import * as msal from '@azure/msal-browser';
import { LogLevel } from '@azure/msal-browser';
import { PlainObject } from '@xh/hoist/core';
import { Token } from '@xh/hoist/security/Token';
import { BaseOAuthClient, BaseOAuthClientConfig } from '../BaseOAuthClient';
import { AccessTokenSpec, TokenMap } from '../Types';
/**
 * Configuration for a {@link MsalClient} - the Microsoft Entra ID (Azure AD) OAuth client.
 * Extends {@link BaseOAuthClientConfig} with MSAL-specific options.
 *
 * @see MsalClient
 */
export interface MsalClientConfig extends BaseOAuthClientConfig<MsalTokenSpec> {
    /**
     * Authority for your organization's tenant: `https://login.microsoftonline.com/[tenantId]`.
     * MSAL defaults to their "common" tenant (https://login.microsoftonline.com/common") to support
     * auth with personal MS accounts, but enterprise/Hoist apps will almost certainly use a
     * specific authority to point to their own private/corporate tenant.
     */
    authority: string;
    /**
     * A hint about the tenant or domain that the user should use to sign in.
     * The value of the domain hint is a registered domain for the tenant.
     */
    domainHint?: string;
    /**
     * True to enable support for built-in telemetry provided by this class's internal MSAL client.
     * Captured performance events will be summarized as {@link MsalClientTelemetry}. Default true.
     */
    enableTelemetry?: boolean;
    /**
     * If specified, the client will use this value when initializing the app to enforce a minimum
     * amount of time during which no further auth flow with the provider should be necessary.
     *
     * Use this argument to front-load any necessary auth flow to the apps initialization stage
     * thereby minimizing disruption to user activity during application use.
     *
     * This value may be set to anything up to 86400 (24 hours), the maximum lifetime
     * of an Azure refresh token.  Set to -1 to disable (default).
     *
     * Note that setting to *any* non-disabled amount will require the app to do *some* communication
     * with the login provider at *every* app load. This may just involve loading new tokens via
     * fetch, however, setting to higher values will increase the frequency with which
     * a new refresh token will also need to be requested via a hidden iframe/redirect/popup. This
     * can be time-consuming and potentially disruptive and applications should therefore use with
     * care and typically set to some value significantly less than the max.
     *
     * See https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/token-lifetimes.md
     */
    initRefreshTokenExpirationOffsetSecs?: number;
    /**
     * Enable the use of the MSAL ssoSilent() API, which will attempt to use credentials gained by
     * another app or tab to start a new session for this app.  Requires iFrames and 3rd party
     * cookies to be enabled.  Default true.
     *
     *  In practice, and according to documentation, this operation is likely to fail for a
     *  number of reasons, and can often do so as timeout.  Therefore, keeping the timeout limit
     *  value -- `system.iframeHashTimeout` -- at a relatively low value is critical.  Hoist
     *  defaults this value to 3000ms vs. the default 10000ms.
     */
    enableSsoSilent?: boolean;
    /** The log level of MSAL. Default is LogLevel.Warning. */
    msalLogLevel?: LogLevel;
    /**
     * Additional options for the MSAL client ctor. Will be deep merged with defaults, with options
     * supplied here taking precedence. Use with care, as overriding defaults may have unintended
     * consequences or fail to work with Hoist's expected usage of the client library.
     */
    msalClientOptions?: Partial<msal.Configuration>;
}
export interface MsalTokenSpec extends AccessTokenSpec {
    /**
     * Scopes to be added to the scopes requested during interactive and SSO logins.
     * See the `scopes` property on  `PopupRequest`, `RedirectRequest`, and `SSORequest`
     * for more info.
     */
    loginScopes?: string[];
    /**
     * Scopes to be added to the scopes requested during interactive and SSO login.
     *
     * See the `extraScopesToConsent` property on  `PopupRequest`, `RedirectRequest`, and
     * `SSORequest` for more info.
     */
    extraScopesToConsent?: string[];
}
/**
 * Service to implement OAuth authentication via MSAL.
 *
 * See the following helpful information relevant to our use of this tricky API --
 * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/
 * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/token-lifetimes.md
 * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/login-user.md
 *
 * Also see this doc re. use of blankUrl as redirectUri for all "silent" token requests:
 * https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/errors.md#issues-caused-by-the-redirecturi-page
 *
 * Important note: The handling of `ssoSilent` and `initRefreshTokenExpirationOffsetSecs` in this
 *    library require 3rd party cookies to be enabled in the browser so that MSAL can load contact
 *    in a hidden iFrame.
 */
export declare class MsalClient extends BaseOAuthClient<MsalClientConfig, MsalTokenSpec> {
    private client;
    private account;
    private initialTokenLoad;
    /** Enable telemetry via `enableTelemetry` ctor config, or via {@link enableTelemetry}. */
    telemetry: MsalClientTelemetry;
    private _telemetryCbHandle;
    constructor(config: MsalClientConfig);
    protected doInitAsync(): Promise<TokenMap>;
    protected doLoginPopupAsync(): Promise<void>;
    protected doLoginRedirectAsync(): Promise<void>;
    protected fetchIdTokenAsync(useCache?: boolean): Promise<Token>;
    protected fetchAccessTokenAsync(spec: MsalTokenSpec, useCache?: boolean): Promise<Token>;
    protected doLogoutAsync(): Promise<void>;
    protected interactiveLoginNeeded(exception: unknown): boolean;
    getFormattedTelemetry(): PlainObject;
    enableTelemetry(): void;
    disableTelemetry(): void;
    private loginSsoAsync;
    private createClientAsync;
    private logFromMsal;
    private get loginScopes();
    private get loginExtraScopesToConsent();
    private get refreshOffsetArgs();
    private setAccount;
    private noteAuthComplete;
    private authRequestCore;
}
type AuthMethod = 'acquireSilent' | 'ssoSilent' | 'loginPopup' | 'loginRedirect';
/**
 * Telemetry produced by this client (if enabled) + included in {@link ClientHealthService}
 * reporting. Leverages MSAL's opt-in support for emitting performance events.
 * See https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/lib/msal-browser/docs/performance.md
 */
interface MsalClientTelemetry {
    /** Method of last authentication for this client. */
    authMethod: AuthMethod;
    /** Stats across all events */
    summary: {
        successCount: number;
        failureCount: number;
        maxDuration: number;
        lastFailureTime: number;
    };
    /** Stats by event type */
    events: Record<string, MsalEventTelemetry>;
}
/** Aggregated telemetry results for a single type of event. */
interface MsalEventTelemetry {
    firstTime: number;
    lastTime: number;
    successCount: number;
    failureCount: number;
    /** Timing info (in ms) for event instances reported with duration. */
    duration?: {
        count: number;
        total: number;
        average: number;
        max: number;
    };
    lastFailure?: {
        time: number;
        duration: number;
        code: string;
        name: string;
    };
}
export {};