import { App } from 'firebase-admin/app';
import { Auth, DecodedIdToken } from 'firebase-admin/auth';
import { AuthProvider } from './_internal/types.js';
import { HttpsBroker } from './https/https-types.js';
import { IdGenerator } from './id-generator.js';
import { AltKey, AppCheckConstructor, AppCheckData, AuthContextOptions, AuthenticatedRequestContext, AuthKey, AuthTokenOptions, IdentityConstructor, IdentityOptions, MockIdentity, UnauthenticatedRequestContext } from './types.js';
/**
 * Construction options for {@link AuthManager}.
 *
 * @remarks
 * These options let you fix the “environment” your tests run in — time source,
 * project identity, region, and even stable OAuth provider IDs — so that
 * repeated invocations generate deterministic tokens and contexts.
 *
 * - All properties are optional.
 * - Missing values are synthesized to realistic Firebase-looking values.
 */
export interface AuthManagerOptions {
    /**
     * Function that returns the current epoch milliseconds.
     *
     * @remarks
     * - Used to derive `iat`, `auth_time`, and `exp` when not explicitly provided
     *   in {@link AuthContextOptions}.
     * - Override this in tests to get deterministic timestamps.
     * - Defaults to `() => Date.now()`.
     */
    now?: () => number;
    /**
     * Firebase App ID used to populate App Check tokens (`sub`, `app_id`).
     *
     * @remarks
     * If omitted, a synthetic app ID is generated from the project number so the
     * resulting token “looks” real.
     */
    appId?: string;
    /**
     * Firebase **project number** used as part of the App Check audience.
     *
     * @remarks
     * Defaults to a generated project number.
     */
    projectNumber?: string;
    /**
     * Firebase **project ID** (human-readable) used as the App Check audience.
     *
     * @remarks
     * Defaults to a sensible value (`"default-project"`) so tests do not need
     * to supply it.
     */
    projectId?: string;
    /**
     * Default Cloud Functions region used by the HTTPS broker.
     *
     * @remarks
     * This is applied to all mock HTTPS invocations made through
     * {@link AuthManager.https}.
     * Defaults to `'nam5'`.
     */
    region?: string;
    /**
     * If required, an `App` definition to apply to the `Auth` mock.
     * If `app` is not provided, a default will be generated.
     */
    app?: App;
}
/**
 * Test-focused provider for mock authentication and App Check contexts
 * for Firebase HTTPS functions.
 *
 * @typeParam TKey - The key type used to register and retrieve identities
 * (defaults to {@link AuthKey}).
 *
 * @remarks
 * - Keeps an in-memory registry of identity **templates** keyed by `TKey`.
 * - Produces fresh per-invocation auth contexts with realistic time claims.
 * - Can automatically attach an App Check token to each context.
 * - Exposes an {@link HttpsBroker} prebound to this manager’s project/region.
 */
export declare class AuthManager<TKey extends AuthKey = AuthKey> implements AuthProvider<TKey> {
    private _tenantManager;
    /**
     * Firebase App ID used for App Check tokens (`sub`, `app_id`).
     */
    readonly appId: string;
    /**
     * Firebase project **number** used in App Check token audience.
     */
    readonly projectNumber: string;
    /**
     * The audience for which App Check tokens are intended. Equal to your Firebase **project ID**.
     */
    readonly projectId: string;
    /**
     * Default Cloud Functions region used by {@link https}.
     */
    readonly region: string;
    /**
     * Issuer string used for App Check tokens, derived from the {@link projectNumber}.
     */
    readonly iss: string;
    /**
     * The HTTPS broker bound to this manager’s defaults (project/region).
     *
     * @remarks
     * The broker is used to invoke mock HTTPS callable/HTTP handlers with synthesized auth/app contexts.
     */
    readonly https: HttpsBroker<TKey>;
    /**
     * Auth facade exposing a high-fidelity mock of the Admin SDK Auth API.
     *
     * @remarks
     * Backed by the same internal `AuthInstance` map that powers context
     * generation, so operations such as `updateUser` are reflected in future
     * tokens and request contexts.
     */
    readonly auth: Auth;
    /**
     * Identifier generator helper for tests.
     *
     * @remarks
     * Exposes the {@link IdGenerator} API directly on the manager for convenience,
     * allowing test code to generate realistic Firebase-like UIDs, provider UIDs,
     * project numbers, and other pseudo-random identifiers without importing
     * `IdGenerator` separately.
     *
     * Identifiers are pseudo-random and **not cryptographically secure**.
     */
    readonly idGen: typeof IdGenerator;
    /**
     * Create a new {@link AuthManager} with optional environment overrides.
     *
     * @param options - Optional initialization overrides. See {@link AuthManagerOptions}.
     */
    constructor(options?: AuthManagerOptions);
    /**
     * Register a normalized identity template under the specified key.
     *
     * @param key - Registry key to associate with this identity.
     * @param identity - Lightweight constructor (partial) that will be normalized.
     * @returns The UID of the newly registered identity.
     *
     * @throws {Error} If the key has already been registered.
     *
     * @remarks
     * - The identity is normalized via an internal {@link authInstance} helper.
     * - The stored template is immutable from the caller’s perspective; runtime
     *   methods return deep-cloned copies.
     */
    register(key: TKey, identity?: IdentityConstructor): string;
    /**
     * Returns the current time according to the instance's configured or default time provider
     */
    now(): Date;
    /**
     * Deregister a previously registered identity.
     *
     * @param key - Registry key to remove.
     * @returns `true` if the identity existed and was removed, otherwise `false`.
     *
     * @remarks
     * This removes both the default template and its active instance, so any
     * subsequent attempts to use `key` for a context will fail with an error.
     */
    deregister(key: TKey): boolean;
    /**
     * Reset mutable identity instances back to their registered defaults.
     *
     * @remarks
     * - Clears the internal instance map and re-clones all registered defaults.
     * - Does **not** remove registered identities; use {@link deregister} for that.
     * - Useful between tests to discard mutations from Admin SDK calls
     *   (`updateUser`, etc.) while keeping the registry intact.
     */
    reset(): void;
    /**
     * Clears all state, including registered identities.
     */
    clear(): void;
    /**
     * Build a request-auth context, either authenticated (when `key` is supplied)
     * or unauthenticated (when `key` is omitted).
     *
     * @param options - Per-invocation overrides (identity key, times, App Check).
     * @returns An {@link AuthenticatedRequestContext} or {@link UnauthenticatedRequestContext}.
     *
     * @throws {Error} If a `key` is supplied but no identity is registered for it.
     *
     * @remarks
     * - Authenticated case:
     *   - `iat` defaults to `now()`
     *   - `auth_time` defaults to `iat - 30m`
     *   - `exp` defaults to `iat + 30m`
     *   - Multi-factor details are applied if configured via
     *     {@link IdentityConstructor.multiFactorDefault} or
     *     {@link IdentityOptions.multifactorSelector}.
     * - Unauthenticated case:
     *   - Only `projectId` and optional App Check are included.
     * - Set `appCheck: false` to omit App Check for this call.
     */
    context(options?: AuthContextOptions<TKey>): UnauthenticatedRequestContext | AuthenticatedRequestContext;
    /**
     * Resolve a normalized {@link MockIdentity} for the given registry key.
     *
     * @param key - Registry key for the identity.
     * @param options - Optional provider and multi-factor selection overrides.
     * @returns A {@link MockIdentity} suitable for embedding into a request context.
     *
     * @throws {Error} If the key is not registered, the backing instance is
     *         missing, or the identity is disabled.
     *
     * @remarks
     * - Applies provider-derived identities (email/phone) into the
     *   `firebase.identities` bag.
     * - Chooses a default `sign_in_provider` when `options.signInProvider`
     *   is not supplied (first non-anonymous provider or `'anonymous'`).
     * - Applies multi-factor details based on {@link IdentityOptions.multifactorSelector}.
     * - Copies validated custom claims from the underlying `AuthInstance`.
     */
    identity(key: TKey | AltKey, options?: IdentityOptions): MockIdentity;
    /**
     * Synthesize a `DecodedIdToken` from constructor values.
     *
     * @param options - object containing a key to resolve the authenticated identity,
     * and optionally explicit `iat`/`exp` etc.
     * @returns A synthesized {@link DecodedIdToken}.
     */
    token(options: AuthTokenOptions<TKey>): DecodedIdToken;
    /**
     * Synthesize an App Check payload from optional constructor values.
     *
     * @param c - Optional seed object containing explicit `iat`/`exp` or custom claims.
     * @returns A normalized {@link AppCheckData} ready to attach to a request context.
     *
     * @remarks
     * - Always enforces this manager’s `appId`, `aud`, and `iss`.
     * - Defaults to a 60-minute validity window when times are not provided.
     * - Preserves arbitrary additional properties on the token.
     */
    appCheck(c?: AppCheckConstructor | undefined): AppCheckData;
    private authInstance;
}
//# sourceMappingURL=auth-manager.d.ts.map