/**
 * Copyright (c) 2020-present, Goldman Sachs
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
import { type GeneratorFn, ActionState } from '@finos/legend-shared';
import { type ApplicationStore } from '@finos/legend-application';
import { SDLCServerClient } from '@finos/legend-server-sdlc';
import { DepotServerClient } from '@finos/legend-server-depot';
import type { LegendStudioPluginManager } from '../application/LegendStudioPluginManager.js';
import type { LegendStudioApplicationConfig } from '../application/LegendStudioApplicationConfig.js';
export type LegendStudioApplicationStore = ApplicationStore<LegendStudioApplicationConfig, LegendStudioPluginManager>;
export declare class LegendStudioBaseStore {
    readonly applicationStore: LegendStudioApplicationStore;
    readonly sdlcServerClient: SDLCServerClient;
    readonly depotServerClient: DepotServerClient;
    readonly pluginManager: LegendStudioPluginManager;
    readonly initState: ActionState;
    readonly popupReAuthState: ActionState;
    isSDLCAuthorized: boolean | undefined;
    private isSDLCServerInitialized;
    SDLCServerTermsOfServicesUrlsToView: string[];
    /**
     * Tracks whether an automatic popup re-auth has already been attempted for
     * the current "failure episode". An episode is the window between two
     * successful SDLC interactions: the flag is set on the first auto-attempt
     * and cleared whenever a re-auth (auto or manual) succeeds. This is what
     * prevents endless 401 → popup → 401 loops.
     */
    private autoPopupReAuthAttempted;
    /**
     * Dedupes concurrent auto callers of `handleSDLCUnauthorized`. Wraps the
     * raw popup promise with the auto-flow notification logic (manual-fallback
     * warning on failure) so all concurrent 401-driven callers get the same
     * resolution and only one warning fires per attempt.
     */
    private inFlightAutoReAuth;
    /**
     * The raw popup promise, set by `reAuthorizeSDLCInPopup` for the duration
     * of an on-screen popup REGARDLESS of who opened it (manual shield click
     * OR auto-trigger). `handleSDLCUnauthorized` consults this before deciding
     * to consume the episode and warn — without it, a 401 raised while the
     * user is in a manually-opened popup would either stack a second popup or
     * pop a "click the shield" warning at them while the shield's popup is in
     * front of them.
     */
    private inFlightReAuth;
    /**
     * Per-episode dedup flag for the "click the shield to retry" warning.
     * `handleSDLCUnauthorized` can be re-entered many times within a single
     * failure episode (every subsequent failing SDLC request in a burst lands
     * in the loop-guard branch); without this flag, each one would stack an
     * identical toast. Cleared alongside `autoPopupReAuthAttempted` on a
     * successful re-auth so the next episode can warn again.
     */
    private manualReAuthNotifiedForEpisode;
    /**
     * Re-entry guard for the network layer's 401 hook. Set to `true` while we
     * are re-bootstrapping the SDLC session inside the popup-success path so
     * that a 401 raised by the re-bootstrap requests themselves (e.g. the
     * `isAuthorized` verification GET coming back 401 because cookies didn't
     * actually land) cannot recurse into `handleSDLCUnauthorized` — that would
     * return the still-in-flight outer promise and deadlock the whole chain.
     */
    private suppressAutoReAuth;
    constructor(applicationStore: LegendStudioApplicationStore);
    initialize(): GeneratorFn<void>;
    get needsToAcceptSDLCServerTermsOfServices(): boolean;
    dismissSDLCServerTermsOfServicesAlert(): void;
    /**
     * Whether the popup-based SDLC re-authentication flow is available.
     *
     * The feature is opt-in via the `sdlc.enablePopupReAuth` config flag
     * because the derived callback URL must be explicitly registered as an
     * OAuth `redirect_uri` on the SDLC server. When `false` (or unset), only
     * the legacy top-level redirect flow is available.
     */
    get isSDLCPopupReAuthEnabled(): boolean;
    /**
     * 401 interception hook wired into the SDLC server client. Triggers the
     * popup re-auth flow automatically — without any user action — but only
     * once per failure episode to guard against retry loops.
     *
     * @returns a promise resolving to `true` if the SDLC server is now
     * authorized (i.e. the underlying network layer should retry the original
     * request), `false` otherwise.
     */
    private handleSDLCUnauthorized;
    /**
     * Best-effort notification that nudges the user toward the manual
     * re-authentication entry point (the StatusBar shield button) when the
     * automatic flow could not complete (popup blocked, user dismissed, or
     * the retry still 401'd).
     *
     * Deduped per failure episode: subsequent 401s within the same episode
     * (a burst of editor requests after session expiry, for example) all hit
     * the loop-guard branch and would otherwise each stack an identical
     * warning toast. The flag is cleared when a re-auth attempt succeeds.
     */
    private notifyManualReAuthAvailable;
    /**
     * Re-initiate the SDLC authorization step in a popup window so that the
     * user can recover from an expired SDLC session without losing in-memory
     * editor state (open tabs, unsaved buffers, etc.).
     *
     * The popup loads the SDLC server's `/auth/authorize?redirect_uri=...`
     * endpoint with a same-origin callback page as the `redirect_uri`. That
     * URL is derived at runtime via the navigator — the same way the
     * boot-time auth flow derives its own `redirect_uri` — so deployments
     * only need to declare intent (`sdlc.enablePopupReAuth: true`) and ship
     * the static `popup-callback.html` page at their base URL.
     *
     * The callback page is expected to `postMessage` back to the opener with
     * payload `{ type: 'SDLC_REAUTH_DONE' }` and then close itself.
     *
     * On success, the SDLC server client is re-checked and re-initialized in
     * place — no top-level navigation, no state loss.
     *
     * @returns a promise that resolves to `true` if the SDLC server is
     * authorized after the popup flow completes, `false` otherwise (popup
     * blocked, user cancelled, authorization check still failing, ...).
     */
    reAuthorizeSDLCInPopup(): Promise<boolean>;
    /**
     * Shared post-auth bootstrap: ToS gate, platforms, features. Plain
     * generator (not a flow) — delegated to from both `initializeSDLCServerClient`
     * (the boot-time flow) and `verifySDLCSessionAfterReAuth` (the popup-success
     * flow) via `yield*`. Caller is responsible for asserting `isSDLCAuthorized`
     * beforehand.
     */
    private bootstrapSDLCSessionAfterAuth;
    /**
     * Verify the SDLC session after a popup re-auth attempt completes, and
     * re-bootstrap the session in place if it took. Returns `true` if the
     * session is now usable, `false` if the SDLC server still reports the
     * session as unauthorized (e.g. cookies didn't actually land, user authed
     * against the wrong identity).
     *
     * Unlike `initializeSDLCServerClient`, this does NOT do a top-level
     * redirect on `!isAuthorized` — preserving in-memory editor state is the
     * entire reason the popup flow exists.
     */
    private verifySDLCSessionAfterReAuth;
    private initializeSDLCServerClient;
}
//# sourceMappingURL=LegendStudioBaseStore.d.ts.map