import type { User, UserManagerSettings } from 'oidc-client-ts';
/**
 * Specifies where the OIDC user session is persisted.
 * - `'sessionStorage'` — (default) cleared when the tab closes; isolated per tab.
 * - `'localStorage'` — survives page reloads; shared across same-origin tabs (use with caution in XSS-prone environments).
 * @example
 * ```tsx
 * // Use in AuthProvider config:
 * const config: KeycloakAuthConfig = {
 *   storageType: 'sessionStorage', // or 'localStorage'
 *   // ... other config fields
 * };
 * ```
 */
export type StorageType = 'sessionStorage' | 'localStorage';
/**
 * Configuration for the AuthProvider.
 * Extends oidc-client-ts `UserManagerSettings` with Keycloak-specific defaults
 * and a configurable token storage strategy.
 * @example
 * ```tsx
 * const config: KeycloakAuthConfig = {
 *   authority: 'https://keycloak.example.com/realms/my-realm',
 *   client_id: 'my-app',
 *   redirect_uri: 'https://app.example.com/auth/callback',
 * };
 * ```
 */
export interface KeycloakAuthConfig extends Omit<UserManagerSettings, 'userStore' | 'stateStore'> {
    /**
     * Keycloak realm base URL.
     * Format: `https://{host}/realms/{realm}` (Keycloak 17+)
     * Format: `https://{host}/auth/realms/{realm}` (Keycloak ≤ 16)
     */
    readonly authority: string;
    /** Client ID of a public (non-confidential) Keycloak client. */
    readonly client_id: string;
    /** URI to redirect to after a successful login. Must be registered in Keycloak. */
    readonly redirect_uri: string;
    /**
     * URI to redirect to after logout.
     * Must be registered in Keycloak's "Valid post logout redirect URIs".
     */
    readonly post_logout_redirect_uri?: string;
    /**
     * URI the Keycloak popup window redirects to after authentication.
     * Must be registered in Keycloak's "Valid redirect URIs".
     *
     * When configured, `loginWithPopup()` opens a child window at this URI,
     * completes the Authorization Code + PKCE exchange there, and posts the
     * result back to the parent — so the user never navigates away from the
     * main page.
     *
     * Typically set to `${window.location.origin}/auth/popup-callback`.
     */
    readonly popup_redirect_uri?: string;
    /**
     * OAuth2/OIDC scopes to request.
     * Defaults to `'openid profile email'`.
     * Add `'offline_access'` for long-lived refresh tokens.
     */
    readonly scope?: string;
    /**
     * Where to persist the OIDC user session and OAuth state parameters.
     * - `'sessionStorage'` (default) — cleared when the tab closes; tab-isolated.
     * - `'localStorage'` — survives page reloads; shared across same-origin tabs.
     */
    readonly storageType?: StorageType;
    /**
     * Optional callback invoked after a successful signin redirect callback.
     * Use this to navigate the user to their intended destination, e.g.:
     * `onSigninCallback={() => navigate('/')}`
     */
    readonly onSigninCallback?: (user: User) => void;
}
/**
 * Snapshot of the current authentication state.
 * @example
 * ```tsx
 * const { isAuthenticated, isLoading, user, error } = useAuth();
 * ```
 */
export interface AuthState {
    /** Whether the user is authenticated with a valid, non-expired access token. */
    readonly isAuthenticated: boolean;
    /** Whether an auth operation is in progress (initial hydration, callback processing, silent renew). */
    readonly isLoading: boolean;
    /** The authenticated OIDC user object, or `null` when not authenticated. */
    readonly user: User | null;
    /** The most recent auth error, or `null` if no error has occurred. */
    readonly error: Error | null;
}
/**
 * Value exposed by the AuthContext and returned by `useAuth()`.
 * @example
 * ```tsx
 * const auth = useAuth();
 * await auth.login();
 * const token = await auth.getAccessToken();
 * if (token) {
 *   // Use token for authenticated requests
 * }
 * await auth.logout();
 * ```
 */
export interface AuthContextValue extends AuthState {
    /**
     * Initiates the Keycloak Authorization Code + PKCE redirect flow.
     * PKCE (S256) is enabled by default — no additional configuration is required.
     */
    readonly login: () => Promise<void>;
    /**
     * Opens a Keycloak login popup window and completes Authorization Code + PKCE
     * flow without navigating the main page.
     *
     * Requires `popup_redirect_uri` to be configured on `AuthProvider` and
     * registered in Keycloak's "Valid redirect URIs".
     *
     * If the popup is blocked by the browser this method throws — callers should
     * catch and fall back to {@link login} if desired.
     */
    readonly loginWithPopup: () => Promise<void>;
    /**
     * Redirects to the Keycloak `end_session_endpoint` and clears the local session.
     * Requires `post_logout_redirect_uri` to be configured and registered in Keycloak.
     */
    readonly logout: () => Promise<void>;
    /**
     * Retrieves the current access token, triggering silent renewal if the token is expired.
     *
     * @returns The access token string, or `null` if the user is not authenticated or if
     * silent renewal fails. When renewal fails the error is also stored in the context `error`
     * field — inspect `useAuth().error` to distinguish "not authenticated" from "renewal failed".
     */
    readonly getAccessToken: () => Promise<string | null>;
    /**
     * Removes the user from storage and resets auth state without redirecting to
     * Keycloak. Useful for handling session expiry silently.
     */
    readonly clearSession: () => Promise<void>;
}
//# sourceMappingURL=auth.types.d.ts.map