import { type EnvironmentConfig } from "../../config/environment-config.js";
import { type EnvReader } from "../providers/base.js";
import type { AuthorizationUrlOptions, OAuthServiceConfig, TokenStore } from "../types.js";
/** Signature for resolving the authenticated user's ID from a request. */
export type GetUserIdFn = (req: Request) => string | null | Promise<string | null>;
/** Options accepted by oauth init handler. */
export interface OAuthInitHandlerOptions {
    /** Shared token store. Optional only in explicit development/test environments. */
    tokenStore?: TokenStore;
    /** Base URL for callbacks (defaults to APP_URL or localhost) */
    baseUrl?: string;
    /**
     * Physical callback route. Defaults to the logical service ID.
     *
     * Set this to the dispatcher's shared route when multiple logical services
     * complete through one provider callback URI.
     */
    callbackRouteId?: string;
    /** Additional authorization options */
    authOptions?: AuthorizationUrlOptions;
    /** EnvironmentConfig for test isolation (defaults to getEnvironmentConfig()) */
    env?: EnvironmentConfig;
    /** EnvReader for dynamic env vars (defaults to getEnv) */
    envReader?: EnvReader;
    /**
     * Optional authentication check. If supplied and returns false the request
     * is rejected with 401. Independent from `getUserId` which always runs.
     */
    isAuthenticated?: (req: Request) => boolean | Promise<boolean>;
    /**
     * REQUIRED. Resolve the authenticated user's id. The returned id is
     * persisted with the OAuth `state` so the callback stores tokens in that
     * user's slot. Return `null` (or an empty string) to reject unauthenticated
     * requests with 401. NEVER return a shared constant like "anonymous" —
     * that re-introduces VULN-AUTH-2.
     */
    getUserId: GetUserIdFn;
}
/** Handler for create oauth init. */
export declare function createOAuthInitHandler(config: OAuthServiceConfig, options: OAuthInitHandlerOptions): (req: Request) => Promise<Response>;
export interface OAuthStatusHandlerOptions {
    /** Shared token store. Optional only in explicit development/test environments. */
    tokenStore?: TokenStore;
    /** EnvironmentConfig for store policy/test isolation. */
    env?: EnvironmentConfig;
    /** EnvReader for dynamic env vars (defaults to getEnv) */
    envReader?: EnvReader;
    /** Optional authentication check — return true if the request is authenticated */
    isAuthenticated?: (req: Request) => boolean | Promise<boolean>;
    /** REQUIRED. Resolve the authenticated user's ID (see OAuthInitHandlerOptions). */
    getUserId: GetUserIdFn;
}
/** Handler for create oauth status. */
export declare function createOAuthStatusHandler(config: OAuthServiceConfig, options: OAuthStatusHandlerOptions): (req: Request) => Promise<Response>;
export interface OAuthDisconnectHandlerOptions {
    /** Shared token store. Optional only in explicit development/test environments. */
    tokenStore?: TokenStore;
    /** EnvironmentConfig for store policy/test isolation. */
    env?: EnvironmentConfig;
    /** Public application origin used for same-origin CSRF validation. */
    baseUrl?: string;
    /** Optional authentication check — return true if the request is authenticated */
    isAuthenticated?: (req: Request) => boolean | Promise<boolean>;
    /** REQUIRED. Resolve the authenticated user's ID (see OAuthInitHandlerOptions). */
    getUserId: GetUserIdFn;
}
/** Handler for create oauth disconnect. */
export declare function createOAuthDisconnectHandler(config: OAuthServiceConfig, options: OAuthDisconnectHandlerOptions): (req: Request) => Promise<Response>;
//# sourceMappingURL=init-handler.d.ts.map