/**
 * OAuth Endpoint Handlers
 *
 * Handler functions for OAuth authentication endpoints
 */
import type { RequestTarget } from 'harper';
import type { Request, Logger, IOAuthProvider, MCPConfig, OAuthProviderConfig } from '../types.ts';
import type { HookManager } from './hookManager.ts';
/**
 * Sanitize a redirect parameter to prevent open redirect attacks
 *
 * Takes a user-provided redirect URL and extracts only the path portion,
 * stripping any protocol, domain, or port information.
 *
 * Blocks dangerous protocols like javascript:, data:, vbscript:, and file:
 * to prevent XSS and other injection attacks.
 *
 * @param redirectParam - User-provided redirect URL (may be absolute, relative, or protocol-relative)
 * @returns Safe relative path (pathname + search + hash), or '/' if invalid
 *
 * @example
 * sanitizeRedirect('https://evil.com/phish')  // '/phish'
 * sanitizeRedirect('//evil.com/phish')        // '/phish'
 * sanitizeRedirect('/dashboard')              // '/dashboard'
 * sanitizeRedirect('javascript:alert(1)')     // '/'
 * sanitizeRedirect('invalid')                 // '/'
 */
export declare function sanitizeRedirect(redirectParam: string): string;
/**
 * Resolve a redirect provided by the onLogin hook (trusted app code, not user
 * input). Unlike sanitizeRedirect, absolute http(s) URLs pass through — an app
 * may legitimately send the user to another host (e.g. a central onboarding
 * page). Anything else falls back to sanitizeRedirect's path-only handling,
 * which also neutralizes javascript:/data: schemes and protocol-relative URLs.
 */
export declare function resolveHookRedirect(redirect: string): string;
/**
 * Handle OAuth login initiation
 */
export declare function handleLogin(request: Request, target: RequestTarget, provider: IOAuthProvider, config: OAuthProviderConfig, providerName: string, logger?: Logger): Promise<any>;
/**
 * Handle OAuth callback from provider
 */
export declare function handleCallback(request: Request, target: RequestTarget, provider: IOAuthProvider, config: OAuthProviderConfig, hookManager: HookManager, providerName: string, opts?: {
    mcpConfig?: MCPConfig;
    logger?: Logger;
}): Promise<any>;
/**
 * Clear OAuth session data and log out the user
 * Shared function for explicit logout and automatic logout on token expiration
 *
 * Deletes the session record from the hdb_session table, completely removing it
 * rather than just clearing the user field. This ensures no orphaned sessions remain.
 */
export declare function clearOAuthSession(session: any, logger?: Logger): Promise<void>;
/**
 * Handle user logout
 */
export declare function handleLogout(request: Request, hookManager: HookManager, logger?: Logger): Promise<any>;
/**
 * Get current user info
 */
export declare function handleUserInfo(request: Request, tokenRefreshed?: boolean): Promise<any>;
/**
 * Serve OAuth test page
 */
export declare function handleTestPage(logger?: Logger): Promise<any>;