import { AuthStrategy } from '@voltro/protocol';

/** Common claims surfaced by Auth0 access tokens. Permissive shape
 *  because custom-action rules can add arbitrary claims. */
export declare interface Auth0Claims {
    readonly sub: string;
    readonly iss?: string;
    readonly aud?: string | ReadonlyArray<string>;
    readonly azp?: string;
    readonly scope?: string;
    readonly permissions?: ReadonlyArray<string>;
    readonly email?: string;
    readonly email_verified?: boolean;
    readonly [key: string]: unknown;
}

export declare const auth0Strategy: (options: Auth0StrategyOptions) => AuthStrategy;

export declare interface Auth0StrategyOptions {
    /** Auth0 tenant domain, e.g. `acme.us.auth0.com` or a custom domain.
     *  No protocol, no path. Used to build the JWKS URL + issuer. */
    readonly domain: string;
    /** Expected audience claim. Auth0 sets this to your API identifier
     *  (the `aud` parameter you specify when requesting the token). */
    readonly audience?: string | ReadonlyArray<string>;
    /** Override the JWKS URL. Default:
     *  `https://<domain>/.well-known/jwks.json`. */
    readonly jwksUrl?: string;
    /** Override the issuer. Default: `https://<domain>/` (Auth0
     *  includes the trailing slash). Set explicitly for custom domains. */
    readonly issuer?: string;
    /** JWT algorithm allowlist. Defaults to `['RS256']` — Auth0's default
     *  signing algorithm. Override for a tenant configured for RS384 / PS256 /
     *  ES256. Pinning it (rather than accepting whatever the token declares)
     *  is what blocks alg-confusion attacks. */
    readonly algorithms?: ReadonlyArray<'ES256' | 'RS256' | 'PS256' | 'EdDSA'>;
    /** Cookie name when the access token travels as a cookie. Default:
     *  `null` (header-only). Auth0's hosted login flow uses Bearer
     *  tokens; cookies are app-side only. */
    readonly cookieName?: string | null;
    /**
     * Auth0 claims that aren't in the standard set (`sub`, `iss`,
     * `aud`, `iat`, `exp`, `azp`, `scope`) must use a namespaced URN
     * per Auth0's rules. The framework reads `tenantClaim` for the
     * `Subject.tenantId`. Default: `'https://voltro.dev/tenant'`.
     */
    readonly tenantClaim?: string;
    /** Map Auth0 claims → tenantId. Overrides `tenantClaim`. */
    readonly tenantIdFromClaims?: (claims: Auth0Claims) => string | null;
    /** Fallback tenantId for single-tenant Auth0 setups. */
    readonly defaultTenantId?: string;
    /** Map Auth0 claims → the subject's permission scopes. Lands on
     *  `Subject.scopes` so `requireScope` / `hasScope` gate handlers off
     *  the token with no second lookup. Auth0 with RBAC enabled emits a
     *  `permissions` array; the OAuth `scope` claim is a space-delimited
     *  string. Omitted → no scopes (a scope gate then denies). */
    readonly scopesFromClaims?: (claims: Auth0Claims) => ReadonlyArray<string>;
}

export { }