import { HttpRequest } from './auth.js';
/**
 * Common fields used by all OIDC credentialing flows.
 */
export type CommonCredentials = {
    /** The OIDC client ID used for token issuance and exchange flows */
    clientId: string;
    /** The endpoint of the OIDC IdP to authenticate against, ex. 'https://virtru.com/auth' */
    oidcOrigin: string;
    /** the client's public key, base64 encoded. Will be bound to the OIDC token. Deprecated. If not set in the constructor, */
    clientPubKey?: string;
    /** the client's public key, base64 encoded. Will be bound to the OIDC token. Deprecated. If not set in the constructor, */
    signingKey?: CryptoKeyPair;
};
/**
 * Information needed for Client Secret OIDC credentialing flow
 */
export type ClientSecretCredentials = CommonCredentials & {
    exchange: 'client';
    /** The OIDC client secret, used for token issuance and exchange flows */
    clientSecret: string;
};
/**
 * Information needed for getting new access tokens with a refresh token
 */
export type RefreshTokenCredentials = CommonCredentials & {
    exchange: 'refresh';
    /** The OIDC refresh token content */
    refreshToken: string;
};
/**
 * Information needed to exchange a standard or external JWT for a TDF claims
 * annotated JWT
 */
export type ExternalJwtCredentials = CommonCredentials & {
    exchange: 'external';
    /** The external JWT used for exchange */
    externalJwt: string;
};
export type OIDCCredentials = ClientSecretCredentials | ExternalJwtCredentials | RefreshTokenCredentials;
export type AccessTokenResponse = {
    access_token: string;
    refresh_token?: string;
};
/**
 * Class that provides OIDC functionality to auth providers, assuming 'enhanced'
 * tokens and sessions with tdf_claims and either one or both of signing keys
 * or DPoP.
 *
 * Note that this class itself is not a provider - providers implement
 * `AuthProvider` and make use of this class.
 *
 * Both browser and non-browser flows use OIDC, but the supported OIDC auth
 * mechanisms differ between  public (e.g. browser) clients, and confidential
 * (e.g. Node) clients.
 *
 * The non-browser flow just expects a `clientId` and `clientSecret` to be
 * provided in the `clientConfig`, and will use that
 * to grant tokens via the OIDC `clientCredentials` flow.
 *
 * For either kind of client, the client's public key must be set in all OIDC
 * token requests in order to recieve a token with valid TDF claims. The public
 * key may be passed to this provider's constructor, or supplied
 * post-construction by calling @see updateClientPublicKey, which forces an
 * explicit token refresh
 */
export declare class AccessToken {
    config: OIDCCredentials;
    request?: (input: RequestInfo, init?: RequestInit) => Promise<Response>;
    data?: AccessTokenResponse;
    baseUrl: string;
    signingKey?: CryptoKeyPair;
    clientPubKey?: string;
    extraHeaders: Record<string, string>;
    currentAccessToken?: string;
    constructor(cfg: OIDCCredentials, request?: typeof fetch);
    /**
     * https://connect2id.com/products/server/docs/api/userinfo
     * @param accessToken the current access_token or code
     * @returns
     */
    info(accessToken: string): Promise<unknown>;
    doPost(url: string, o: Record<string, string>): Promise<Response>;
    accessTokenLookup(cfg: OIDCCredentials): Promise<any>;
    /**
     * Gets an access token; operates lazily/cached, with an optional check for freshness.
     * @param validate if we should run a inline check against the OIDC 'userinfo' endpoint to make sure any cached access token is still valid
     * @returns
     */
    get(validate?: boolean): Promise<string>;
    /**
     * A TDF client MUST call this method whenever the client wants to use a new
     * ephemeral key set. This updates the keys used to:
     * or wishes to set the keypair after creating the object.
     *
     * Calling this function will trigger a forcible token refresh using the cached refresh token, and contact the auth server.
     */
    refreshTokenClaimsWithClientPubkeyIfNeeded(clientPubKey: string, signingKey?: CryptoKeyPair): Promise<void>;
    /**
     * Converts included refresh token or external JWT for a new one.
     */
    exchangeForRefreshToken(): Promise<string>;
    withCreds(httpReq: HttpRequest): Promise<HttpRequest>;
}
//# sourceMappingURL=oidc.d.ts.map