import type { TKeycloakConfig } from './keycloak.config.js';
/**
 * Keycloak module options — type-aligned with KEYCLOAK_CONFIG_SCHEMA.
 *
 * All fields match the validated schema to ensure options passed to forRoot/forRootAsync
 * conform to strict requirements (especially the online/offline clientSecret contract).
 *
 * Includes optional `mapUserFn` hook to reshape the extracted user identity after successful validation,
 * enabling custom claim mapping for non-standard Keycloak protocol mappers.
 *
 * @example
 * ```ts
 * const options: TKeycloakModuleOptions = {
 *   authServerUrl: 'https://auth.example.com',
 *   realm: 'myrealm',
 *   clientId: 'my-service',
 *   clientSecret: 'secret123',
 *   validationMode: 'online',
 *   mapUserFn: (claims, user) => ({
 *     ...user,
 *     tenantId: claims['urn:custom:tenant_id']
 *   })
 * };
 * ```
 */
export type TKeycloakModuleOptions = TKeycloakConfig;
/**
 * Raw claims decoded from a Keycloak-issued JWT.
 *
 * These are the standard OpenID Connect and Keycloak-specific claims present in
 * access tokens. Additional custom claims added via Keycloak mappers are accessible
 * through the index signature.
 *
 * @example
 * ```ts
 * const claims: IKeycloakTokenClaims = {
 *   sub: 'user-uuid-123',
 *   iss: 'https://auth.example.com/realms/myrealm',
 *   aud: ['my-client'],
 *   exp: 1720000000,
 *   iat: 1719996400,
 *   preferred_username: 'john_doe',
 *   email: 'john@example.com',
 *   realm_access: { roles: ['admin', 'user'] },
 *   resource_access: { 'my-client': { roles: ['editor'] } }
 * };
 * ```
 */
export interface IKeycloakTokenClaims {
    /** Subject — the Keycloak user ID (UUID) */
    sub: string;
    /** Token issuer URL — must match `authServerUrl` (or `issuer` if overridden) */
    iss: string;
    /** Intended audience(s) — must include this service's `clientId` */
    aud: string | string[];
    /** Expiration time (Unix seconds) */
    exp: number;
    /** Issued-at time (Unix seconds) */
    iat: number;
    /** Unique token ID */
    jti?: string;
    /** Authorized party — the client that requested the token */
    azp?: string;
    /** Keycloak session state identifier */
    session_state?: string;
    /** User email address */
    email?: string;
    /** Whether the user's email address has been verified */
    email_verified?: boolean;
    /** Preferred display username */
    preferred_username?: string;
    /** User's full name */
    name?: string;
    /** User's given (first) name */
    given_name?: string;
    /** User's family (last) name */
    family_name?: string;
    /** Realm-level role assignments */
    realm_access?: {
        roles: string[];
    };
    /** Client-level role assignments, keyed by client ID */
    resource_access?: Record<string, {
        roles: string[];
    }>;
    /** Space-separated OAuth 2.0 scopes granted to the token */
    scope?: string;
    /** Additional custom claims from Keycloak mappers */
    [key: string]: unknown;
}
/**
 * Normalised user identity extracted from a validated Keycloak token.
 *
 * Populated by `KeycloakTokenValidationService.ExtractUser` and attached to
 * `request.user` by `JwtAuthGuard`. Inject via `@CurrentUser()` in controllers
 * and resolvers.
 *
 * @example
 * ```ts
 * const user: IKeycloakUser = {
 *   id: 'user-uuid-123',
 *   email: 'john@example.com',
 *   username: 'john_doe',
 *   name: 'John Doe',
 *   realmRoles: ['admin', 'user'],
 *   clientRoles: ['editor', 'viewer']
 * };
 * ```
 */
export interface IKeycloakUser {
    /** The user's unique Keycloak ID (`sub` claim) */
    id: string;
    /** User's email address (`email` claim), if present in the token */
    email?: string;
    /** Preferred display username (`preferred_username` claim) */
    username?: string;
    /** User's full name (`name` claim) */
    name?: string;
    /** Realm-level roles from `realm_access.roles` */
    realmRoles: string[];
    /** Client-level roles from `resource_access[clientId].roles` */
    clientRoles: string[];
}
/**
 * Create a mock IKeycloakUser with sensible test defaults.
 * Override any field by passing a Partial<IKeycloakUser>.
 *
 * This is a pure data factory with no side effects — safe to use in any test context.
 *
 * @param overrides - Partial user object to override defaults
 * @returns IKeycloakUser with merged defaults and overrides
 *
 * @example
 * ```ts
 * const adminUser = CreateMockKeycloakUser({ realmRoles: ['admin'] });
 * const guestUser = CreateMockKeycloakUser({ id: 'guest-id', clientRoles: [] });
 * ```
 */
export declare function CreateMockKeycloakUser(overrides?: Partial<IKeycloakUser>): IKeycloakUser;
//# sourceMappingURL=keycloak.types.d.ts.map