import { DiscoveryService, LoggerService } from '@backstage/backend-plugin-api';
import { HumanDuration } from '@backstage/types';
import { PluginKeySource } from './keys/types';
type Options = {
    ownPluginId: string;
    keyDuration: HumanDuration;
    keySource: PluginKeySource;
    discovery: DiscoveryService;
    logger: LoggerService;
    /**
     * JWS "alg" (Algorithm) Header Parameter value. Defaults to ES256.
     * Must match one of the algorithms defined for IdentityClient.
     * When setting a different algorithm, check if the `key` field
     * of the `signing_keys` table can fit the length of the generated keys.
     * If not, add a knex migration file in the migrations folder.
     * More info on supported algorithms: https://github.com/panva/jose
     */
    algorithm?: string;
};
/**
 * @public
 * Issues and verifies {@link https://backstage.iceio/docs/auth/service-to-service-auth | service-to-service tokens}.
 */
export interface PluginTokenHandler {
    verifyToken(token: string): Promise<{
        subject: string;
        limitedUserToken?: string;
    } | undefined>;
    issueToken(options: {
        pluginId: string;
        targetPluginId: string;
        onBehalfOf?: {
            limitedUserToken: string;
            expiresAt: Date;
        };
    }): Promise<{
        token: string;
    }>;
}
export declare class DefaultPluginTokenHandler implements PluginTokenHandler {
    private readonly logger;
    private readonly ownPluginId;
    private readonly keySource;
    private readonly algorithm;
    private readonly keyDurationSeconds;
    private readonly discovery;
    private jwksMap;
    private supportedTargetPlugins;
    private targetPluginInflightChecks;
    static create(options: Options): DefaultPluginTokenHandler;
    private constructor();
    verifyToken(token: string): Promise<{
        subject: string;
        limitedUserToken?: string;
    } | undefined>;
    issueToken(options: {
        pluginId: string;
        targetPluginId: string;
        onBehalfOf?: {
            limitedUserToken: string;
            expiresAt: Date;
        };
    }): Promise<{
        token: string;
    }>;
    private isTargetPluginSupported;
    private getJwksClient;
}
export {};
