import type { CliContext } from '../../context/create-context.js';
import { DockerService } from '../docker-service.js';
type SsoStartOptions = {
    /**
     * Every URI the client is allowed to redirect back to. Keycloak rejects the authorization
     * request when the redirect URI the backend sends is not listed here.
     */
    redirectUris: string[];
    background?: boolean;
};
/**
 * Runs a second SSO server next to the one `stam sso start` manages. The Playwright suite needs
 * its own hostname, port, container and realm file so an e2e run never restarts (or is restarted
 * by) the SSO server a developer started for manual testing.
 */
export type SsoServiceVariant = {
    /** Suffix for the container name, e.g. 'playwright' → <instance>-keycloak-playwright */
    name: string;
    /** Host port the container publishes on. */
    port: number;
    /** Public hostname the server is reachable on (proxied by Caddy). */
    hostname: string;
};
type SsoPrepared = {
    importDir: string;
};
export declare class SsoService extends DockerService<SsoStartOptions, SsoPrepared> {
    private readonly variant;
    readonly key: string;
    readonly name: string;
    readonly runQuiet = false;
    constructor(variant?: SsoServiceVariant | null);
    getContainer(context: CliContext): string;
    getDetail(context: CliContext): string;
    /**
     * The OpenID Connect issuer of the imported realm: what you configure as the issuer in the
     * Stamhoofd SSO settings.
     */
    getIssuer(context: CliContext): string;
    prepare(context: CliContext, options: SsoStartOptions): Promise<SsoPrepared>;
    canReuse(): boolean;
    getDockerArgs(context: CliContext, options: SsoStartOptions, prepared: SsoPrepared): string[];
    /**
     * Keycloak accepts TCP connections well before the realm import finished, so poll the realm's
     * discovery document instead of the container state. Goes through Caddy, which is how the
     * backend reaches the server too.
     *
     * The document has to name our issuer: Caddy answers an empty 200 for a host it has no route
     * for, so a bare status check would pass while nothing is reachable at all.
     */
    waitUntilReady(context: CliContext, options?: {
        timeoutMs?: number;
    }): Promise<void>;
    private getHostname;
    private getPort;
    static container(context: {
        instance: {
            name: string;
        };
    }, variant?: string): string;
    /**
     * Remove the containers of sibling variants, e.g. the server of an e2e run that crashed before
     * its teardown. Variant names carry the slots a run reserved, so a leaked container is not
     * replaced by the next run (which reserves other slots) and would keep both its memory and its
     * port for as long as the machine is up. Only variants starting with `variantPrefix` are
     * removed, so this never touches the SSO server of `stam sso start`.
     */
    removeOtherVariants(context: CliContext, variantPrefix: string): Promise<void>;
}
export declare const ssoService: SsoService;
export {};
//# sourceMappingURL=sso-service.d.ts.map