import { BinaryReader, BinaryWriter } from "@bufbuild/protobuf/wire";
import Long from "long";
import { Duration } from "../../../google/protobuf/duration.js";
import { LoginVersion } from "./login.js";
export declare const protobufPackage = "zitadel.application.v2";
export declare enum OIDCResponseType {
    OIDC_RESPONSE_TYPE_UNSPECIFIED = 0,
    OIDC_RESPONSE_TYPE_CODE = 1,
    OIDC_RESPONSE_TYPE_ID_TOKEN = 2,
    OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN = 3,
    UNRECOGNIZED = -1
}
export declare function oIDCResponseTypeFromJSON(object: any): OIDCResponseType;
export declare function oIDCResponseTypeToJSON(object: OIDCResponseType): string;
export declare enum OIDCGrantType {
    OIDC_GRANT_TYPE_AUTHORIZATION_CODE = 0,
    OIDC_GRANT_TYPE_IMPLICIT = 1,
    OIDC_GRANT_TYPE_REFRESH_TOKEN = 2,
    OIDC_GRANT_TYPE_DEVICE_CODE = 3,
    OIDC_GRANT_TYPE_TOKEN_EXCHANGE = 4,
    UNRECOGNIZED = -1
}
export declare function oIDCGrantTypeFromJSON(object: any): OIDCGrantType;
export declare function oIDCGrantTypeToJSON(object: OIDCGrantType): string;
export declare enum OIDCApplicationType {
    OIDC_APP_TYPE_WEB = 0,
    OIDC_APP_TYPE_USER_AGENT = 1,
    OIDC_APP_TYPE_NATIVE = 2,
    UNRECOGNIZED = -1
}
export declare function oIDCApplicationTypeFromJSON(object: any): OIDCApplicationType;
export declare function oIDCApplicationTypeToJSON(object: OIDCApplicationType): string;
export declare enum OIDCAuthMethodType {
    OIDC_AUTH_METHOD_TYPE_BASIC = 0,
    OIDC_AUTH_METHOD_TYPE_POST = 1,
    OIDC_AUTH_METHOD_TYPE_NONE = 2,
    OIDC_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT = 3,
    UNRECOGNIZED = -1
}
export declare function oIDCAuthMethodTypeFromJSON(object: any): OIDCAuthMethodType;
export declare function oIDCAuthMethodTypeToJSON(object: OIDCAuthMethodType): string;
export declare enum OIDCVersion {
    OIDC_VERSION_1_0 = 0,
    UNRECOGNIZED = -1
}
export declare function oIDCVersionFromJSON(object: any): OIDCVersion;
export declare function oIDCVersionToJSON(object: OIDCVersion): string;
export declare enum OIDCTokenType {
    OIDC_TOKEN_TYPE_BEARER = 0,
    OIDC_TOKEN_TYPE_JWT = 1,
    UNRECOGNIZED = -1
}
export declare function oIDCTokenTypeFromJSON(object: any): OIDCTokenType;
export declare function oIDCTokenTypeToJSON(object: OIDCTokenType): string;
export interface OIDCLocalizedMessage {
    key: string;
    localizedMessage: string;
}
export interface OIDCConfiguration {
    /**
     * RedirectURIs are the allowed callback URIs for the OAuth2 / OIDC flows,
     * where the authorization code or tokens will be sent to.
     * The redirect_uri parameter in the authorization request must exactly match one of these URIs.
     */
    redirectUris: string[];
    /**
     * ResponseTypes define whether a code, id_token token or just id_token will be returned.
     * The response_type parameter in the authorization request must exactly match one of these values.
     */
    responseTypes: OIDCResponseType[];
    /**
     * GrantTypes define the flow type the application is allowed to use.
     * The grant_type parameter in the token request must exactly match one of these values.
     */
    grantTypes: OIDCGrantType[];
    /**
     * ApplicationType defines the OAuth2/OIDC client type and their ability to maintain
     * confidentiality of their credentials.
     * This influences the allowed grant types and the required authentication method.
     */
    applicationType: OIDCApplicationType;
    /**
     * The unique OAuth2/OIDC client_id used for authentication of the application,
     * e.g. at the token endpoint.
     */
    clientId: string;
    /** The authentication method type used by the application to authenticate at the token endpoint. */
    authMethodType: OIDCAuthMethodType;
    /**
     * PostLogoutRedirectURIs are the allowed URIs to redirect to after a logout.
     * The post_logout_redirect_uri parameter in the logout request must exactly match one of these URIs.
     */
    postLogoutRedirectUris: string[];
    /**
     * Version defines the OIDC version used by the application.
     * Currently, only version 1.0 is supported.
     * Future versions might introduce breaking changes.
     */
    version: OIDCVersion;
    /**
     * NonCompliant specifies whether the config is OIDC compliant. A production configuration SHOULD be compliant.
     * Non-compliant configurations can run into interoperability issues with OIDC libraries and tools.
     * Compliance problems are listed in the compliance_problems field.
     */
    nonCompliant: boolean;
    /**
     * ComplianceProblems lists the problems for non-compliant configurations.
     * In case of a compliant configuration, this list is empty.
     */
    complianceProblems: OIDCLocalizedMessage[];
    /**
     * DevelopmentMode can be enabled for development purposes. This allows the use of
     * OIDC non-compliant and potentially insecure settings, such as the use of
     * HTTP redirect URIs or wildcard redirect URIs.
     */
    developmentMode: boolean;
    /**
     * The AccessTokenType defines the type of the access token returned from ZITADEL.
     * Bearer tokens are opaque to clients. JWT tokens are self-contained and can be validated by the client.
     * Bearer tokens must be introspected at the ZITADEL token endpoint.
     */
    accessTokenType: OIDCTokenType;
    /**
     * If AccessTokenRoleAssertion is enabled, the roles of the user are added to the access token.
     * Ensure that the access token is a JWT token and not a bearer token. And either request the roles
     * by scope or enable the user role assertion on the project.
     */
    accessTokenRoleAssertion: boolean;
    /**
     * If IDTokenRoleAssertion is enabled, the roles of the user are added to the id token.
     * Ensure that either the roles are requested by scope or enable the user role assertion on the
     * project.
     */
    idTokenRoleAssertion: boolean;
    /**
     * If IDTokenUserinfoAssertion is enabled, the claims of profile, email, address and phone scopes
     * are added to the id token even if an access token is issued. This can be required by some applications
     * that do not call the userinfo endpoint after authentication or directly use the id_token for retrieving
     * user information.
     * Attention: this violates the OIDC specification, which states that these claims must only be
     * requested from the userinfo endpoint if an access token is issued. This is to prevent
     * leaking of personal information in the id token, which is often stored in the browser and
     * therefore more vulnerable.
     */
    idTokenUserinfoAssertion: boolean;
    /**
     * ClockSkew is used to compensate time differences between the servers of ZITADEL and the application.
     * It is added to the "exp" claim and subtracted from "iat", "auth_time" and "nbf" claims.
     * The default is 0s, the maximum is 5s.
     */
    clockSkew: Duration | undefined;
    /**
     * AdditionalOrigins are HTTP origins (scheme + host + port) from where the API can be used
     * additional to the redirect_uris.
     * This is useful if the application is used from an origin different to the redirect_uris,
     * e.g. if the application is a SPA served in a native app, where the redirect_uri is a custom scheme,
     * but the application is served from a https origin.
     */
    additionalOrigins: string[];
    /**
     * AllowedOrigins are all HTTP origins where the application is allowed to be used from.
     * This is used to prevent CORS issues in browsers.
     * If the origin of the request is not in this list, the request will be rejected.
     * This is especially important for SPAs.
     * Note that this is a generated list from the redirect_uris and additional_origins.
     * If you use the application from another origin, you have to add it to the additional_origins.
     */
    allowedOrigins: string[];
    /**
     * For native apps a successful login usually shows a success page with a link to open the application again.
     * SkipNativeAppSuccessPage can be used to skip this page and open the application directly.
     */
    skipNativeAppSuccessPage: boolean;
    /**
     * BackChannelLogoutURI is used to notify the application about terminated sessions according
     * to the OIDC Back-Channel Logout (https://openid.net/specs/openid-connect-backchannel-1_0.html).
     */
    backChannelLogoutUri: string;
    /**
     * LoginVersion specifies the login UI, where the user is redirected to for authentication.
     * It can be used to select a specific login UI, e.g. for embedded UIs or for custom login pages
     * hosted on any other domain.
     * If unset, the login UI is chosen by the instance default.
     */
    loginVersion: LoginVersion | undefined;
}
export declare const OIDCLocalizedMessage: MessageFns<OIDCLocalizedMessage>;
export declare const OIDCConfiguration: MessageFns<OIDCConfiguration>;
type Builtin = Date | Function | Uint8Array | string | number | boolean | undefined;
export type DeepPartial<T> = T extends Builtin ? T : T extends Long ? string | number | Long : T extends globalThis.Array<infer U> ? globalThis.Array<DeepPartial<U>> : T extends ReadonlyArray<infer U> ? ReadonlyArray<DeepPartial<U>> : T extends {} ? {
    [K in keyof T]?: DeepPartial<T[K]>;
} : Partial<T>;
export interface MessageFns<T> {
    encode(message: T, writer?: BinaryWriter): BinaryWriter;
    decode(input: BinaryReader | Uint8Array, length?: number): T;
    fromJSON(object: any): T;
    toJSON(message: T): unknown;
    create(base?: DeepPartial<T>): T;
    fromPartial(object: DeepPartial<T>): T;
}
export {};