import { AuthResponseDTO } from '../dto/auth-response.dto';
import { StartSocialRedirectResponseDTO, SocialRedirectCallbackResponseDTO } from '../dto/social-redirect.dto';
import { NAuthConfig } from '../interfaces/config.interface';
import { ISocialAuthStateStore } from '../interfaces/social-auth-state-store.interface';
import { StorageAdapter } from '../interfaces/storage-adapter.interface';
import { SocialProviderRegistry } from '../services/social-provider-registry.service';
import { NAuthLogger } from '../utils/nauth-logger';
/**
 * Social Redirect Handler (framework-neutral)
 *
 * Consumer backends should implement their own HTTP controllers/routes and delegate to this handler.
 * The handler returns a small "response recipe" that the consumer applies to their framework response.
 *
 * Key properties:
 * - Backend-first redirect (provider -> backend callback -> frontend)
 * - Cluster-safe CSRF `state` storage via `ISocialAuthStateStore` (StorageAdapter-backed)
 * - Optional `appState` round-trip (opaque string, URL-encoded)
 * - Supports `cookies`, `json`, and `hybrid` (origin-based) delivery modes
 *
 * @example
 * ```typescript
 * // NestJS controller
 * const result = await socialRedirect.start(provider, dto);
 * return result; // { url }
 *
 * const result = await socialRedirect.callback(provider, dto);
 * return result; // { url } - cookies applied via HTTP_RESPONSE in context
 *
 * const auth = await socialRedirect.exchange(exchangeToken);
 * return auth;
 * ```
 */
export declare class SocialRedirectHandler {
    private readonly config;
    private readonly providerRegistry;
    private readonly socialStateStore;
    private readonly storage;
    private readonly logger?;
    private readonly csrfService;
    private readonly exchangeTtlSeconds;
    constructor(config: NAuthConfig, providerRegistry: SocialProviderRegistry, socialStateStore: ISocialAuthStateStore, storage: StorageAdapter, logger?: NAuthLogger | undefined, exchangeTtlSeconds?: number);
    /**
     * Start redirect-first social login.
     *
     * Delivery and deviceToken are read from ContextStorage (set by framework before controller).
     *
     * @param provider - OAuth provider (e.g. 'google', 'apple', 'facebook')
     * @param dto - Query DTO with returnTo, appState, action, oauthParams (JSON string)
     * @returns Redirect URL for NestJS @Redirect() or equivalent
     * @throws {NAuthException} When provider/returnTo are invalid or config is missing
     */
    start(provider: string, dto: {
        returnTo?: string;
        appState?: string;
        action?: 'login' | 'link';
        oauthParams?: string;
    }): Promise<StartSocialRedirectResponseDTO>;
    /**
     * Handle provider callback and produce a frontend redirect.
     *
     * In cookies mode, applies cookies directly to HTTP_RESPONSE from ContextStorage.
     *
     * @param provider - OAuth provider (e.g. 'google', 'apple', 'facebook')
     * @param dto - Callback params (GET query or POST form); may include error_description (underscore)
     * @returns Redirect URL for NestJS @Redirect() or equivalent
     * @throws {NAuthException} When required params are missing/invalid
     */
    callback(provider: string, dto: {
        code?: string;
        state?: string;
        error?: string;
        error_description?: string;
        user?: string;
        profileData?: Record<string, unknown>;
    }): Promise<SocialRedirectCallbackResponseDTO>;
    /**
     * Apply cookie recipe to the HTTP response from ContextStorage.
     * Supports both Express (res.cookie) and Fastify (res.setCookie).
     */
    private applyCookiesToResponse;
    /**
     * Exchange a short-lived exchange token for an AuthResponse.
     *
     * @param exchangeToken - One-time token from callback redirect URL
     * @returns AuthResponse payload (tokens or challenge)
     * @throws {NAuthException} When exchangeToken is invalid/expired
     */
    exchange(exchangeToken: string): Promise<AuthResponseDTO>;
    private buildAuthCookies;
    private buildCsrfCookie;
    private getFrontendBaseUrl;
    private buildFrontendRedirectUrl;
    private appendQuery;
    private resolveEffectiveDelivery;
    private normalizeProvider;
    private getExchangeKey;
    private safeParseExchangePayload;
    /**
     * Sanitize AuthResponse for cookies mode
     *
     * Removes tokens and expiration fields from response body when cookies mode is used.
     * Follows same principle as signup/login endpoints - tokens delivered via httpOnly cookies,
     * not in response body.
     *
     * @param authResponse - Original auth response with tokens
     * @returns Sanitized auth response without tokens and expiries
     */
    private sanitizeAuthResponseForCookies;
}
//# sourceMappingURL=social-redirect.handler.d.ts.map