import { User } from '../user/types';
import { CodeChallengeMethod, OAuth2Code, OAuth2Token } from './types';
import { OAuth2Client } from '../oauth2-client/types';
export declare function getRedirectUris(client: OAuth2Client): Promise<string[]>;
export declare function validateRedirectUri(client: OAuth2Client, redirectUri: string): Promise<boolean>;
/**
 * Checks if a redirect_uri is permitted for the client.
 *
 * If not, it will emit an InvalidGrant error
 */
export declare function requireRedirectUri(client: OAuth2Client, redirectUrl: string): Promise<void>;
export declare function addRedirectUris(client: OAuth2Client, redirectUris: string[]): Promise<void>;
/**
 * This function is used for the implicit grant oauth2 flow.
 *
 * This function creates an access token for a specific user.
 */
export declare function generateTokenForUser(client: OAuth2Client, user: User, browserSessionId?: string): Promise<OAuth2Token>;
/**
 * This function is used for the client_credentials oauth2 flow.
 *
 * In this flow there is not a 3rd party (resource owner). There is simply 2
 * clients talk to each other.
 *
 * The client acts on behalf of itself, not someone else.
 */
export declare function generateTokenForClient(client: OAuth2Client): Promise<OAuth2Token>;
/**
 * This function is used for the authorization_code oauth2 flow.
 *
 * In this flow a user first authenticates itself and grants permisssion to
 * the client. After gaining permission the user gets redirected back to the
 * resource owner with a one-time code.
 *
 * The resource owner then exchanges that code for an access and refresh token.
 */
export declare function generateTokenFromCode(client: OAuth2Client, code: string, codeVerifier: string | undefined): Promise<OAuth2Token>;
export declare function validatePKCE(codeVerifier: string | undefined, codeChallenge: string | undefined, codeChallengeMethod: CodeChallengeMethod): void;
/**
 * This function is used for the 'refresh_token' grant.
 *
 * By specifying a refresh token, a new access/refresh token pair gets
 * returned. This also expires the old token.
 */
export declare function generateTokenFromRefreshToken(client: OAuth2Client, refreshToken: string): Promise<OAuth2Token>;
export declare function revokeByAccessRefreshToken(client: OAuth2Client, token: string): Promise<void>;
/**
 * Removes a token.
 *
 * This function will not throw an error if the token was deleted before.
 */
export declare function revokeToken(token: OAuth2Token): Promise<void>;
/**
 * This function is used for the authorization_code grant flow.
 *
 * This function creates an code for a user. The code is later exchanged for
 * a oauth2 access token.
 */
export declare function generateCodeForUser(client: OAuth2Client, user: User, codeChallenge: string | undefined, codeChallengeMethod: string | undefined, browserSessionId: string): Promise<OAuth2Code>;
/**
 * Returns Token information for an existing Access Token.
 *
 * This effectively gives you all information of an access token if you have
 * just the bearer, and allows you to validate if a bearer token is valid.
 *
 * This function will throw NotFound if the token was not recognized.
 */
export declare function getTokenByAccessToken(accessToken: string): Promise<OAuth2Token>;
/**
 * Returns Token information for an existing Refresh Token.
 *
 * This function will throw NotFound if the token was not recognized.
 */
export declare function getTokenByRefreshToken(refreshToken: string): Promise<OAuth2Token>;
/**
 * Removes all tokens that relate to a specific browser session id.
 *
 * This will cause all access tokens and refresh tokens to be invalidated. Generally
 * used when a user logs out.
 *
 * This doesn't remove all tokens for all sessions, but should remove the tokens that
 * relate to the device the user used to log out.
 */
export declare function invalidateTokensByBrowserSessionId(browserSessionId: string): Promise<void>;