import { AuthorizationResponseType, AuthParams, LoginSession, RefreshToken, User, TokenResponse } from "@authhero/adapter-interfaces";
import { EnrichedClient } from "../helpers/client";
import { Context } from "hono";
import { Bindings, Variables } from "../types";
import { GrantType } from "@authhero/adapter-interfaces";
/**
 * Minimal client properties actually used by createAuthTokens.
 * This avoids requiring a full EnrichedClient when only a few fields are needed
 * (e.g. service tokens).
 */
export interface AuthTokenClient {
    client_id: string;
    tenant: {
        audience: string;
        default_audience?: string;
        allow_organization_name_in_authentication_api?: boolean;
    };
    auth0_conformant?: boolean;
}
export interface CreateAuthTokensParams {
    authParams: AuthParams;
    client: AuthTokenClient;
    loginSession?: LoginSession;
    user?: User;
    session_id?: string;
    refresh_token?: string;
    authStrategy?: {
        strategy: string;
        strategy_type: string;
    };
    /** The connection name used for authentication (e.g., "email", "google-oauth2") */
    authConnection?: string;
    ticketAuth?: boolean;
    skipHooks?: boolean;
    organization?: {
        id: string;
        name: string;
    };
    permissions?: string[];
    grantType?: GrantType;
    impersonatingUser?: User;
    auth_time?: number;
    /** Custom claims to add to the access token payload (cannot override reserved claims) */
    customClaims?: Record<string, unknown>;
    /** Access token lifetime in seconds, from resource server config */
    token_lifetime?: number;
    /**
     * Authorization code co-issued in the same front-channel response (hybrid
     * flow). When provided AND an id_token is being issued, a `c_hash` claim
     * covering this code is added to the id_token per OIDC Core 3.3.2.11.
     */
    code?: string;
}
export declare function createAuthTokens(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: CreateAuthTokensParams): Promise<TokenResponse>;
export interface CreateCodeParams {
    user: User;
    client: EnrichedClient;
    authParams: AuthParams;
    login_id: string;
}
export declare function createCodeData(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: CreateCodeParams): Promise<{
    code: string;
    state: string | undefined;
}>;
export interface CreateRefreshTokenParams {
    user: User;
    client: EnrichedClient;
    login_id: string;
    scope: string;
    audience?: string;
}
export interface CreatedRefreshToken {
    row: RefreshToken;
    wireToken: string;
}
export declare function createRefreshToken(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: CreateRefreshTokenParams): Promise<CreatedRefreshToken>;
export interface CreateSessionParams {
    user: User;
    client: EnrichedClient;
    loginSession: LoginSession;
}
export interface AuthenticateLoginSessionParams {
    user: User;
    client: EnrichedClient;
    loginSession: LoginSession;
    /** Optional existing session to reuse instead of creating a new one */
    existingSessionId?: string;
    /** The connection name used for authentication (e.g., "email", "google-oauth2") */
    authConnection?: string;
}
/**
 * Authenticate a login session - transitions from PENDING to AUTHENTICATED
 *
 * This is the single source of truth for authentication state transitions.
 * It either creates a new session or links an existing one, and always
 * transitions the state to AUTHENTICATED.
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 * and guards against terminal states (FAILED, EXPIRED, COMPLETED)
 *
 * @returns The session ID (either newly created or existing)
 */
export declare function authenticateLoginSession(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, { user, client, loginSession, existingSessionId, authConnection, }: AuthenticateLoginSessionParams): Promise<string>;
export interface FinalizeAuthenticatedSessionParams extends AuthenticateLoginSessionParams {
    /** Strategy metadata persisted so /authorize/resume can rehydrate it */
    authStrategy?: {
        strategy: string;
        strategy_type: string;
    };
}
/**
 * Persist an authenticated identity onto the login session and 302 the browser
 * to `/authorize/resume?state=…`. This is the terminal step for sub-flows
 * (social callback, UL password/OTP/signup, SAML SP-ACS, etc.) — instead of
 * issuing tokens and setting the session cookie inline, they persist enough
 * state for the resume endpoint to do it on the correct domain.
 *
 * Mirrors Auth0's pattern where /u/login/{password,…} 302s to /authorize/resume.
 */
export declare function finalizeAuthenticatedSession(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: FinalizeAuthenticatedSessionParams): Promise<Response>;
/**
 * @deprecated Use authenticateLoginSession instead.
 * This function is kept for backward compatibility but will be removed.
 */
export declare function createSession(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, { user, client, loginSession }: CreateSessionParams): Promise<{
    id: string;
}>;
/**
 * Mark a login session as failed
 * This should be called when authentication fails (wrong password, blocked user, etc.)
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function failLoginSession(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession, reason: string): Promise<void>;
/**
 * Mark a login session as awaiting hook completion
 * This should be called when redirecting to a form, page, or external URL
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function startLoginSessionHook(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession, hookId?: string): Promise<void>;
/**
 * Mark a login session as returning from a hook
 * This should be called when the user returns via /u/continue after a form/page redirect
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function completeLoginSessionHook(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession): Promise<void>;
/**
 * Mark a login session as completed (tokens issued)
 * This should be called when tokens are successfully returned to the client
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function completeLoginSession(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession, auth_connection?: string): Promise<void>;
/**
 * Start a continuation - user is redirected to an account page (change-email, etc.)
 * This transitions to AWAITING_CONTINUATION and stores the allowed scope and return URL
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function startLoginSessionContinuation(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession, scope: string[], returnUrl: string): Promise<void>;
/**
 * Complete a continuation - user finished the account page action
 * This transitions back to AUTHENTICATED so the login flow can continue
 *
 * Uses optimistic concurrency: re-fetches current state to prevent stale overwrites
 */
export declare function completeLoginSessionContinuation(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, tenantId: string, loginSession: LoginSession): Promise<string | undefined>;
/**
 * Check if a login session allows access to a given scope during continuation
 */
export declare function hasValidContinuationScope(loginSession: LoginSession, requiredScope: string): boolean;
export interface CreateAuthResponseParams {
    authParams: AuthParams;
    client: EnrichedClient;
    user: User;
    loginSession?: LoginSession;
    /**
     * An existing session ID to link to the login session instead of creating a new one.
     * Use this when the user already has a valid session (e.g., from a cookie) that should be reused.
     *
     * If not provided and loginSession is in PENDING state, a new session will be created.
     * If provided, this session will be linked and the state will transition to AUTHENTICATED.
     */
    existingSessionIdToLink?: string;
    refreshToken?: string;
    ticketAuth?: boolean;
    authStrategy?: {
        strategy: string;
        strategy_type: string;
    };
    /** The connection name used for authentication (e.g., "email", "google-oauth2") */
    authConnection?: string;
    skipHooks?: boolean;
    organization?: {
        id: string;
        name: string;
    };
    impersonatingUser?: User;
}
export declare function createFrontChannelAuthResponse(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: CreateAuthResponseParams): Promise<Response>;
export declare function completeLogin(ctx: Context<{
    Bindings: Bindings;
    Variables: Variables;
}>, params: Omit<CreateAuthTokensParams, "client"> & {
    client: EnrichedClient;
    responseType?: AuthorizationResponseType;
}): Promise<TokenResponse | {
    code: string;
    state?: string;
} | (TokenResponse & {
    code: string;
}) | Response>;
