import { SignJWT } from 'jose';
/**
 * Generic HTTP request interface used by AuthProvider implementers.
 */
export class HttpRequest {
    constructor() {
        this.headers = {};
        this.params = {};
        this.method = 'POST';
        this.url = '';
    }
}
/**
 * Appends the given `newHeaders` to the headers listed in HttpRequest, overwriting
 * any with the same name. NOTE: Case sensitive.
 * @param httpReq the source request
 * @param newHeaders header name/value pairs
 * @returns an updated variant of the request
 */
export function withHeaders(httpReq, newHeaders) {
    const headers = {
        ...httpReq.headers,
        ...newHeaders,
    };
    return { ...httpReq, headers };
}
/**
 * Generate a JWT (or JWS-ed object)
 * @param toSign the data to sign. Interpreted as JWTPayload but AFAIK this isn't required
 * @param privateKey an RSA key
 * @returns the signed object, with a JWS header. This may be a JWT.
 */
export async function reqSignature(toSign, privateKey) {
    return new SignJWT(toSign)
        .setProtectedHeader({ alg: 'RS256' })
        .setIssuedAt()
        .setExpirationTime('2h')
        .sign(privateKey);
}
/**
 * A utility type for getting and updating a bearer token to associate with
 * HTTP requests to the backend services, notably rewrap and upsert endpoints.
 *
 * In the TDF protocol, this bearer token will be a wrapper around a signed
 * ephemeral key, to be included in
 * [the claims object](https://github.com/opentdf/spec/blob/main/schema/ClaimsObject.md).
 */
export class AuthProvider {
}
/**
 * An AuthProvider encapsulates all logic necessary to authenticate to a backend service, in the
 * vein of <a href="https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/Credentials.html">AWS.Credentials</a>.
 * <br/><br/>
 * The client will call into its configured AuthProvider to decorate remote TDF service calls with necessary
 * authentication info. This approach allows the client to be agnostic to the auth scheme, allowing for
 * methods like identify federation and custom service credentials to be used and changed at the developer's will.
 * <br/><br/>
 * This class is not intended to be used on its own. See the documented subclasses for public-facing implementations.
 * <ul>
 * <li><a href="EmailCodeAuthProvider.html">EmailCodeAuthProvider</li>
 * <li><a href="GoogleAuthProvider.html">GoogleAuthProvider</li>
 * <li><a href="O365AuthProvider.html">O365AuthProvider</li>
 * <li><a href="OutlookAuthProvider.html">OutlookAuthProvider</li>
 * <li><a href="VirtruCredentialsAuthProvider.html">VirtruCredentialsAuthProvider</li>
 * </ul>
 */
export class AppIdAuthProvider {
}
export default AppIdAuthProvider;
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hdXRoL2F1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFjLE9BQU8sRUFBRSxNQUFNLE1BQU0sQ0FBQztBQWEzQzs7R0FFRztBQUNILE1BQU0sT0FBTyxXQUFXO0lBV3RCO1FBQ0UsSUFBSSxDQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7UUFDbEIsSUFBSSxDQUFDLE1BQU0sR0FBRyxFQUFFLENBQUM7UUFDakIsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLEdBQUcsR0FBRyxFQUFFLENBQUM7SUFDaEIsQ0FBQztDQUNGO0FBRUQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxVQUFVLFdBQVcsQ0FBQyxPQUFvQixFQUFFLFVBQWtDO0lBQ2xGLE1BQU0sT0FBTyxHQUFHO1FBQ2QsR0FBRyxPQUFPLENBQUMsT0FBTztRQUNsQixHQUFHLFVBQVU7S0FDZCxDQUFDO0lBQ0YsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQ2pDLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsWUFBWSxDQUFDLE1BQWUsRUFBRSxVQUFxQjtJQUN2RSxPQUFPLElBQUksT0FBTyxDQUFDLE1BQW9CLENBQUM7U0FDckMsa0JBQWtCLENBQUMsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUM7U0FDcEMsV0FBVyxFQUFFO1NBQ2IsaUJBQWlCLENBQUMsSUFBSSxDQUFDO1NBQ3ZCLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUN0QixDQUFDO0FBRUQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sT0FBZ0IsWUFBWTtDQXNCakM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUNILE1BQU0sT0FBZ0IsaUJBQWlCO0NBU3RDO0FBRUQsZUFBZSxpQkFBaUIsQ0FBQyJ9