import type { AuthProviderConfig } from '../config/types.js';
export interface OAuthProviderConfig {
    clientId: string;
    clientSecret: string;
    redirectUri: string;
}
export interface OAuthProviders {
    google?: OAuthProviderConfig;
    github?: OAuthProviderConfig;
    microsoft?: OAuthProviderConfig;
}
export interface OAuthState {
    provider: string;
    codeVerifier: string;
    returnTo: string;
    /** Optional nonce that the callback compares against a cookie value to prevent state-replay. */
    nonce?: string;
}
export interface OAuthCallbackOptions {
    /**
     * When true, allow self-signup: an OAuth login with no matching local user
     * creates a new CLIENT user. Defaults to false — without this flag, OAuth
     * logins for unknown emails are rejected and an admin must invite the user.
     *
     * Even when enabled, the integrator should restrict provisioning further
     * (for example, by checking the email domain) via the `onProvision` hook.
     */
    allowSelfSignup?: boolean;
    /**
     * Hook called immediately before a new user is created during self-signup.
     * Throw to reject the signup with a custom error.
     */
    onProvision?: (profile: OAuthUserProfile, provider: string) => Promise<void> | void;
}
export interface OAuthCallbackResult {
    provider: string;
    providerAccountId: string;
    email: string;
    name?: string;
    avatarUrl?: string;
    accessToken: string;
    refreshToken?: string;
    expiresAt?: Date;
}
export interface OAuthUserProfile {
    id: string;
    email: string;
    name: string;
    avatar?: string;
}
declare const PROVIDER_URLS: {
    readonly google: {
        readonly authorize: "https://accounts.google.com/o/oauth2/v2/auth";
        readonly token: "https://oauth2.googleapis.com/token";
        readonly userinfo: "https://www.googleapis.com/oauth2/v3/userinfo";
        readonly scopes: "openid email profile";
    };
    readonly github: {
        readonly authorize: "https://github.com/login/oauth/authorize";
        readonly token: "https://github.com/login/oauth/access_token";
        readonly userinfo: "https://api.github.com/user";
        readonly scopes: "read:user user:email";
    };
    readonly microsoft: {
        readonly authorize: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
        readonly token: "https://login.microsoftonline.com/common/oauth2/v2.0/token";
        readonly userinfo: "https://graph.microsoft.com/v1.0/me";
        readonly scopes: "openid email profile";
    };
};
export type OAuthProviderType = keyof typeof PROVIDER_URLS;
export declare function generateCodeVerifier(): string;
export declare function generateCodeChallenge(codeVerifier: string): Promise<string>;
export declare function generateState(provider: string, codeVerifier: string, returnTo: string, secret: string, nonce?: string): Promise<string>;
/** Generate a random base64url nonce suitable for binding state to a browser cookie. */
export declare function generateOAuthNonce(): string;
/**
 * Thrown when an OAuth state token verifies cryptographically but its decoded
 * payload doesn't match the expected `OAuthState` shape. Mapped to a 400 by
 * the callback handler — the user is then bounced back to the login page.
 */
export declare class InvalidOAuthStateError extends Error {
    constructor(reason: string);
}
export declare function verifyState(stateToken: string, secret: string): Promise<OAuthState>;
export declare function getAuthorizationUrl(provider: OAuthProviderType, config: OAuthProviderConfig, state: string, codeChallenge: string): string;
export declare function exchangeCodeForTokens(provider: OAuthProviderType, code: string, codeVerifier: string, config: OAuthProviderConfig): Promise<{
    access_token: string;
    id_token?: string;
    refresh_token?: string;
}>;
export declare function getUserProfile(provider: OAuthProviderType, accessToken: string): Promise<OAuthUserProfile>;
export declare function handleOAuthCallback(provider: string, code: string, stateToken: string, providers: OAuthProviders, secret: string, db: any, options?: OAuthCallbackOptions & {
    expectedNonce?: string | null;
}): Promise<{
    token: string;
    user: {
        id: string;
        email: string;
        name: string;
        role: string;
    };
}>;
/** @deprecated Use `initiateOAuth` pattern — kept for backward compat with auth/index.ts re-exports */
export declare function initiateOAuth(_providerConfig: AuthProviderConfig, _callbackUrl: string): Promise<{
    redirectUrl: string;
    state: OAuthState;
}>;
/** @deprecated Use `handleOAuthCallback` — kept for backward compat with auth/index.ts re-exports */
export declare function handleCallback(_providerConfig: AuthProviderConfig, _code: string, _state: OAuthState): Promise<OAuthCallbackResult>;
/** Link an OAuth account to an existing, already-authenticated user. */
export declare function linkAccount(userId: string, result: OAuthCallbackResult, db: unknown): Promise<void>;
export {};
//# sourceMappingURL=oauth.d.ts.map