/**
 * @fileoverview OAuth Callback Handler for MCP OAuth flows
 *
 * Handles OAuth authorization callbacks from external authorization servers.
 * This endpoint is unauthenticated since it's called by the auth server after user consent.
 *
 * Endpoints:
 * - GET /api/v1/oauth/callback - Authorization callback
 * - GET /api/v1/oauth/status/:stateParameter - Poll for authorization status (authenticated)
 * - POST /api/v1/oauth/initiate - Initiate OAuth flow (authenticated)
 *
 * @module @memberjunction/server/rest/OAuthCallbackHandler
 */
import express from 'express';
/**
 * Configuration for OAuth callback handler
 */
export interface OAuthCallbackHandlerOptions {
    /** Base URL for this MJAPI instance (for redirects) */
    publicUrl: string;
    /** URL to redirect to after successful authorization */
    successRedirectUrl?: string;
    /** URL to redirect to after failed authorization */
    errorRedirectUrl?: string;
}
/**
 * Handles OAuth callbacks and related endpoints for MCP server authentication.
 *
 * The callback endpoint is unauthenticated because it's called by external auth servers.
 * It uses the state parameter to look up the authorization context and validate the flow.
 *
 * @example
 * ```typescript
 * const oauthHandler = new OAuthCallbackHandler({
 *     publicUrl: 'https://api.example.com'
 * });
 *
 * // Mount unauthenticated callback route
 * app.use('/api/v1/oauth', oauthHandler.getCallbackRouter());
 *
 * // Mount authenticated routes
 * app.use('/api/v1/oauth', authMiddleware, oauthHandler.getAuthenticatedRouter());
 * ```
 */
export declare class OAuthCallbackHandler {
    private readonly options;
    private readonly oauthManager;
    private readonly callbackRouter;
    private readonly authenticatedRouter;
    constructor(options: OAuthCallbackHandlerOptions);
    /**
     * Sets up all routes for OAuth handling.
     */
    private setupRoutes;
    /**
     * Renders a success page after OAuth authorization completes.
     */
    private handleSuccessPage;
    /**
     * Renders an error page when OAuth authorization fails.
     */
    private handleErrorPage;
    /**
     * Handles the OAuth authorization callback.
     *
     * This endpoint is unauthenticated - the auth server redirects here after user consent.
     * We validate the state parameter and exchange the code for tokens.
     *
     * @param req - Express request
     * @param res - Express response
     */
    private handleCallback;
    /**
     * Gets the status of an OAuth authorization flow.
     *
     * Authenticated endpoint for polling authorization status.
     *
     * @param req - Express request
     * @param res - Express response
     */
    private getStatus;
    /**
     * Initiates a new OAuth authorization flow.
     *
     * Authenticated endpoint for starting OAuth authorization.
     *
     * @param req - Express request
     * @param res - Express response
     */
    private initiateFlow;
    /**
     * Exchanges an authorization code for tokens.
     *
     * This endpoint is used when the frontend handles the OAuth callback.
     * The frontend receives the code and state from the OAuth provider redirect,
     * then calls this authenticated endpoint to complete the token exchange.
     *
     * @param req - Express request with { code, state } in body
     * @param res - Express response
     */
    private handleExchange;
    /**
     * Gets the system user from cache.
     */
    private getSystemUser;
    /**
     * Loads authorization state from database.
     */
    private loadAuthorizationState;
    /**
     * Loads connection and server OAuth configuration.
     */
    private loadConnectionConfig;
    /**
     * Redirects to success page with state info.
     * If a frontend return URL is provided, redirects there instead of the default success page.
     */
    private redirectToSuccess;
    /**
     * Redirects to error page with error info.
     * If a frontend return URL is provided, redirects there instead of the default error page.
     */
    private redirectToError;
    /**
     * Gets the router for unauthenticated callback endpoint.
     */
    getCallbackRouter(): express.Router;
    /**
     * Gets the router for authenticated OAuth endpoints.
     */
    getAuthenticatedRouter(): express.Router;
}
/**
 * Creates and configures the OAuth callback handler.
 *
 * @param options - Handler configuration
 * @returns Object with callback and authenticated routers
 */
export declare function createOAuthCallbackHandler(options: OAuthCallbackHandlerOptions): {
    callbackRouter: express.Router;
    authenticatedRouter: express.Router;
};
//# sourceMappingURL=OAuthCallbackHandler.d.ts.map