import { ClientAuthMethod } from '../../plugins/index.js';
import { OAuthErrorResponse, OAuthTokenResponse } from '../auth/index.js';
import { Property } from '../common/property.js';
export declare const OAUTH_CALLBACK_PATH = "oauth/callback";
export declare const LS_OAUTH_DATASOURCE_KEY = "oauth-datasource";
export declare const LS_OAUTH_ENV_KEY = "oauth-env";
export declare const LS_OAUTH_ERROR_KEY = "oauth-error";
export declare const LS_OAUTH_ONE_TIME_CODE = "oauth-one-time-code";
export declare const LS_OAUTH_REDIRECT_FINISHED = "oauth-redirect-finished";
export declare const LS_FULL_STATE = "oauth-full-state";
export declare function getOAuthCodeVerifierStorageKey(oneTimeCode: string): string;
/**
 * `usePkce` is typed as a boolean but reaches us from persisted integration
 * configuration, where a form checkbox can store it as the string `'true'`.
 * Every read of the flag goes through this predicate so that no two call
 * sites disagree about whether PKCE is on.
 */
export declare function isPkceEnabled(usePkce: unknown): boolean;
export type AuthId = string;
export declare function getAuthId(authType: AuthType | undefined, authConfig: AuthConfig | undefined, integrationId?: string, integrationConfigurationId?: string): AuthId;
export declare enum IntegrationAuthType {
    NONE = "None",
    BASIC = "basic",
    OAUTH2_CODE = "oauth-code",
    OAUTH2_CLIENT_CREDS = "oauth-client-cred",
    OAUTH2_IMPLICIT = "oauth-implicit",
    OAUTH2_PASSWORD = "oauth-pword",
    OAUTH2_TOKEN_EXCHANGE = "oauth-token-exchange",
    OAUTH2_TOKEN_EXCHANGE_PROTO = "oauthTokenExchange",
    /** Passes the user's SSO IdP access token through as {{ oauth.token }} — no OAuth client config needed. */
    OAUTH2_IDP_TOKEN_PASSTHROUGH = "oauth-idp-token-passthrough",
    FIREBASE = "Firebase",
    BEARER = "bearer",
    API_KEY = "api-key",
    TOKEN_PREFIXED = "token-prefixed",
    API_KEY_FORM = "api-key-form"
}
export declare enum NewAuthType {
    OAUTH2_PASSWORD_GRANT_FLOW = "passwordGrantFlow",
    OAUTH2_AUTH_CODE_FLOW = "authorizationCodeFlow",
    OAUTH2_CLIENT_CREDS_FLOW = "clientCredentialsFlow",
    OAUTH2_TOKEN_EXCHANGE_FLOW = "tokenExchangeFlow"
}
export declare function isRedirectRequired(authType: AuthType | undefined): boolean;
export declare const IntegrationAuthHeaderPrefixMap: {
    basic: string;
    bearer: string;
    "oauth-code": string;
    "token-prefixed": string;
};
export declare enum ApiKeyMethod {
    HEADER = "header",
    QUERY_PARAM = "query-param"
}
export declare enum GoogleSheetsAuthType {
    OAUTH2_CODE = "oauth-code",
    SERVICE_ACCOUNT = "service-account"
}
export declare enum AWSAuthType {
    ACCESS_KEY = "access-key",
    TOKEN_FILE = "token-file",
    EC2_INSTANCE_METADATA = "ec2-instance-metadata"
}
export declare enum PostgresAuthType {
    AWS_IAM_ROLE = "aws_iam_role",
    PASSWORD = "password"
}
export declare function getAWSAuthTypeDisplayName(authType: AWSAuthType): string;
declare enum DatabaseAuthType {
    URL = "url",
    FIELDS = "fields",
    OKTA = "okta",
    KEY_PAIR = "key-pair"
}
export type AuthType = IntegrationAuthType | GoogleSheetsAuthType | NewAuthType | DatabaseAuthType;
export declare function getDisplayName(authType: AuthType): string;
type PublicFirebaseAuthConfig = {
    apiKey?: string;
    google?: boolean;
    email?: boolean;
};
type FirebaseAuthConfig = PublicFirebaseAuthConfig;
type PublicOAuthConfig = PublicOAuthPasswordConfig & PublicOAuthClientCredsConfig & PublicOAuthImplicitConfig & PublicOAuthCodeConfig & PublicOAuthTokenExchangeConfig;
type OAuthConfig = OAuthPasswordConfig & OAuthClientCredsConfig & OAuthImplicitConfig & OAuthCodeConfig & OAuthBringYourOwnClientConfig & OAuthTokenExchangeConfig;
type PublicOAuthPasswordConfig = {
    clientId?: string;
    tokenUrl?: string;
    useFixedPasswordCreds?: boolean;
};
type OAuthPasswordConfig = PublicOAuthPasswordConfig & {
    clientSecret?: string;
    username?: string;
    password?: string;
};
type PublicOAuthClientCredsConfig = {
    clientId?: string;
    tokenUrl?: string;
    scope?: string;
};
type OAuthClientCredsConfig = PublicOAuthClientCredsConfig & {
    clientSecret?: string;
    audience?: string;
};
type PublicOAuthImplicitConfig = {
    clientId?: string;
    authorizationUrl?: string;
    scope?: string;
};
type OAuthImplicitConfig = PublicOAuthImplicitConfig & {
    clientSecret?: string;
};
type PublicOAuthTokenExchangeConfig = {
    tokenUrl?: string;
    audience?: string;
    scope?: string;
    subjectTokenSource?: string;
    subjectTokenSourceStaticToken?: string;
    subjectTokenType?: string;
    clientId?: string;
};
export type OAuthTokenExchangeConfig = PublicOAuthTokenExchangeConfig & {
    clientSecret?: string;
};
type PublicOAuthCodeConfig = {
    clientId?: string;
    authorizationUrl?: string;
    authUrl?: string;
    userInfoUrl?: string;
    tokenUrl?: string;
    scope?: string;
    audience?: string;
    promptType?: string;
    refreshTokenFromServer?: boolean;
    tokenScope?: TokenScope;
    revokeTokenUrl?: string;
    authToken?: string;
    hasToken?: boolean;
    userEmail?: string;
    sendOAuthState?: boolean;
    usePkce?: boolean;
};
type OAuthCodeConfig = Omit<PublicOAuthCodeConfig, 'usePkce'> & {
    clientSecret?: string;
    usePkce?: FakeBoolean;
};
export declare enum TokenScope {
    DATASOURCE = "datasource",
    USER = "user"
}
type OAuthBringYourOwnClientConfig = {
    tokenUrl?: string;
    authorizationUrl?: string;
    revokeTokenUrl?: string;
    clientSecret?: string;
    clientAuthMethod?: ClientAuthMethod;
};
export declare enum TokenType {
    REFRESH = "refresh",
    USER = "userId",
    ACCESS = "token",
    ID = "id-token"
}
export type TokenMetadata = {
    email?: string;
};
type FakeBoolean = boolean | string;
type BasicAuthConfig = PublicBasicAuthConfig & {
    username?: string;
    password?: string;
};
type PublicBasicAuthConfig = {
    shareBasicAuthCreds?: FakeBoolean;
};
type BearerTokenAuthConfig = {
    bearerToken?: string;
};
type TokenPrefixedAuthConfig = {
    prefix?: string;
    token?: string;
};
type ApiKeyFormAuthConfig = {
    apiKeys?: Record<string, {
        header?: string;
        token?: string;
    }>;
};
type ApiKeyAuthConfig = {
    key?: string;
    value?: string;
    method?: ApiKeyMethod;
};
export declare const extractPublic: (authType: AuthType | undefined, authConfig: AuthConfig | undefined) => PublicAuthConfig;
type ServiceAccountConfig = {
    googleServiceAccount?: Property;
};
type PublicRestAuthConfig = PublicBasicAuthConfig & PublicOAuthConfig & PublicFirebaseAuthConfig;
type PublicGoogleSheetsAuthConfig = PublicOAuthCodeConfig;
type PublicAuthConfig = PublicRestAuthConfig & PublicGoogleSheetsAuthConfig;
type RestAuthConfig = BasicAuthConfig & OAuthConfig & FirebaseAuthConfig & BearerTokenAuthConfig & TokenPrefixedAuthConfig & ApiKeyFormAuthConfig & ApiKeyAuthConfig;
type GoogleSheetsAuthConfig = OAuthCodeConfig & ServiceAccountConfig;
export type AuthConfig = RestAuthConfig & GoogleSheetsAuthConfig;
export type ExchangeCodeRequest = {
    authId: AuthId;
    authType: AuthType;
    authConfig: AuthConfig;
    accessCode: string;
    pluginId: string;
    origin: string;
    grantedScope: string | null;
    integrationId: string | undefined;
    configurationId: string | undefined;
};
export type ExchangeCodeResponse = {
    successful: boolean;
    error?: string;
};
export declare function isExchangeCodeResponse(obj: ExchangeCodeResponse | {
    success: boolean;
    result?: void;
    error?: string | undefined;
}): obj is ExchangeCodeResponse;
export type RequestTokenRequest = {
    datasourceId: string;
    username: string;
    password: string;
    environment?: string;
};
export type RequestTokenResponse = OAuthTokenResponse & OAuthErrorResponse & {
    expirationTimestamp?: number;
};
export type DatasourceAuthState = DatasourceOneTimeState & {
    integrationId: string;
    configurationId: string;
    pluginId: string;
    authType: AuthType;
    authId: string;
    authConfig: {
        refreshTokenFromServer?: boolean;
        clientId: string;
        clientSecret: string;
        tokenUrl: string;
        authorizationUrl: string;
        userInfoUrl?: string;
        tokenScope: TokenScope;
        scope: string | undefined;
        clientAuthMethod?: ClientAuthMethod;
        usePkce?: boolean;
    };
    origin: string;
};
export declare function isDatasourceAuthState(aus: DatasourceAuthState | DatasourceOneTimeState): aus is DatasourceAuthState;
export type DatasourceOneTimeState = {
    oneTimeCode: string;
    /**
     * Explicitly selects the ui-legacy localStorage callback handoff.
     * ui app and deployed-shell flows must leave this unset so the
     * dashboard callback uses postMessage only.
     */
    useLocalStorage?: boolean;
    integrationId: string;
    externalUser: boolean;
    configurationId?: string;
    /** Profile key for agent-scoped auth when not supplied via postMessage. */
    profileKey?: string;
    /**
     * Origin of the window that opened the OAuth popup. When the opener
     * is cross-origin (e.g. a deployed app iframe on a CDN), the callback
     * page must postMessage with this targetOrigin instead of its own.
     */
    openerOrigin?: string;
};
export type DeleteDatasourceOnAgentResult = {
    message?: string;
    success: boolean;
};
export {};
//# sourceMappingURL=auth.d.ts.map