import { BinaryReader, BinaryWriter } from "@bufbuild/protobuf/wire";
import Long from "long";
import { Duration } from "../../../google/protobuf/duration.js";
import { Options } from "../../idp/v2/idp.js";
import { ResourceOwnerType } from "./settings.js";
export declare const protobufPackage = "zitadel.settings.v2";
export declare enum SecondFactorType {
    SECOND_FACTOR_TYPE_UNSPECIFIED = 0,
    /** SECOND_FACTOR_TYPE_OTP - Deprecated: use SECOND_FACTOR_TYPE_TOTP instead. */
    SECOND_FACTOR_TYPE_OTP = 1,
    SECOND_FACTOR_TYPE_TOTP = 1,
    SECOND_FACTOR_TYPE_U2F = 2,
    SECOND_FACTOR_TYPE_OTP_EMAIL = 3,
    SECOND_FACTOR_TYPE_OTP_SMS = 4,
    UNRECOGNIZED = -1
}
export declare function secondFactorTypeFromJSON(object: any): SecondFactorType;
export declare function secondFactorTypeToJSON(object: SecondFactorType): string;
export declare enum MultiFactorType {
    MULTI_FACTOR_TYPE_UNSPECIFIED = 0,
    MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION = 1,
    UNRECOGNIZED = -1
}
export declare function multiFactorTypeFromJSON(object: any): MultiFactorType;
export declare function multiFactorTypeToJSON(object: MultiFactorType): string;
export declare enum PasskeysType {
    PASSKEYS_TYPE_NOT_ALLOWED = 0,
    PASSKEYS_TYPE_ALLOWED = 1,
    UNRECOGNIZED = -1
}
export declare function passkeysTypeFromJSON(object: any): PasskeysType;
export declare function passkeysTypeToJSON(object: PasskeysType): string;
export declare enum IdentityProviderType {
    IDENTITY_PROVIDER_TYPE_UNSPECIFIED = 0,
    IDENTITY_PROVIDER_TYPE_OIDC = 1,
    IDENTITY_PROVIDER_TYPE_JWT = 2,
    IDENTITY_PROVIDER_TYPE_LDAP = 3,
    IDENTITY_PROVIDER_TYPE_OAUTH = 4,
    IDENTITY_PROVIDER_TYPE_AZURE_AD = 5,
    IDENTITY_PROVIDER_TYPE_GITHUB = 6,
    IDENTITY_PROVIDER_TYPE_GITHUB_ES = 7,
    IDENTITY_PROVIDER_TYPE_GITLAB = 8,
    IDENTITY_PROVIDER_TYPE_GITLAB_SELF_HOSTED = 9,
    IDENTITY_PROVIDER_TYPE_GOOGLE = 10,
    IDENTITY_PROVIDER_TYPE_SAML = 11,
    IDENTITY_PROVIDER_TYPE_APPLE = 12,
    UNRECOGNIZED = -1
}
export declare function identityProviderTypeFromJSON(object: any): IdentityProviderType;
export declare function identityProviderTypeToJSON(object: IdentityProviderType): string;
export interface LoginSettings {
    /**
     * If enabled, users can log in locally with their username and passkeys or password.
     * Disabling this option will require users to log in with an external identity provider.
     * Be sure to allow at least one external identity provider if this option is disabled.
     * Deprecated: check allow_local_authentication instead.
     *
     * @deprecated
     */
    allowUsernamePassword: boolean;
    /**
     * If enabled, users can log in locally with their username and passkeys or password.
     * Disabling this option will require users to log in with an external identity provider.
     * Be sure to allow at least one external identity provider if this option is disabled.
     */
    allowLocalAuthentication: boolean;
    /**
     * If enabled, users can register a local account by themself.
     * This option does not effect external identity providers.
     * Each identity provider can be configured to allow or disallow registration.
     */
    allowRegister: boolean;
    /**
     * If enabled, users will generally be allowed to use an external identity provider to log in.
     * Be sure to allow at least one external identity provider if this option is enabled.
     */
    allowExternalIdp: boolean;
    /**
     * If enabled, users will be forced to use a multi-factor to log in.
     * This also applies to federated logins through an external identity provider.
     * Users will be required to set up a second factor if they have not done so already.
     */
    forceMfa: boolean;
    /**
     * Defines the usage of passkeys for users.
     * PASSKEYS_TYPE_NOT_ALLOWED: Users are not allowed to use passkeys.
     * PASSKEYS_TYPE_ALLOWED: Users are allowed to use passkeys.
     * There will be additional options in the future.
     * If passkeys are allowed, users can choose to use passkeys or password for local authentication.
     * A verified passkey authentication will not require a second factor, if force_mfa is enabled.
     */
    passkeysType: PasskeysType;
    /** If enabled, the password reset link will be hidden on the login screen. */
    hidePasswordReset: boolean;
    /**
     * If enabled, an unknown username on the login screen will not return an error directly,
     * but will always display the password screen.
     * This prevents user enumeration attacks.
     */
    ignoreUnknownUsernames: boolean;
    /** Defines where the user will be redirected to if the login is started without app context (e.g. from mail). */
    defaultRedirectUri: string;
    /**
     * The duration a password check is valid.
     * After this time has passed, the user will be required to re-validate their
     * password on the next action that requires authentication.
     * Note that this does not enforce a logout or session expiration.
     */
    passwordCheckLifetime: Duration | undefined;
    /**
     * The duration a login through an external identity provider is valid.
     * After this time has passed, the user will be required to re-authenticate with the
     * external identity provider on the next action that requires authentication.
     * Note that this does not enforce a logout or session expiration.
     */
    externalLoginCheckLifetime: Duration | undefined;
    /** Defines after how much time the mfa prompt will be shown again. */
    mfaInitSkipLifetime: Duration | undefined;
    /**
     * The duration a second factor check is valid.
     * After this time has passed, the user will be required to re-validate their
     * second factor on the next action that requires authentication.
     * Note that this does not enforce a logout or session expiration.
     */
    secondFactorCheckLifetime: Duration | undefined;
    /**
     * The duration a multi-factor check is valid.
     * After this time has passed, the user will be required to re-validate their
     * multi-factor on the next action that requires authentication.
     * Note that this does not enforce a logout or session expiration.
     */
    multiFactorCheckLifetime: Duration | undefined;
    /** The list of allowed second factors. */
    secondFactors: SecondFactorType[];
    /** The list of allowed multi factors. */
    multiFactors: MultiFactorType[];
    /**
     * Allow discovery of the organization and its authentication option by domain.
     * If set to true, the suffix (@domain.com) of an unknown username input on the login screen
     * will be matched against the organization domains and will redirect to the registration of that organization on success.
     * The registration can either be locally (requires allow_register to be true) or through an external identity provider.
     * In case only one identity provider is configured for the organization, the user will be redirected directly to the identity provider.
     */
    allowDomainDiscovery: boolean;
    /**
     * By default, users can login with their verified email address additionally to their login name.
     * Setting this to true disables the email login.
     * Note: If the email is set as the login name, this setting has no effect.
     */
    disableLoginWithEmail: boolean;
    /**
     * By default, users can login with their verified phone number additionally to their login name.
     * Setting this to true disables the phone number login.
     * Note: If the phone number is set as the login name, this setting has no effect.
     */
    disableLoginWithPhone: boolean;
    /**
     * ResourceOwnerType returns if the settings is managed on the organization explicitly or
     * fell back on the instance settings.
     */
    resourceOwnerType: ResourceOwnerType;
    /**
     * If enabled, users will be forced to use a multi-factor to log in if they authenticated locally.
     * This does not apply to federated logins through an external identity provider.
     * Users will be required to set up a second factor if they have not done so already.
     * If both force_mfa and force_mfa_local_only are enabled, force_mfa takes precedence and
     * all logins will require a second factor.
     */
    forceMfaLocalOnly: boolean;
}
export interface IdentityProvider {
    id: string;
    name: string;
    type: IdentityProviderType;
    options: Options | undefined;
}
export declare const LoginSettings: MessageFns<LoginSettings>;
export declare const IdentityProvider: MessageFns<IdentityProvider>;
type Builtin = Date | Function | Uint8Array | string | number | boolean | undefined;
export type DeepPartial<T> = T extends Builtin ? T : T extends Long ? string | number | Long : T extends globalThis.Array<infer U> ? globalThis.Array<DeepPartial<U>> : T extends ReadonlyArray<infer U> ? ReadonlyArray<DeepPartial<U>> : T extends {} ? {
    [K in keyof T]?: DeepPartial<T[K]>;
} : Partial<T>;
export interface MessageFns<T> {
    encode(message: T, writer?: BinaryWriter): BinaryWriter;
    decode(input: BinaryReader | Uint8Array, length?: number): T;
    fromJSON(object: any): T;
    toJSON(message: T): unknown;
    create(base?: DeepPartial<T>): T;
    fromPartial(object: DeepPartial<T>): T;
}
export {};