/**
 * Auth Workflow Helper - Guided authentication setup for discovered APIs
 *
 * Features:
 * - Detects auth requirements from API documentation discovery
 * - Guides users through credential configuration
 * - Supports API key, Bearer token, Basic auth, OAuth 2.0, and cookie-based auth
 * - Stores credentials securely via SessionManager
 * - Auto-refreshes OAuth tokens when expired
 */
import { SessionManager } from './session-manager.js';
import { AuthInfo } from './api-documentation-discovery.js';
/**
 * Stored API credentials (encrypted at rest via SessionManager)
 */
export interface StoredApiCredentials {
    /** Domain this credential is for */
    domain: string;
    /** Auth type */
    type: AuthInfo['type'];
    /** Profile name for multiple credentials per domain */
    profile: string;
    /** Credential data (type-specific) */
    credentials: ApiKeyCredentials | BearerCredentials | BasicCredentials | OAuth2Credentials | CookieCredentials;
    /** When these credentials were configured */
    configuredAt: number;
    /** When these credentials were last used */
    lastUsed: number;
    /** Whether credentials have been validated */
    validated: boolean;
    /** Last validation error */
    validationError?: string;
}
export interface ApiKeyCredentials {
    type: 'api_key';
    /** Where the key goes */
    in: 'header' | 'query' | 'cookie';
    /** Header/query param/cookie name */
    name: string;
    /** The API key value */
    value: string;
}
export interface BearerCredentials {
    type: 'bearer';
    /** The bearer token */
    token: string;
    /** Optional token expiration (Unix timestamp in ms) */
    expiresAt?: number;
}
export interface BasicCredentials {
    type: 'basic';
    /** Username */
    username: string;
    /** Password */
    password: string;
}
export interface OAuth2Credentials {
    type: 'oauth2';
    /** OAuth flow type */
    flow: 'authorization_code' | 'client_credentials' | 'implicit' | 'password';
    /** Client ID */
    clientId: string;
    /** Client secret (for client_credentials and authorization_code flows) */
    clientSecret?: string;
    /** Current access token */
    accessToken?: string;
    /** Refresh token (for authorization_code flow) */
    refreshToken?: string;
    /** Token expiration (Unix timestamp in ms) */
    expiresAt?: number;
    /** Requested scopes */
    scopes?: string[];
    /** OAuth URLs */
    urls: {
        authorizationUrl?: string;
        tokenUrl?: string;
        refreshUrl?: string;
    };
    /** Username (for password flow) */
    username?: string;
    /** Password (for password flow) */
    password?: string;
}
export interface CookieCredentials {
    type: 'cookie';
    /** Cookie name */
    name: string;
    /** Cookie value */
    value: string;
    /** Optional expiration */
    expiresAt?: number;
}
/**
 * Auth workflow status for a domain
 */
export interface AuthWorkflowStatus {
    /** Domain */
    domain: string;
    /** Detected auth requirements from discovery */
    detectedAuth: AuthInfo[];
    /** Configured credentials */
    configuredCredentials: Array<{
        type: AuthInfo['type'];
        profile: string;
        validated: boolean;
        expiresAt?: number;
        isExpired: boolean;
    }>;
    /** Missing auth types that need configuration */
    missingAuth: AuthInfo[];
    /** Overall status */
    status: 'not_configured' | 'partially_configured' | 'configured' | 'expired';
    /** Human-readable message */
    message: string;
}
/**
 * Result of a credential configuration operation
 */
export interface ConfigureCredentialsResult {
    success: boolean;
    domain: string;
    type: AuthInfo['type'];
    profile: string;
    validated: boolean;
    error?: string;
    /** Instructions for completing auth (e.g., OAuth authorization URL) */
    nextStep?: {
        action: 'visit_url' | 'enter_code' | 'complete';
        url?: string;
        instructions?: string;
    };
}
/**
 * Options for making authenticated requests
 */
export interface AuthenticatedRequestOptions {
    /** Domain to authenticate for */
    domain: string;
    /** Profile name (default: 'default') */
    profile?: string;
    /** Specific auth type to use (auto-detect if not specified) */
    authType?: AuthInfo['type'];
    /** Base headers to include */
    headers?: Record<string, string>;
    /** URL being requested (for query param auth) */
    url?: string;
}
/**
 * Result of building auth headers/params
 */
export interface AuthenticatedRequestResult {
    /** Headers to include in request */
    headers: Record<string, string>;
    /** Query params to append to URL */
    queryParams?: Record<string, string>;
    /** Cookies to set */
    cookies?: Array<{
        name: string;
        value: string;
        domain: string;
    }>;
    /** Whether token was refreshed */
    tokenRefreshed: boolean;
    /** Auth type used */
    authType: AuthInfo['type'];
}
export declare class AuthWorkflow {
    private sessionManager;
    private credentials;
    private oauthStates;
    private fetchFn;
    constructor(sessionManager: SessionManager, fetchFn?: typeof fetch);
    /**
     * Initialize the auth workflow (load stored credentials)
     */
    initialize(): Promise<void>;
    /**
     * Get auth workflow status for a domain
     * Shows what auth is required and what's configured
     */
    getAuthStatus(domain: string, profile?: string): Promise<AuthWorkflowStatus>;
    /**
     * Configure credentials for a domain
     */
    configureCredentials(domain: string, credentials: ApiKeyCredentials | BearerCredentials | BasicCredentials | OAuth2Credentials | CookieCredentials, profile?: string, validate?: boolean): Promise<ConfigureCredentialsResult>;
    /**
     * Complete OAuth authorization_code flow after user authorizes
     */
    completeOAuthFlow(code: string, state: string): Promise<ConfigureCredentialsResult>;
    /**
     * Build authenticated request headers/params for a domain
     * Automatically refreshes tokens if needed
     */
    buildAuthenticatedRequest(options: AuthenticatedRequestOptions): Promise<AuthenticatedRequestResult | null>;
    /**
     * Delete credentials for a domain
     */
    deleteCredentials(domain: string, authType?: AuthInfo['type'], profile?: string): Promise<boolean>;
    /**
     * List all configured domains with auth
     */
    listConfiguredDomains(): Array<{
        domain: string;
        types: AuthInfo['type'][];
        profiles: string[];
    }>;
    /**
     * Get guidance for configuring auth based on discovered requirements
     */
    getAuthGuidance(authInfo: AuthInfo): {
        instructions: string;
        requiredFields: string[];
        optionalFields: string[];
        example?: Record<string, string>;
    };
    private getCredentialKey;
    private isCredentialExpired;
    private getCredentialExpiration;
    private validateCredentials;
    private initiateOAuthFlow;
    private exchangeOAuthCode;
    private getClientCredentialsToken;
    private refreshOAuthToken;
    private generateRandomString;
    private loadCredentials;
    private persistCredentials;
}
//# sourceMappingURL=auth-workflow.d.ts.map