/**
 * Authentication Utilities
 *
 * Shared authentication functionality for CounterMeasure applications.
 */
export interface TokenPayload {
    sub: string;
    exp: number;
    iat: number;
    roles?: string[];
    groups?: string[];
}
export interface AuthResponse {
    access_token: string;
    refresh_token?: string;
    token_type: string;
    expires_in: number;
}
export interface AuthTokenStorage {
    getAccessToken: () => string | null;
    getRefreshToken: () => string | null;
    setTokens: (accessToken: string, refreshToken?: string) => void;
    clearTokens: () => void;
}
export interface AuthTokenStorageConfig {
    accessTokenKey?: string;
    refreshTokenKey?: string;
}
export interface InitialAuthTokens {
    accessToken?: string | null;
    refreshToken?: string | null;
}
export interface UserInfo {
    id: string;
    username: string;
    email: string;
    display_name?: string;
    roles: string[];
    groups: string[];
    is_active: boolean;
    is_verified: boolean;
}
export interface MfaSetupPayload {
    secret: string;
    qr_code: string;
    recovery_codes?: string[];
}
export interface MfaChallenge {
    challenge_id: string;
    challenge_type: 'totp' | 'webauthn' | 'recovery';
}
export interface WebConfig {
    app_name?: string;
    app_links?: AppLink[];
}
export interface AppLink {
    name: string;
    url: string;
    icon?: string;
}
export interface AuthConfig {
    /** Legacy localStorage key for access tokens. Ignored when tokenStorage is provided. */
    accessTokenKey?: string;
    /** Legacy localStorage key for refresh tokens. Ignored when tokenStorage is provided. */
    refreshTokenKey?: string;
    apiBasePath?: string;
    /**
     * Token storage strategy. Prefer cookie-backed auth or createMemoryTokenStorage().
     * The default localStorage strategy is retained for compatibility and development.
     */
    tokenStorage?: AuthTokenStorage;
}
/**
 * Legacy token storage backed by localStorage. Prefer memory-only storage or
 * server-managed HttpOnly cookies for production auth flows.
 */
export declare function createLocalStorageTokenStorage(storageConfig?: AuthTokenStorageConfig): AuthTokenStorage;
/** Create an in-memory token store that does not persist tokens across reloads. */
export declare function createMemoryTokenStorage(initialTokens?: InitialAuthTokens): AuthTokenStorage;
/**
 * Create an auth manager instance with the given configuration.
 */
export declare function createAuthManager(userConfig?: AuthConfig): {
    getAccessToken: () => string | null;
    getRefreshToken: () => string | null;
    setTokens: (accessToken: string, refreshToken?: string) => void;
    clearTokens: () => void;
    parseToken: (token: string) => TokenPayload | null;
    isTokenExpired: (token: string) => boolean;
    isAuthenticated: () => boolean;
    refreshAccessToken: () => Promise<string | null>;
    logout: () => Promise<void>;
    fetchWithAuth: (url: string, options?: RequestInit) => Promise<Response>;
    extractTokenFromResponse: (response: unknown) => AuthResponse | null;
    extractMfaChallengeFromResponse: (response: unknown) => MfaChallenge | null;
    config: {
        accessTokenKey: string;
        refreshTokenKey: string;
        apiBasePath: string;
        /**
         * Token storage strategy. Prefer cookie-backed auth or createMemoryTokenStorage().
         * The default localStorage strategy is retained for compatibility and development.
         */
        tokenStorage?: AuthTokenStorage;
    };
    tokenStorage: AuthTokenStorage;
};
export declare function getDefaultAuthManager(config?: AuthConfig): {
    getAccessToken: () => string | null;
    getRefreshToken: () => string | null;
    setTokens: (accessToken: string, refreshToken?: string) => void;
    clearTokens: () => void;
    parseToken: (token: string) => TokenPayload | null;
    isTokenExpired: (token: string) => boolean;
    isAuthenticated: () => boolean;
    refreshAccessToken: () => Promise<string | null>;
    logout: () => Promise<void>;
    fetchWithAuth: (url: string, options?: RequestInit) => Promise<Response>;
    extractTokenFromResponse: (response: unknown) => AuthResponse | null;
    extractMfaChallengeFromResponse: (response: unknown) => MfaChallenge | null;
    config: {
        accessTokenKey: string;
        refreshTokenKey: string;
        apiBasePath: string;
        /**
         * Token storage strategy. Prefer cookie-backed auth or createMemoryTokenStorage().
         * The default localStorage strategy is retained for compatibility and development.
         */
        tokenStorage?: AuthTokenStorage;
    };
    tokenStorage: AuthTokenStorage;
};
export declare const getAccessToken: () => string | null;
export declare const getRefreshToken: () => string | null;
export declare const setTokens: (accessToken: string, refreshToken?: string) => void;
export declare const clearTokens: () => void;
export declare const parseToken: (token: string) => TokenPayload | null;
export declare const isTokenExpired: (token: string) => boolean;
export declare const isAuthenticated: () => boolean;
export declare const refreshAccessToken: () => Promise<string | null>;
export declare const logout: () => Promise<void>;
export declare const fetchWithAuth: (url: string, options?: RequestInit) => Promise<Response>;
//# sourceMappingURL=index.d.ts.map