import { type OidcMetadata } from "./OidcMetadata";
import { type AuthResponse } from "./AuthResponse";
import type { Oidc } from "./Oidc";
import type { Evt } from "../tools/Evt";
import type { ParamsOfCreateGetServerDateNow } from "../tools/getServerDateNow";
export type ParamsOfCreateOidc<DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec, AutoLogin extends boolean = false> = {
    /**
     * See: https://docs.oidc-spa.dev/v/v10/providers-configuration/provider-configuration
     */
    issuerUri: string;
    /**
     * See: https://docs.oidc-spa.dev/v/v10/providers-configuration/provider-configuration
     */
    clientId: string;
    /**
     * The scopes being requested from the OIDC/OAuth2 provider (default: `["profile"]`
     * (the scope "openid" is added automatically as it's mandatory)
     **/
    scopes?: string[];
    /**
     * Transform the url (authorization endpoint) before redirecting to the login pages.
     *
     * The isSilent parameter is true when the redirect is initiated in the background iframe for silent signin.
     * This can be used to omit ui related query parameters (like `ui_locales`).
     */
    transformUrlBeforeRedirect?: (params: {
        authorizationUrl: string;
        isSilent: boolean;
    }) => string;
    /**
     * Extra query params to be added to the authorization endpoint url before redirecting or silent signing in.
     * You can provide a function that returns those extra query params, it will be called
     * when login() is called.
     *
     * Example: extraQueryParams: ()=> ({ ui_locales: "fr" })
     *
     * This parameter can also be passed to login() directly.
     */
    extraQueryParams?: Record<string, string | undefined> | ((params: {
        isSilent: boolean;
        url: string;
    }) => Record<string, string | undefined>);
    /**
     * Extra body params to be added to the /token POST request.
     *
     * It will be used when for the initial request, whenever the token is getting refreshed and if you call `renewTokens()`.
     * You can also provide this parameter directly to the `renewTokens()` method.
     *
     * It can be either a string to string record or a function that returns a string to string record.
     *
     * Example: extraTokenParams: ()=> ({ selectedCustomer: "xxx" })
     *          extraTokenParams: { selectedCustomer: "xxx" }
     */
    extraTokenParams?: Record<string, string | undefined> | (() => Record<string, string | undefined>);
    decodedIdTokenSchema?: {
        parse: (decodedIdToken_original: Oidc.Tokens.DecodedIdToken_OidcCoreSpec) => DecodedIdToken;
    };
    /**
     * This parameter defines after how many seconds of inactivity the user should be
     * logged out automatically.
     *
     * WARNING: It should be configured on the identity server side
     * as it's the authoritative source for security policies and not the client.
     * If you don't provide this parameter it will be inferred from the refresh token expiration time.
     * Some provider however don't issue a refresh token or do not correctly set the
     * expiration time. This parameter enable you to hard code the value to compensate
     * the shortcoming of your auth server.
     * */
    idleSessionLifetimeInSeconds?: number;
    /**
     * Extra optional parameter specific to oidc-spa
     * (not present in the original keycloak-js module)
     *
     * Where to redirect when auto logout happens due to session expiration
     * on the Keycloak server.
     *
     * Example:
     * autoLogoutParams: { redirectTo: "current page" } // Default
     * autoLogoutParams: { redirectTo: "home" }
     * autoLogoutParams: { redirectTo: "specific url", url: "/your-session-has-expired" }
     * autoLogoutParams: {
     *      redirectTo: "specific url",
     *      get url(){ return `/your-session-has-expired?return_url=${encodeURIComponent(location.href)}`; }
     * }
     */
    autoLogoutParams?: {
        redirectTo: "home" | "current page";
    } | {
        redirectTo: "specific url";
        url: string;
    };
    autoLogin?: AutoLogin;
    /**
     * NOTE: Can be provided as parameter to the Vite plugin or to oidcEarlyInit()
     *
     * Determines how session restoration is handled.
     * Session restoration allows users to stay logged in between visits
     * without needing to explicitly sign in each time.
     *
     * Options:
     *
     * - **"auto" (default)**:
     *   Automatically selects the best method.
     *   If the app’s domain shares a common parent domain with the authorization endpoint,
     *   an iframe is used for silent session restoration.
     *   Otherwise, a full-page redirect is used.
     *
     * - **"full page redirect"**:
     *   Forces full-page reloads for session restoration.
     *   Use this if your application is served with a restrictive CSP
     *   (e.g., `Content-Security-Policy: frame-ancestors "none"`)
     *   or `X-Frame-Options: DENY`, and you cannot modify those headers.
     *   This mode provides a slightly less seamless UX and will lead oidc-spa to
     *   store tokens in `localStorage` if multiple OIDC clients are used
     *   (e.g., your app communicates with several APIs).
     *
     * - **"iframe"**:
     *   Forces iframe-based session restoration.
     *   In development, if you go in your browser setting and allow your auth server’s domain
     *   to set third-party cookies this value will let you test your app
     *   with the local dev server as it will behave in production.
     *
     *  See: https://docs.oidc-spa.dev/v/v10/resources/third-party-cookies-and-session-restoration
     */
    sessionRestorationMethod?: "iframe" | "full page redirect" | "auto";
    debugLogs?: boolean;
    /**
     * WARNING: This option exists solely as a workaround
     * for limitations in the Google OAuth API.
     * See: https://docs.oidc-spa.dev/providers-configuration/google-oauth
     *
     * Do not use this for other providers.
     * If you think you need a client secret in a SPA, you are likely
     * trying to use a confidential (private) client in the browser,
     * which is insecure and not supported.
     */
    __unsafe_clientSecret?: string;
    /**
     *  WARNING: Setting this to true is a workaround for provider
     *  like Google OAuth that don't support JWT access token.
     *  Use at your own risk, this is a hack.
     */
    __unsafe_useIdTokenAsAccessToken?: boolean;
    /**
     * This option should only be used as a last resort.
     *
     * If your OIDC provider is correctly configured, this should not be necessary.
     *
     * The metadata is normally retrieved automatically from:
     * `${issuerUri}/.well-known/openid-configuration`
     *
     * Use this only if that endpoint is not accessible (e.g. due to missing CORS headers
     * or non-standard deployments), and you cannot fix the server-side configuration.
     */
    __metadata?: Partial<OidcMetadata>;
    /**
     * NOTE: This parameter is optional if you use the Vite plugin.
     *
     * This parameter let's you overwrite the value provided in
     * oidcEarlyInit({ BASE_URL: xxx });
     *
     * What should you put in this parameter?
     *   - Vite project:             `BASE_URL: import.meta.env.BASE_URL`
     *   - Create React App project: `BASE_URL: process.env.PUBLIC_URL`
     *   - Other:                    `BASE_URL: "/"` (Usually, or `/dashboard` if your app is not at the root of the domain)
     */
    BASE_URL?: string;
    /**
     * This parameter is irrelevant in most usecases.
     * It tells where to redirect after a successful login or autoLogin.
     *
     * If you are not in autoLogin mode there is absolutely no reason to use
     * this parameter since you can pass `login({ redirectUrl: "..." })`.
     *
     * It can only be useful in some edge case with `autoLogin: true`
     * When you want to precisely redirect somewhere after login.
     *
     * This can make sense if you have multiple clients to talk with different
     * API and no iframe capabilities.
     */
    postLoginRedirectUrl?: string;
    /**
     * This is only for opting out of DPoP for a specific OIDC client instance.
     * To enable DPoP see: https://docs.oidc-spa.dev/v/v10/security-features/dpop
     * */
    disableDPoP?: true;
};
export type Exports_earlyInit = {
    shouldLoadApp: false;
} | {
    shouldLoadApp: true;
    getEvtIframeAuthResponse: () => Evt<AuthResponse>;
    getRedirectAuthResponse: () => {
        authResponse: AuthResponse;
        clearAuthResponse: () => void;
    } | {
        authResponse: undefined;
        clearAuthResponse?: never;
    };
    sessionRestorationMethod: "iframe" | "full page redirect" | "auto" | undefined;
};
export declare function registerExports_earlyInit(exports: Exports_earlyInit): void;
export type Exports_tokenSubstitution = {
    getTokensPlaceholders: (params: {
        configId: string;
        tokens: Exports_tokenSubstitution.Tokens;
    }) => Exports_tokenSubstitution.Tokens;
};
export declare namespace Exports_tokenSubstitution {
    type Tokens = {
        accessToken: string;
        idToken: string;
        refreshToken?: string;
    };
}
export declare function registerExports_tokenSubstitution(exports: Exports_tokenSubstitution): void;
export type Exports_DPoP = {
    isEnforced: boolean;
    createDPoPStore: (params: {
        implementation: "indexedDB" | "in memory";
        configId: string;
        clientId: string;
    }) => Exports_DPoP.DPoPStore;
    registerAccessTokenForDPoP: (params: {
        configId: string;
        accessToken: string;
        paramsOfCreateGetServerDateNow: ParamsOfCreateGetServerDateNow;
    }) => void;
};
export declare namespace Exports_DPoP {
    type DPoPState = {
        keys: CryptoKeyPair;
        nonce?: string;
    };
    type DPoPStore = {
        set: (key: string, value: DPoPState) => Promise<void>;
        get: (key: string) => Promise<DPoPState>;
        remove: (key: string) => Promise<DPoPState>;
        getAllKeys: () => Promise<string[]>;
    };
}
export declare function registerExports_DPoP(exports: Exports_DPoP): void;
/** @see: https://docs.oidc-spa.dev/v/v10/usage */
export declare function createOidc<DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec, AutoLogin extends boolean = false>(params: ParamsOfCreateOidc<DecodedIdToken, AutoLogin>): Promise<AutoLogin extends true ? Oidc.LoggedIn<DecodedIdToken> : Oidc<DecodedIdToken>>;
export declare function createOidc_nonMemoized<DecodedIdToken extends Record<string, unknown>, AutoLogin extends boolean>(params: Omit<ParamsOfCreateOidc<DecodedIdToken, AutoLogin>, "issuerUri" | "clientId" | "debugLogs">, preProcessedParams: {
    issuerUri: string;
    clientId: string;
    configId: string;
    log: typeof console.log | undefined;
}): Promise<AutoLogin extends true ? Oidc.LoggedIn<DecodedIdToken> : Oidc<DecodedIdToken>>;