import { AccessToken } from './AccessToken.js';
import { IVirtruOIDC } from '../nanotdf/interfaces/OIDCInterface.js';
import { HttpRequest } from './auth.js';
/**
 * Class that provides OIDC functionality to auth providers.
 *
 * Note that this class itself is not a provider - providers implement
 * `AuthProvider` and make use of this class.
 *
 * Both browser and non-browser flows use OIDC, but the supported OIDC auth
 * mechanisms differ between  public (e.g. browser) clients, and confidential
 * (e.g. Node) clients.
 *
 * The non-browser flow just expects a `clientId` and `clientSecret` to be
 * provided in the `clientConfig`, and will use that
 * to grant tokens via the OIDC `clientCredentials` flow.
 *
 * For either kind of client, the client's public key must be set in all OIDC
 * token requests in order to recieve a token with valid TDF claims. The public
 * key may be passed to this provider's constructor, or supplied
 * post-construction by calling @see updateClientPublicKey, which forces an
 * explicit token refresh
 */
export default class VirtruOIDC {
    readonly accessTokenGetter: AccessToken;
    currentAccessToken?: string;
    /**
     * If clientId and clientSecret are provided, clientCredentials mode will be assumed.
     *
     * If clientId and clientSecret are not provided, browser mode will be assumed, and @see refreshTokenWithVirtruClaims must be
     * manually called during object initialization to do a token exchange.
     */
    constructor({ clientId, clientSecret, oidcOrigin }: IVirtruOIDC);
    /**
     * This function should be called if the consumer of this auth provider changes the client keypair,
     * or wishes to set the keypair after creating the object.
     *
     * Calling this function will trigger a forcible token refresh using the cached refresh token, and contact the auth server.
     */
    refreshTokenClaimsWithClientPubkeyIfNeeded(clientPubKey: string, signingKey?: CryptoKeyPair): Promise<void>;
    getCurrentAccessToken(): Promise<string>;
    /**
     * This function checks to see if we need to perform the one-time operation of exchanging a valid OIDC token
     * that lacks Virtru claims (because it hasn't been associated with a client pubkey yet) for
     *
     */
    exchangeExternalRefreshToken(externalRefreshToken: string): Promise<string>;
    /**
     * This function checks to see if we need to perform the one-time operation of exchanging a valid OIDC token
     * that lacks Virtru claims (because it hasn't been associated with a client pubkey yet) for
     *
     */
    exchangeExternalJwt(externalJwt: string): Promise<string>;
    withCreds(httpReq: HttpRequest): Promise<HttpRequest>;
}
//# sourceMappingURL=virtru-oidc.d.ts.map