import type { Request, Response } from 'express';
import type { OAuthRegisteredClientsStore } from '@modelcontextprotocol/sdk/server/auth/clients.js';
import type { AuthorizationParams, OAuthServerProvider } from '@modelcontextprotocol/sdk/server/auth/provider.js';
import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
import { type Db } from '@znet/catalog-db';
import type { Logger } from '@znet/shared';
import type { MagentoApi } from '@znet/magento';
import { LoginThrottle } from './throttle.js';
import { type UserScopes } from './user-scopes.js';
export interface MagentoAuthOptions {
    db: Db;
    magento: MagentoApi;
    log: Logger;
    /** HMAC key for the signed login request carried through the form. */
    secret: string;
    userScopes: UserScopes;
    require2fa: boolean;
    resource: URL;
    accessTtlSeconds: number;
    refreshTtlSeconds: number;
    storeName: string;
}
/**
 * OAuth 2.1 authorization server where staff sign in with their **Magento admin** username,
 * password and 2FA code. Magento is the source of truth for who is a staff member; this server
 * only issues its own short-lived MCP tokens. Passwords are never stored or logged.
 *
 * Flow: ChatGPT registers (DCR) → /authorize renders our login page → POST /login checks the
 * credentials against Magento → redirect with a one-time code → /token exchanges it (PKCE).
 */
export declare class MagentoAdminAuthProvider implements OAuthServerProvider {
    private readonly o;
    readonly throttle: LoginThrottle;
    constructor(o: MagentoAuthOptions);
    get clientsStore(): OAuthRegisteredClientsStore;
    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
    /** POST /login — check credentials against Magento and redirect back with a code. */
    handleLogin(req: Request, res: Response): Promise<void>;
    challengeForAuthorizationCode(client: OAuthClientInformationFull, code: string): Promise<string>;
    exchangeAuthorizationCode(client: OAuthClientInformationFull, code: string, _verifier?: string, redirectUri?: string): Promise<OAuthTokens>;
    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[]): Promise<OAuthTokens>;
    verifyAccessToken(token: string): Promise<AuthInfo>;
    revokeToken(_client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
    private issueTokens;
    private sendLoginPage;
    /** The pending request travels through the form as an HMAC-signed blob — no server-side session. */
    private sign;
    private verify;
}
//# sourceMappingURL=provider.d.ts.map