import type { User } from '@n8n/db';
import type { OAuthResourceGrant } from 'n8n-workflow';
export type AuthFailureReason = 'missing_authorization_header' | 'invalid_bearer_format' | 'jwt_decode_failed' | 'invalid_token' | 'token_not_found_in_db' | 'user_not_found' | 'user_id_not_in_auth_info' | 'unknown_error' | 'verifier_not_registered' | 'insufficient_scope';
export type Mcpauth_type = 'oauth' | 'api_key' | 'unknown';
export type McpResolvedAuthType = Exclude<Mcpauth_type, 'unknown'>;
export type McpCallerAuth = {
    authType: 'oauth';
    clientId: string;
} | {
    authType: 'api_key';
    clientId?: never;
};
export type TelemetryAuthContext = {
    reason: AuthFailureReason;
    auth_type: Mcpauth_type;
    error_details?: string;
};
export type UserWithContext = {
    user: User | null;
    actor?: User;
    context?: TelemetryAuthContext;
    caller?: McpCallerAuth;
    scopes?: string[];
    grant?: OAuthResourceGrant;
};
export interface OAuthTokenVerifier {
    verifyOAuthAccessToken(token: string, expectedAudience?: string, grant?: OAuthResourceGrant): Promise<UserWithContext>;
    authorizeSealedGrant(userId: string, grant: OAuthResourceGrant): Promise<boolean>;
}
export declare class OAuthTokenVerifierProxy implements OAuthTokenVerifier {
    private provider;
    registerProvider(provider: OAuthTokenVerifier): void;
    verifyOAuthAccessToken(token: string, expectedAudience?: string, grant?: OAuthResourceGrant): Promise<UserWithContext>;
    authorizeSealedGrant(userId: string, grant: OAuthResourceGrant): Promise<boolean>;
}