import { default as AuthProvider, AuthProviderProps } from '../AuthProvider';
import { AuthResult, MfaChallenge, Schema } from '@plitzi/sdk-shared';
export type BasicAuthProviderProps = AuthProviderProps & {
    loginUrl?: string;
    userUrl?: string;
    refreshUrl?: string;
    logoutUrl?: string;
    sessionExchangeUrl?: Schema['settings']['sessionExchangeUrl'];
    mfaUrl?: Schema['settings']['mfaUrl'];
    detailsPath?: Schema['settings']['detailsPath'];
    tokenPath?: Schema['settings']['tokenPath'];
    refreshTokenPath?: Schema['settings']['refreshTokenPath'];
    expirationTimePath?: Schema['settings']['expirationTimePath'];
    refreshExpirationTimePath?: Schema['settings']['refreshExpirationTimePath'];
};
declare class BasicAuthProvider<U = Record<string, unknown>> extends AuthProvider<U> {
    readonly name = "basic";
    private readonly options;
    constructor({ loginUrl, userUrl, refreshUrl, logoutUrl, sessionExchangeUrl, mfaUrl, detailsPath, tokenPath, refreshTokenPath, expirationTimePath, refreshExpirationTimePath, ...providerProps }?: BasicAuthProviderProps);
    protected get capabilities(): {
        renew: boolean;
        identity: boolean;
    };
    protected get endpoints(): string[];
    /**
     * Two ways in, because a page may already hold a credential.
     *
     * `mode: 'token'` adopts one the page obtained some other way — handed over by a host application, carried in a
     * link, minted by a CLI — and confirms it against the identity endpoint rather than posting anything. Nothing is
     * taken on trust: an unusable token is refused here rather than becoming a session that fails on its first real
     * request. `mode: 'normal'` (the default) posts the credentials.
     */
    protected requestLogin(params: Record<string, unknown>): Promise<AuthResult<U> | MfaChallenge>;
    /** Confirms a token by asking who it belongs to, and only then reports it as a session. */
    private adoptToken;
    /**
     * The refresh token travels in the body under the name the backend reads it by, and by cookie when the backend
     * keeps it in one — a browser session normally does, which is why this works with nothing in storage at all.
     */
    protected requestRenewal(refreshToken?: string): Promise<AuthResult<U>>;
    /**
     * Only happens when the space declares `sessionExchangeUrl`, which is how it says its credentials are obtained in
     * the browser rather than issued by the server that renders it. The server is handed the credential and the name
     * of the provider that issued it — it has to know who to verify it with, and it must refuse anything else.
     */
    protected requestExchange(): Promise<AuthResult<U> | undefined>;
    protected requestIdentity(): Promise<AuthResult<U>>;
    protected requestLogout(): Promise<void>;
    private request;
    /**
     * A right password on an account with a second factor: a challenge, not a session with nobody in it. Read as the
     * latter it ended as `inactive`, and told somebody with a perfectly good account that it could not be used.
     */
    private challengeOf;
    private toResult;
    private tokenFrom;
}
export default BasicAuthProvider;