import type { AuthPlugin } from '@owlmeans/server-auth/manager/plugins';
import type { Config, Context } from '../../types.js';
/**
 * Actually the most of implementation desceibed here is a proprietary one and
 * located within OwlMeans Auth service implmentation.
 * We keep it here for easier code navigation and understanding of relying developers
 * about what's going on but we can't show it.
 *
 * @See OwlMeans Auth {AccountLinkingService} interface implementation for more details
 *
 * We need to distinguish the following cases:
 * 1. The user authenticates via owlmenas.org
 *  1.1. The user authenticated in owlmeans.net via IAM product based account.
 *     1.1.1. The user do it for the first time
 *          * We create an account
 *          * We create and link credentials from jwt to the account (i'm not sure if it's required)
 *          * We create the profile
 *          * We create and link credentials from jwt to the profile
 *     1.1.2. The user do it not for the first time
 *          * We found the linked profile by jwt
 *  1.2. The user autehnticated in owlmeans.net via OwlMeans ID
 *     1.2.1. The user do it for the first time
 *          * Figure out if the user has OwlMeans ID linked to the authentication from jwt
 *            (GET /admin/realms/{realm}/users/{id}/federated-identity)
 *          * We create and link credentials from jwt to the profile
 *     1.2.2. The user do it not for the first time
 *          * We found the linked profile by credentials from jwt
 * 2. The user authenticates via a custom identity provider
 *  2.1. The user auhtneticated in his identity provier directly
 *     2.1.1. The user do it for the first time
 *          * We create a profile (we cant request info about his Owlmeans id)!
 *          * We create and link credentials from jwt to the profile
 *          * ! When the user will try to pay for something via this profile
 *          *   we need to force him to link it to owlmeans.net profile / account.
 *     2.1.2. The user do it not for the first time
 *          * We found the linked profile by jwt
 *  2.2. The user authenticated in his identity provider via OwlMeans ID
 *     - This case actually shouldn't know anything about it until the profile is linked to the
 *       owlmeans.net acccount.
 *
 *  Generailized
 *  1. We try to get credentials
 *  2. If there is no credentials we try to get more info abou the user
 *  2.1. To do it we get admin client if it's presented for API access
 *  2.2. If it's presented we get list of identity providers to figure out if there an owlmeans.net id
 *  3. If there is no owlmeans.net account while the login is going through it - we create one
 *  4. If there is no profile - we create one and link oidc credentials
 */
export declare const oidcClientPlugin: <C extends Config, T extends Context<C>>(context: T) => AuthPlugin;
//# sourceMappingURL=oidc-client.d.ts.map