import { Subject, type Observable } from "rxjs";
import type { Oidc, OidcInitializationError } from "./core";
import type { OidcMetadata } from "./core/OidcMetadata";
import { type Signal, type EnvironmentProviders } from "@angular/core";
import type { HttpInterceptorFn, HttpRequest } from "@angular/common/http";
import type { ReadonlyBehaviorSubject } from "./tools/ReadonlyBehaviorSubject";
import type { ValueOrAsyncGetter } from "./tools/ValueOrAsyncGetter";
export type ParamsOfProvide = {
    issuerUri: string;
    clientId: string;
    /**
     * The scopes being requested from the OIDC/OAuth2 provider (default: `["profile"]`
     * (the scope "openid" is added automatically as it's mandatory)
     **/
    scopes?: string[];
    /**
     * Transform the url (authorization endpoint) before redirecting to the login pages.
     *
     * The isSilent parameter is true when the redirect is initiated in the background iframe for silent signin.
     * This can be used to omit ui related query parameters (like `ui_locales`).
     */
    transformUrlBeforeRedirect?: (params: {
        authorizationUrl: string;
        isSilent: boolean;
    }) => string;
    /**
     * Extra query params to be added to the authorization endpoint url before redirecting or silent signing in.
     * You can provide a function that returns those extra query params, it will be called
     * when login() is called.
     *
     * Example: extraQueryParams: ()=> ({ ui_locales: "fr" })
     *
     * This parameter can also be passed to login() directly.
     */
    extraQueryParams?: Record<string, string | undefined> | ((params: {
        isSilent: boolean;
        url: string;
    }) => Record<string, string | undefined>);
    /**
     * Extra body params to be added to the /token POST request.
     *
     * It will be used when for the initial request, whenever the token is getting refreshed and if you call `renewTokens()`.
     * You can also provide this parameter directly to the `renewTokens()` method.
     *
     * It can be either a string to string record or a function that returns a string to string record.
     *
     * Example: extraTokenParams: ()=> ({ selectedCustomer: "xxx" })
     *          extraTokenParams: { selectedCustomer: "xxx" }
     */
    extraTokenParams?: Record<string, string | undefined> | (() => Record<string, string | undefined>);
    /**
     * Usage discouraged, it's here because we don't want to assume too much on your
     * usecase but I can't think of a scenario where you would want anything
     * other than the current page.
     *
     * Where to redirect after successful login.
     * Default: window.location.href (here)
     *
     * It does not need to include the origin, eg: "/dashboard"
     *
     * This parameter can also be passed to login() directly as `redirectUrl`.
     */
    postLoginRedirectUrl?: string;
    /**
     * This parameter defines after how many seconds of inactivity the user should be
     * logged out automatically.
     *
     * WARNING: It should be configured on the identity server side
     * as it's the authoritative source for security policies and not the client.
     * If you don't provide this parameter it will be inferred from the refresh token expiration time.
     * */
    idleSessionLifetimeInSeconds?: number;
    /**
     * Usage discouraged, this parameter exists because we don't want to assume
     * too much about your usecase but I can't think of a scenario where you would
     * want anything other than the current page.
     *
     * Default: { redirectTo: "current page" }
     */
    autoLogoutParams?: Parameters<Oidc.LoggedIn<any>["logout"]>[0];
    autoLogin?: boolean;
    /**
     * NOTE: Can be provided as parameter to oidcEarlyInit()
     *
     * Determines how session restoration is handled.
     * Session restoration allows users to stay logged in between visits
     * without needing to explicitly sign in each time.
     *
     * Options:
     *
     * - **"auto" (default)**:
     *   Automatically selects the best method.
     *   If the app’s domain shares a common parent domain with the authorization endpoint,
     *   an iframe is used for silent session restoration.
     *   Otherwise, a full-page redirect is used.
     *
     * - **"full page redirect"**:
     *   Forces full-page reloads for session restoration.
     *   Use this if your application is served with a restrictive CSP
     *   (e.g., `Content-Security-Policy: frame-ancestors "none"`)
     *   or `X-Frame-Options: DENY`, and you cannot modify those headers.
     *   This mode provides a slightly less seamless UX and will lead oidc-spa to
     *   store tokens in `localStorage` if multiple OIDC clients are used
     *   (e.g., your app communicates with several APIs).
     *
     * - **"iframe"**:
     *   Forces iframe-based session restoration.
     *   In development, if you go in your browser setting and allow your auth server’s domain
     *   to set third-party cookies this value will let you test your app
     *   with the local dev server as it will behave in production.
     */
    sessionRestorationMethod?: "iframe" | "full page redirect" | "auto";
    debugLogs?: boolean;
    /**
     * WARNING: This option exists solely as a workaround
     * for limitations in the Google OAuth API.
     * See: https://docs.oidc-spa.dev/providers-configuration/google-oauth
     *
     * Do not use this for other providers.
     * If you think you need a client secret in a SPA, you are likely
     * trying to use a confidential (private) client in the browser,
     * which is insecure and not supported.
     */
    __unsafe_clientSecret?: string;
    /**
     *  WARNING: Setting this to true is a workaround for provider
     *  like Google OAuth that don't support JWT access token.
     *  Use at your own risk, this is a hack.
     */
    __unsafe_useIdTokenAsAccessToken?: boolean;
    /**
     * This option should only be used as a last resort.
     *
     * If your OIDC provider is correctly configured, this should not be necessary.
     *
     * The metadata is normally retrieved automatically from:
     * `${issuerUri}/.well-known/openid-configuration`
     *
     * Use this only if that endpoint is not accessible (e.g. due to missing CORS headers
     * or non-standard deployments), and you cannot fix the server-side configuration.
     */
    __metadata?: Partial<OidcMetadata>;
    /**
     * You can use oidc.$secondsLeftBeforeAutoLogout to display an overlay/update the tab title
     * to indicate to your user that they are going to be logged out if they don't interact
     * with the app.
     * This value let you define how long before how long before auto logout this warning should
     * start showing.
     * Default is 60 seconds.
     */
    warnUserSecondsBeforeAutoLogout?: number;
    /**
     * This is only for opting out of DPoP for a specific OIDC client instance.
     * To enable DPoP see: https://docs.oidc-spa.dev/v/v10/security-features/dpop
     * */
    disableDPoP?: true;
};
export type ParamsOfProvideMock = {
    mockIssuerUri?: string;
    mockClientId?: string;
    mockAccessToken?: string;
    isUserInitiallyLoggedIn?: boolean;
};
export declare abstract class AbstractOidcService<T_DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec> {
    #private;
    protected autoLogin: boolean;
    protected providerAwaitsInitialization: boolean;
    protected decodedIdTokenSchema: {
        parse: (decodedIdToken_original: Oidc.Tokens.DecodedIdToken_OidcCoreSpec) => T_DecodedIdToken;
    } | undefined;
    protected mockDecodedIdToken: (() => Promise<T_DecodedIdToken>) | T_DecodedIdToken | undefined;
    static provide(params: ValueOrAsyncGetter<ParamsOfProvide>): EnvironmentProviders;
    static provideMock(params?: ParamsOfProvideMock): EnvironmentProviders;
    protected allowDecodedIdTokenAccessInShouldInjectAccessToken: boolean;
    static createBearerInterceptor(params: {
        shouldInjectAccessToken: (req: HttpRequest<unknown>) => boolean;
    }): HttpInterceptorFn;
    static get enforceLoginGuard(): (route: import("@angular/router").ActivatedRouteSnapshot) => Promise<boolean>;
    readonly prInitialized: Promise<true>;
    get initializationError(): OidcInitializationError | undefined;
    get issuerUri(): string;
    get clientId(): string;
    get validRedirectUri(): string;
    get backFromAuthServer(): {
        extraQueryParams: Record<string, string>;
        result: Record<string, string>;
    } | undefined;
    get isUserLoggedIn(): boolean;
    login(params?: {
        /**
         * Add extra query parameters to the url before redirecting to the login pages.
         */
        extraQueryParams?: Record<string, string | undefined>;
        /**
         * Where to redirect after successful login.
         * Default: window.location.href (here)
         *
         * It does not need to include the origin, eg: "/dashboard"
         */
        redirectUrl?: string;
        /**
         * Transform the url before redirecting to the login pages.
         * Prefer using the extraQueryParams parameter if you're only adding query parameters.
         */
        transformUrlBeforeRedirect?: (url: string) => string;
    }): Promise<never>;
    renewTokens(params?: {
        extraTokenParams?: Record<string, string | undefined>;
    }): Promise<void>;
    logout(params: {
        redirectTo: "home" | "current page";
    } | {
        redirectTo: "specific url";
        url: string;
    }): Promise<never>;
    goToAuthServer(params: {
        extraQueryParams?: Record<string, string | undefined>;
        redirectUrl?: string;
        transformUrlBeforeRedirect?: (url: string) => string;
    }): Promise<never>;
    decodedIdTokenAccess: Subject<void> | undefined;
    get decodedIdToken$(): ReadonlyBehaviorSubject<T_DecodedIdToken>;
    get $decodedIdToken(): Signal<T_DecodedIdToken>;
    getAccessToken(): Promise<{
        isUserLoggedIn: false;
        accessToken?: never;
    } | {
        isUserLoggedIn: true;
        accessToken: string;
    }>;
    readonly accessTokenRotation$: Observable<string>;
    readonly $secondsLeftBeforeAutoLogout: Signal<number | null>;
    get isNewBrowserSession(): boolean;
}
export declare class OidcAccessedTooEarlyError extends Error {
    constructor(message: string);
}