import { Hono } from "hono";
import type { AuthRepository, OAuthProvider } from "./interfaces";
import type { AuthHooks } from "./auth-hooks";
import { EmailService, EmailConfig } from "../email";
import { HonoEnv } from "../api/types";
/**
 * Shared configuration for auth and admin route factories.
 */
export interface AuthModuleConfig {
    authRepo: AuthRepository;
    emailService?: EmailService;
    emailConfig?: EmailConfig;
    /** Allow new user registration (default: false). */
    allowRegistration?: boolean;
    /** Expose the authenticated email→minimal-profile lookup route (default: false). */
    allowUserLookup?: boolean;
    /** Default role ID to assign to new users (default: none). Must NOT be "admin". */
    defaultRole?: string;
    /** Optional array of OAuth providers */
    oauthProviders?: OAuthProvider<unknown>[];
    /** When true, blocks all self-registration regardless of `allowRegistration`. */
    disableSelfRegistration?: boolean;
    /**
     * Auth hooks for customizing password hashing, credential
     * verification, lifecycle hooks, etc.
     */
    authHooks?: AuthHooks;
    /**
     * Callback that checks if bootstrap has already been completed.
     * Used by GET /auth/config to report `needsSetup` status.
     * When not provided, falls back to checking if any users exist.
     */
    isBootstrapCompleted?: () => Promise<boolean>;
    /** Enable magic link (passwordless email) login. Requires email service. */
    enableMagicLink?: boolean;
    /**
     * Opt-in httpOnly cookie mode for refresh tokens.
     *
     * When set, the refresh token is delivered as an `httpOnly`, `Secure`,
     * `SameSite` cookie instead of in the JSON response body. This
     * prevents XSS from stealing the long-lived refresh token.
     *
     * The access token remains in the JSON body so the client can use it
     * in `Authorization: Bearer` headers for API calls.
     *
     * **Requires** `credentials: "include"` on client-side fetch calls to
     * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
     */
    cookieAuth?: CookieAuthConfig;
}
/**
 * Configuration for httpOnly refresh-token cookies.
 */
export interface CookieAuthConfig {
    /** Cookie name (default: "__rb_refresh"). */
    cookieName?: string;
    /** Cookie domain. Omit to use the current domain. */
    domain?: string;
    /** Cookie path (default: "/"). */
    path?: string;
    /** SameSite attribute (default: "Lax"). */
    sameSite?: "Strict" | "Lax" | "None";
    /** Force the Secure flag. Defaults to `true` when SameSite is "None", otherwise auto-detected from the request protocol. */
    secure?: boolean;
}
export declare function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv>;