/**
 * Result returned by an auth provider after successful authentication.
 */
export interface AuthResult {
    readonly externalId: string;
    readonly username: string;
    readonly email?: string;
    readonly displayName?: string;
    readonly avatarUrl?: string;
    readonly groups?: string[];
    readonly rawProfile?: unknown;
}
/**
 * Pluggable authentication provider.
 * Each addon can register one or more auth providers (collection capability).
 */
export interface IAuthProvider {
    readonly id: string;
    readonly name: string;
    readonly icon: string;
    /** Type of auth flow */
    readonly flowType: 'credentials' | 'redirect' | 'token';
    /**
     * For 'credentials' flow: validate username/password, return user info.
     */
    validateCredentials?(username: string, password: string): Promise<AuthResult | null>;
    /**
     * For 'redirect' flow (OIDC, OAuth2):
     * getLoginUrl() returns the URL to redirect the user to.
     * handleCallback() processes the callback and returns user info.
     */
    getLoginUrl?(state: string): string;
    handleCallback?(params: Record<string, string>): Promise<AuthResult>;
    /**
     * For 'token' flow: validate an external token (e.g., from mobile app).
     */
    validateToken?(token: string): Promise<AuthResult | null>;
}
//# sourceMappingURL=auth-provider.d.ts.map