import * as auth_pb from "./generated/auth_pb";
import { UUID } from "./typesCommon";
import { MessageFactory } from "./typesConvert";
export type AuthCapability = 'JWT_RS256';
export type TokenId = UUID;
export type OrganizationId = UUID;
export type ProjectId = UUID;
/**
 * A token to authenticate with API. Format: emrld_ + 38 random alphanumeric characters.
 * When it's a one-time auth token, it starts with "emrld_temp_"
 */
export type SecretToken = string;
export declare function isSecretToken(token: string): token is SecretToken;
export type RefreshToken = string;
export declare function isRefreshToken(token: string): token is RefreshToken;
export type AuthRequest = {
    agent: string[];
    secret: SecretToken;
};
export type RefreshRequest = {
    refreshToken: RefreshToken;
};
export type AuthResponseOk = {
    status: number;
    jwt: string;
    expiresAt: Date;
    refreshToken: RefreshToken;
};
export type AuthResponseFail = {
    status: number;
    denyMessage: string;
};
export type AuthResponse = AuthResponseOk | AuthResponseFail;
export declare function isAuthResponseOk(res: AuthResponse): res is AuthResponseOk;
export declare function isAuthResponseFail(res: AuthResponse): res is AuthResponseFail;
export type IAmAuthenticated = {
    authenticated: true;
    tokenId: TokenId;
};
export type IAMUnauthenticated = {
    authenticated: false;
};
export type WhoIAmResponse = IAmAuthenticated | IAMUnauthenticated;
export type ListTokensRequest = {
    organizationId: OrganizationId;
    projectId?: ProjectId;
};
export type ListTokensResponse = {
    tokens: TokenDetails[];
};
export type TokenDetails = {
    organizationId: OrganizationId;
    projectId: ProjectId;
    tokenId: TokenId;
    createdAt: Date;
    description?: string;
};
export type IssueTokenRequest = {
    /**
     * Type of the token to issue
     * - "temp" - one-time token
     * - "permanent" - long-live token that can be used multiple times
     */
    type: "temp" | "permanent";
    /**
     * The scopes to be used for the token. Cannot be larger that the current authenticated scopes.
     */
    scopes?: string[];
    /**
     * The user id associated with the token, i.e. who will use the token.
     * There are restrictions who can set this. In short the token issuer must be in control of the user / impersonate the user.
     */
    userId?: string;
    /**
     * A timestamp when it expires.
     * For a temp one-time token, by default, it's 1 Day and cannot be more than 30 days.
     */
    expireAt?: Date;
    /**
     * (for a permanent token) organization id for the token
     */
    organizationId?: OrganizationId;
    /**
     * (for a permanent token) project id for the token
     */
    projectId?: ProjectId;
    /**
     * (for a permanent token) description of the token
     */
    description?: string;
};
export type IssuedTokenResponse = {
    /**
     * The issued token
     */
    secret: SecretToken;
    /**
     * When the token expires
     */
    expiresAt: Date;
};
export type DeleteTokenRequest = {
    organizationId: OrganizationId;
    projectId: ProjectId;
    tokenId: TokenId;
};
export type DeleteTokenResponse = Record<string, never>;
export declare class ConvertAuth {
    private readonly factory;
    constructor(factory: MessageFactory);
    authRequest(req: AuthRequest): auth_pb.AuthRequest;
    refreshRequest(req: RefreshRequest): auth_pb.RefreshRequest;
    authResponse(res: auth_pb.AuthResponse): AuthResponse;
    whoIAmResponse(res: auth_pb.WhoAmIResponse): WhoIAmResponse;
    listTokensRequest(req: ListTokensRequest): auth_pb.ListTokensRequest;
    listTokensResponse(res: auth_pb.ListTokensResponse): ListTokensResponse;
    issueTokenRequest(req: IssueTokenRequest): auth_pb.IssueTokenRequest;
    issuedTokenResponse(res: auth_pb.IssuedTokenResponse): IssuedTokenResponse;
    deleteTokenRequest(req: DeleteTokenRequest): auth_pb.DeleteTokenRequest;
    deleteTokenResponse(res: auth_pb.DeleteTokenResponse): DeleteTokenResponse;
}
/**
 * A subset of the Auth API used to get credentials
 */
export interface CredentialsClient {
    authenticate(req: AuthRequest): Promise<AuthResponse>;
    refresh(req: RefreshRequest): Promise<AuthResponse>;
}