import type { UmbTokenEndpointResponse } from './umb-auth-client.js';
import type { UmbOpenApiConfiguration } from './models/openApiConfiguration.js';
import type { ManifestAuthProvider } from './auth-provider.extension.js';
import type { UmbControllerHost } from '../../../libs/controller-api/index.js';
import { UmbContextBase } from '../../../libs/class-api/index.js';
import type { Observable } from '../../../external/rxjs/index.js';
import type { UmbBackofficeExtensionRegistry } from '../extension-registry/index.js';
import type { UmbApiClient } from '../http-client/index.js';
export interface UmbAuthSession {
    /** When the access token expires (issuedAt + expiresIn). Used to decide when to refresh. */
    accessTokenExpiresAt: number;
    /** When the full session expires (issuedAt + expiresIn * MULTIPLIER). Used for timeout UI. */
    expiresAt: number;
}
export declare class UmbAuthContext extends UmbContextBase {
    #private;
    readonly session$: Observable<UmbAuthSession | undefined>;
    /**
     * Observable that emits once, without a value, when the auth context is initialized.
     * For consumers: the boot sequence already awaits app entry points before the router evaluates
     * its guards, so by the time any extension code runs this has long since completed.
     * @internal
     * @deprecated Internal boot signal, never intended for public use. Scheduled for removal in Umbraco 19.
     * @remarks It will only emit once and then complete itself.
     * @returns {Observable<void>} An observable that emits once when the auth context is initialized.
     */
    get isInitialized(): Observable<void>;
    /**
     * Observable that emits true if the user is authorized, otherwise false.
     * @remarks It will only emit when the authorization state changes.
     */
    readonly isAuthorized: Observable<boolean>;
    /**
     * Observable that acts as a signal and emits when the user has timed out, i.e. the token has expired.
     * This can be used to show a timeout message to the user.
     * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the user has timed out.
     */
    readonly timeoutSignal: Observable<void>;
    /**
     * Observable that acts as a signal for when the authorization state changes.
     * @deprecated Observe isAuthorized instead. Scheduled for removal in Umbraco 19.
     * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the authorization state changes.
     * @returns {Observable<void>} An observable that emits when the authorization state changes.
     */
    get authorizationSignal(): Observable<void>;
    /**
     * Whether the server is configured to keep users logged in by auto-refreshing before session expiry.
     * Provided by the backend via the `keep-user-logged-in` attribute on `<umb-app>`.
     */
    readonly keepUserLoggedIn: boolean;
    constructor(host: UmbControllerHost, serverUrl: string, backofficePath: string, isBypassed: boolean, keepUserLoggedIn?: boolean);
    destroy(): void;
    /**
     * Initiates the login flow.
     * @param {string} identityProvider The provider to use for login. Default is 'Umbraco'.
     * @param {boolean} redirect If true, the user will be redirected to the login page.
     * @param {string} usernameHint The username hint to use for login.
     * @param {ManifestAuthProvider} manifest The manifest for the registered provider.
     */
    makeAuthorizationRequest(identityProvider?: string, redirect?: boolean, usernameHint?: string, manifest?: ManifestAuthProvider): Promise<void>;
    /**
     * Completes the login flow.
     * This is called on the oauth_complete page to exchange the authorization code for tokens.
     * @returns {Promise<UmbTokenEndpointResponse | null>} The token response timing, or null if no authorization was pending.
     */
    completeAuthorizationRequest(): Promise<UmbTokenEndpointResponse | null>;
    /**
     * Checks if the user is authorized. If Authorization is bypassed, the user is always authorized.
     * @returns {boolean} True if the user is authorized, otherwise false.
     */
    getIsAuthorized(): boolean;
    /**
     * Sets the initial state of the auth flow.
     * First asks existing tabs for their session via BroadcastChannel.
     * If no peer responds, falls back to a server refresh.
     * @returns {Promise<void>}
     */
    setInitialState(): Promise<void>;
    /**
     * Gets the latest token from the Management API.
     * With cookie auth, this returns '[redacted]' — the real token is in the httpOnly cookie.
     * If the session has expired, it will attempt a refresh first.
     * @example <caption>Using the latest token</caption>
     * ```js
     *   const token = await authContext.getLatestToken();
     *   const result = await fetch('https://my-api.com', { headers: { Authorization: `Bearer ${token}` } });
     * ```
     * @see {@link configureClient} for automatic token handling with `@hey-api/openapi-ts` clients.
     * @see {@link getOpenApiConfiguration} for manual fetch calls with cookie-based auth.
     * @memberof UmbAuthContext
     * @returns {Promise<string>} The latest token from the Management API
     */
    getLatestToken(): Promise<string>;
    /**
     * Forces a token refresh against the server (calls `/token`) and returns true if successful.
     * Use this when you need to unconditionally refresh — e.g. session timeout keep-alive.
     * For per-request token handling, prefer {@link configureClient} which skips the network
     * call when the access token is still valid.
     * Uses Web Locks to deduplicate concurrent refresh requests across tabs.
     * @memberof UmbAuthContext
     * @returns {Promise<boolean>} True if the refresh succeeded, otherwise false
     */
    validateToken(): Promise<boolean>;
    /**
     * Attempts to refresh the token using Web Locks to prevent concurrent refresh requests.
     * @returns {Promise<boolean>} True if the refresh was successful, otherwise false.
     */
    makeRefreshTokenRequest(): Promise<boolean>;
    /**
     * Checks if the current session is still valid.
     * @deprecated Use {@link getIsAuthorized} or observe {@link session$} instead. Scheduled for removal in Umbraco 19.
     * @returns {boolean} True if the session has not expired.
     */
    isSessionValid(): boolean;
    /**
     * Clears the in-memory session state.
     * @memberof UmbAuthContext
     */
    clearTokenStorage(): void;
    /**
     * Handles the case where the user has timed out, i.e. the token has expired.
     * This will clear the token storage and set the user as unauthorized.
     * @memberof UmbAuthContext
     */
    timeOut(): void;
    /**
     * Signs the user out by revoking tokens and redirecting to the end session endpoint.
     * @memberof UmbAuthContext
     */
    signOut(): Promise<void>;
    /**
     * Get the server url to the Management API.
     * @memberof UmbAuthContext
     * @example <caption>Using the server url</caption>
     * ```js
     * 	const serverUrl = authContext.getServerUrl();
     * 	OpenAPI.BASE = serverUrl;
     * ```
     * @example <caption></caption>
     * ```js
     * 	const config = authContext.getOpenApiConfiguration();
     * 	const result = await fetch(`${config.base}/umbraco/management/api/v1/my-resource`, {
     * 		credentials: config.credentials,
     * 		headers: { Authorization: `Bearer ${await config.token()}` },
     * 	});
     * ```
     * @deprecated Consume {@link UMB_SERVER_CONTEXT} and use its `getServerUrl()` — the canonical source for the server URL. Scheduled for removal in Umbraco 19.
     * @returns {string} The server url to the Management API
     */
    getServerUrl(): string;
    /**
     * Get the default OpenAPI configuration, which is set up to communicate with the Management API.
     * @remarks This is useful if you want to communicate with your own resources generated by the [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) library.
     * @memberof UmbAuthContext
     * @example <caption>Using the default OpenAPI configuration</caption>
     * ```js
     * const defaultOpenApi = authContext.getOpenApiConfiguration();
     * client.setConfig({
     *   base: defaultOpenApi.base,
     *   auth: defaultOpenApi.token,
     * });
     * ```
     * @returns {UmbOpenApiConfiguration} The default OpenAPI configuration
     */
    getOpenApiConfiguration(): UmbOpenApiConfiguration;
    /**
     * Configures a `@hey-api/openapi-ts` generated client for authenticated API calls.
     *
     * Sets `baseUrl`, `credentials`, and the `auth` callback (cookie-based with
     * automatic token refresh via {@link getLatestToken}), and binds the default
     * response interceptors (401 retry, problem-details error notifications, etc.)
     * to the client.
     *
     * The same auth context owns a single {@link UmbApiInterceptorController} for
     * the lifetime of the host (`<umb-app>`), so it's safe to call this method for
     * multiple clients (the core's {@link umbHttpClient} *and* an extension's own
     * generated client) without registering duplicate auth-signaler contexts.
     * @example
     * ```js
     * const authContext = await this.getContext(UMB_AUTH_CONTEXT);
     * authContext.configureClient(myClient);
     * // Now myClient automatically includes auth headers and interceptors
     * ```
     * @param {UmbApiClient} client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
     * or one regenerated by an extension package against its own OpenAPI document.
     */
    configureClient(client: UmbApiClient): void;
    /**
     * Sets the auth context as initialized, which means that the auth context is ready to be used.
     * No code outside Umbraco core should ever call this — doing so opens the provider-discovery gate early.
     * @internal
     * @deprecated Internal boot hook, never intended for public use. Scheduled for removal in Umbraco 19.
     * @remarks The constructor already does this, so calling it again is a no-op on an
     * already-completed subject. It emits once, without a value.
     */
    setInitialized(): void;
    /**
     * Gets all registered auth providers.
     * @deprecated Query the extension registry directly: `umbExtensionsRegistry.byType('authProvider')`. Scheduled for removal in Umbraco 19.
     * @remarks The initialization gate this used to add is redundant — the app awaits app entry points
     * before the router evaluates its guards, so the provider list has already settled by then.
     * @param {UmbBackofficeExtensionRegistry} extensionsRegistry The extension registry to query.
     * @returns {Observable<Array<ManifestAuthProvider>>} An observable of the registered auth providers.
     */
    getAuthProviders(extensionsRegistry: UmbBackofficeExtensionRegistry): Observable<ManifestAuthProvider[]>;
    /**
     * Gets the authorized redirect url.
     * @returns {string} The redirect url, which is the backoffice path.
     */
    getRedirectUrl(): string;
    /**
     * Gets the post logout redirect url.
     * @returns {string} The post logout redirect url, which is the backoffice path with the logout path appended.
     */
    getPostLogoutRedirectUrl(): string;
    /**
     * Links the current user to the specified provider by redirecting to the link endpoint.
     * @param {string} provider The provider to link to.
     */
    linkLogin(provider: string): Promise<void>;
    /**
     * Unlinks the current user from the specified provider.
     * @param {string} loginProvider The login provider to unlink from.
     * @param {string} providerKey The provider's key for the current user.
     * @returns {Promise<boolean>} True if the unlink succeeded.
     */
    unlinkLogin(loginProvider: string, providerKey: string): Promise<boolean>;
}