import { AuthStrategy } from '@voltro/protocol';

export declare interface SupabaseClaims {
    readonly sub: string;
    readonly iss?: string;
    readonly aud?: string | ReadonlyArray<string>;
    readonly email?: string;
    readonly phone?: string;
    readonly role?: string;
    readonly app_metadata?: Record<string, unknown>;
    readonly user_metadata?: Record<string, unknown>;
    readonly [key: string]: unknown;
}

export declare const supabaseStrategy: (options: SupabaseStrategyOptions) => AuthStrategy;

export declare interface SupabaseStrategyOptions {
    /** Supabase project ref (the `<ref>` in `<ref>.supabase.co`). Used
     *  to build the JWKS URL when `jwksUrl` is not set. */
    readonly projectRef?: string;
    /** Explicit JWKS URL — for self-hosted GoTrue or non-standard hosts.
     *  Takes precedence over `projectRef`. */
    readonly jwksUrl?: string;
    /** Legacy / self-hosted Supabase shared JWT secret (the project's
     *  `JWT_SECRET`). When set, user tokens are verified with HS256 using
     *  this secret instead of a JWKS endpoint — for deployments that sign
     *  symmetrically and expose no `.well-known/jwks.json`. SERVER-side
     *  only; never expose it to the browser. Takes precedence over
     *  `jwksUrl` / `projectRef` for verification (those may still be set so
     *  the issuer can be derived). */
    readonly jwtSecret?: string;
    /** Expected issuer. Default: `https://<projectRef>.supabase.co/auth/v1`.
     *  Set explicitly for self-hosted deployments. */
    readonly issuer?: string;
    /** Expected audience claim. Supabase sets `aud` to `'authenticated'`
     *  for signed-in users by default. */
    readonly audience?: string | ReadonlyArray<string>;
    /** Cookie name for cookie-mode apps (server-rendered / `@supabase/ssr`).
     *  Default `null` (header-only) — most Voltro apps send the token as an
     *  `Authorization: Bearer` header. Set this to `@supabase/ssr`'s cookie —
     *  `sb-<projectRef>-auth-token` — and the strategy unwraps that SDK's stored
     *  session (a JSON envelope, optionally `base64-`-encoded and split across
     *  `<name>.0`, `<name>.1`, … chunk cookies) to the inner `access_token`
     *  before verifying it. The Bearer header is always a raw JWT. */
    readonly cookieName?: string | null;
    /** Where the tenantId lives in the claims tree. Default:
     *  `'app_metadata.tenant_id'`. Dot-notation path. */
    readonly tenantClaim?: string;
    /** Map claims → tenantId. Overrides `tenantClaim`. */
    readonly tenantIdFromClaims?: (claims: SupabaseClaims) => string | null;
    /** Fallback for single-tenant apps. */
    readonly defaultTenantId?: string;
    /** Map Supabase claims → the subject's permission scopes. Lands on
     *  `Subject.scopes` so `requireScope` / `hasScope` gate handlers off the
     *  token with no second lookup. Supabase's `role` (`'authenticated'` /
     *  custom Postgres roles) or an `app_metadata`-carried permissions array are
     *  the usual sources (e.g. `(c) => [c.role ?? 'authenticated']`). Omitted →
     *  no scopes (a scope gate then denies). */
    readonly scopesFromClaims?: (claims: SupabaseClaims) => ReadonlyArray<string>;
}

export { }