import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
import { LoggerService, DiscoveryService } from '@backstage/backend-plugin-api';
import { EntityFilterQuery } from '@backstage/catalog-client';
import { Entity } from '@backstage/catalog-model';
import { Config } from '@backstage/config';
import { JsonValue, JsonObject } from '@backstage/types';
import express, { Request, Response } from 'express';
import { BackstageSignInResult as BackstageSignInResult$1, BackstageIdentityResponse as BackstageIdentityResponse$1 } from '@backstage/plugin-auth-node';
import { Profile, Strategy } from 'passport';
import { ZodSchema, ZodTypeDef } from 'zod';

/**
 * A representation of a successful Backstage sign-in.
 *
 * Compared to the {@link BackstageIdentityResponse} this type omits
 * the decoded identity information embedded in the token.
 *
 * @public
 */
interface BackstageSignInResult {
    /**
     * The token used to authenticate the user within Backstage.
     */
    token: string;
    /**
     * Identity information to pass to the client rather than using the
     * information that's embeeded in the token.
     */
    identity?: BackstageUserIdentity;
}
/**
 * Response object containing the {@link BackstageUserIdentity} and the token
 * from the authentication provider.
 *
 * @public
 */
interface BackstageIdentityResponse extends BackstageSignInResult {
    /**
     * The number of seconds until the token expires. If not set, it can be assumed that the token does not expire.
     */
    expiresInSeconds?: number;
    /**
     * A plaintext description of the identity that is encapsulated within the token.
     */
    identity: BackstageUserIdentity;
}
/**
 * User identity information within Backstage.
 *
 * @public
 */
type BackstageUserIdentity = {
    /**
     * The type of identity that this structure represents. In the frontend app
     * this will currently always be 'user'.
     */
    type: 'user';
    /**
     * The entityRef of the user in the catalog.
     * For example User:default/sandra
     */
    userEntityRef: string;
    /**
     * The user and group entities that the user claims ownership through
     */
    ownershipEntityRefs: string[];
};
/**
 * A query for a single user in the catalog.
 *
 * If `entityRef` is used, the default kind is `'User'`.
 *
 * If `annotations` are used, all annotations must be present and
 * match the provided value exactly. Only entities of kind `'User'` will be considered.
 *
 * If `filter` are used, only entities of kind `'User'` will be considered unless it is explicitly specified differently in the filter.
 *
 * Regardless of the query method, the query must match exactly one entity
 * in the catalog, or an error will be thrown.
 *
 * @public
 */
type AuthResolverCatalogUserQuery = {
    entityRef: string | {
        kind?: string;
        namespace?: string;
        name: string;
    };
} | {
    annotations: Record<string, string>;
} | {
    filter: EntityFilterQuery;
};
/**
 * Parameters used to issue new Backstage Tokens
 *
 * @public
 */
type TokenParams = {
    /**
     * The claims that will be embedded within the token. At a minimum, this should include
     * the subject claim, `sub`. It is common to also list entity ownership relations in the
     * `ent` list. Additional claims may also be added at the developer's discretion except
     * for the following list, which will be overwritten by the TokenIssuer: `iss`, `aud`,
     * `iat`, and `exp`. The Backstage team also maintains the right add new claims in the future
     * without listing the change as a "breaking change".
     */
    claims: {
        /** The token subject, i.e. User ID */
        sub: string;
        /** A list of entity references that the user claims ownership through */
        ent?: string[];
    } & Record<string, JsonValue>;
};
/**
 * The context that is used for auth processing.
 *
 * @public
 */
type AuthResolverContext = {
    /**
     * Issues a Backstage token using the provided parameters.
     */
    issueToken(params: TokenParams): Promise<BackstageSignInResult>;
    /**
     * Finds a single user in the catalog using the provided query.
     *
     * See {@link AuthResolverCatalogUserQuery} for details.
     */
    findCatalogUser(query: AuthResolverCatalogUserQuery): Promise<{
        entity: Entity;
    }>;
    /**
     * Finds a single user in the catalog using the provided query, and then
     * issues an identity for that user using default ownership resolution.
     *
     * If the user is not found, an optional `dangerousEntityRefFallback`
     * entity ref can be provided to allow sign-in to proceed by issuing an
     * identity based on the given ref. This bypasses the requirement for the
     * user to exist in the catalog and should be used with caution.
     *
     * See {@link AuthResolverCatalogUserQuery} for details.
     */
    signInWithCatalogUser(query: AuthResolverCatalogUserQuery, options?: {
        dangerousEntityRefFallback?: {
            entityRef: string | {
                kind?: string;
                namespace?: string;
                name: string;
            };
        };
    }): Promise<BackstageSignInResult>;
    /**
     * Resolves the ownership entity references for the provided entity.
     * This will use the `AuthOwnershipResolver` if one is installed, and otherwise fall back to the default resolution logic.
     */
    resolveOwnershipEntityRefs(entity: Entity): Promise<{
        ownershipEntityRefs: string[];
    }>;
};
/**
 * Resolver interface for resolving the ownership entity references for entity
 *
 * @public
 */
interface AuthOwnershipResolver {
    resolveOwnershipEntityRefs(entity: Entity): Promise<{
        ownershipEntityRefs: string[];
    }>;
}
/**
 * Any Auth provider needs to implement this interface which handles the routes in the
 * auth backend. Any auth API requests from the frontend reaches these methods.
 *
 * The routes in the auth backend API are tied to these methods like below
 *
 * `/auth/[provider]/start -> start`
 * `/auth/[provider]/handler/frame -> frameHandler`
 * `/auth/[provider]/refresh -> refresh`
 * `/auth/[provider]/logout -> logout`
 *
 * @public
 */
interface AuthProviderRouteHandlers {
    /**
     * Handles the start route of the API. This initiates a sign in request with an auth provider.
     *
     * Request
     * - scopes for the auth request (Optional)
     * Response
     * - redirect to the auth provider for the user to sign in or consent.
     * - sets a nonce cookie and also pass the nonce as 'state' query parameter in the redirect request
     */
    start(req: Request, res: Response): Promise<void>;
    /**
     * Once the user signs in or consents in the OAuth screen, the auth provider redirects to the
     * callbackURL which is handled by this method.
     *
     * Request
     * - to contain a nonce cookie and a 'state' query parameter
     * Response
     * - postMessage to the window with a payload that contains accessToken, expiryInSeconds?, idToken? and scope.
     * - sets a refresh token cookie if the auth provider supports refresh tokens
     */
    frameHandler(req: Request, res: Response): Promise<void>;
    /**
     * (Optional) If the auth provider supports refresh tokens then this method handles
     * requests to get a new access token.
     *
     * Other types of providers may also use this method to implement its own logic to create new sessions
     * upon request. For example, this can be used to create a new session for a provider that handles requests
     * from an authenticating proxy.
     *
     * Request
     * - to contain a refresh token cookie and scope (Optional) query parameter.
     * Response
     * - payload with accessToken, expiryInSeconds?, idToken?, scope and user profile information.
     */
    refresh?(req: Request, res: Response): Promise<void>;
    /**
     * (Optional) Handles sign out requests
     *
     * Response
     * - removes the refresh token cookie
     */
    logout?(req: Request, res: Response): Promise<void>;
}
/**
 * @public
 * @deprecated Use top-level properties passed to `AuthProviderFactory` instead
 */
type AuthProviderConfig = {
    /**
     * The protocol://domain[:port] where the app is hosted. This is used to construct the
     * callbackURL to redirect to once the user signs in to the auth provider.
     */
    baseUrl: string;
    /**
     * The base URL of the app as provided by app.baseUrl
     */
    appUrl: string;
    /**
     * A function that is called to check whether an origin is allowed to receive the authentication result.
     */
    isOriginAllowed: (origin: string) => boolean;
    /**
     * The function used to resolve cookie configuration based on the auth provider options.
     */
    cookieConfigurer?: CookieConfigurer;
};
/** @public */
type AuthProviderFactory = (options: {
    providerId: string;
    /** @deprecated Use top-level properties instead */
    globalConfig: AuthProviderConfig;
    config: Config;
    logger: LoggerService;
    resolverContext: AuthResolverContext;
    /**
     * The protocol://domain[:port] where the app is hosted. This is used to construct the
     * callbackURL to redirect to once the user signs in to the auth provider.
     */
    baseUrl: string;
    /**
     * The base URL of the app as provided by app.baseUrl
     */
    appUrl: string;
    /**
     * A function that is called to check whether an origin is allowed to receive the authentication result.
     */
    isOriginAllowed: (origin: string) => boolean;
    /**
     * The function used to resolve cookie configuration based on the auth provider options.
     */
    cookieConfigurer?: CookieConfigurer;
}) => AuthProviderRouteHandlers;
/** @public */
type ClientAuthResponse<TProviderInfo> = {
    providerInfo: TProviderInfo;
    profile: ProfileInfo;
    backstageIdentity?: BackstageIdentityResponse;
};
/**
 * Type of sign in information context. Includes the profile information and
 * authentication result which contains auth related information.
 *
 * @public
 */
type SignInInfo<TAuthResult> = {
    /**
     * The simple profile passed down for use in the frontend.
     */
    profile: ProfileInfo;
    /**
     * The authentication result that was received from the authentication
     * provider.
     */
    result: TAuthResult;
};
/**
 * Describes the function which handles the result of a successful
 * authentication. Must return a valid {@link @backstage/plugin-auth-node#BackstageSignInResult}.
 *
 * @public
 */
type SignInResolver<TAuthResult> = (info: SignInInfo<TAuthResult>, context: AuthResolverContext) => Promise<BackstageSignInResult>;
/**
 * Describes the function that transforms the result of a successful
 * authentication into a {@link ProfileInfo} object.
 *
 * This function may optionally throw an error in order to reject authentication.
 *
 * @public
 */
type ProfileTransform<TResult> = (result: TResult, context: AuthResolverContext) => Promise<{
    profile: ProfileInfo;
}>;
/**
 * Used to display login information to user, i.e. sidebar popup.
 *
 * It is also temporarily used as the profile of the signed-in user's Backstage
 * identity, but we want to replace that with data from identity and/org catalog
 * service
 *
 * @public
 */
type ProfileInfo = {
    /**
     * Email ID of the signed in user.
     */
    email?: string;
    /**
     * Display name that can be presented to the signed in user.
     */
    displayName?: string;
    /**
     * URL to an image that can be used as the display image or avatar of the
     * signed in user.
     */
    picture?: string;
};
/**
 * The callback used to resolve the cookie configuration for auth providers that use cookies.
 * @public
 */
type CookieConfigurer = (ctx: {
    /** ID of the auth provider that this configuration applies to */
    providerId: string;
    /** The externally reachable base URL of the auth-backend plugin */
    baseUrl: string;
    /** The configured callback URL of the auth provider */
    callbackUrl: string;
    /** The origin URL of the app */
    appOrigin: string;
}) => {
    domain: string;
    path: string;
    secure: boolean;
    sameSite?: 'none' | 'lax' | 'strict';
};
/**
 * Core properties of various token types.
 *
 * @public
 */
declare const tokenTypes: Readonly<{
    user: Readonly<{
        typParam: "vnd.backstage.user";
        audClaim: "backstage";
    }>;
    limitedUser: Readonly<{
        typParam: "vnd.backstage.limited-user";
    }>;
    plugin: Readonly<{
        typParam: "vnd.backstage.plugin";
    }>;
}>;

/** @public */
interface AuthProviderRegistrationOptions {
    providerId: string;
    factory: AuthProviderFactory;
}
/** @public */
interface AuthProvidersExtensionPoint {
    registerProvider(options: AuthProviderRegistrationOptions): void;
}
/** @public */
declare const authProvidersExtensionPoint: _backstage_backend_plugin_api.ExtensionPoint<AuthProvidersExtensionPoint>;

/** @public */
interface AuthOwnershipResolutionExtensionPoint {
    setAuthOwnershipResolver(ownershipResolver: AuthOwnershipResolver): void;
}
/** @public */
declare const authOwnershipResolutionExtensionPoint: _backstage_backend_plugin_api.ExtensionPoint<AuthOwnershipResolutionExtensionPoint>;

/**
 * Payload sent as a post message after the auth request is complete.
 * If successful then has a valid payload with Auth information else contains an error.
 *
 * @public
 */
type WebMessageResponse = {
    type: 'authorization_response';
    response: ClientAuthResponse<unknown>;
} | {
    type: 'authorization_response';
    error: Error;
};
/** @public */
declare function sendWebMessageResponse(res: Response, appOrigin: string, response: WebMessageResponse): void;

/**
 * Parses a Backstage-issued token and decorates the
 * {@link @backstage/plugin-auth-node#BackstageIdentityResponse} with identity information sourced from the
 * token.
 *
 * @public
 */
declare function prepareBackstageIdentityResponse(result: BackstageSignInResult$1): BackstageIdentityResponse$1;

/**
 * Parses the given authorization header and returns the bearer token, or
 * undefined if no bearer token is given.
 *
 * @remarks
 *
 * This function is explicitly built to tolerate bad inputs safely, so you may
 * call it directly with e.g. the output of `req.header('authorization')`
 * without first checking that it exists.
 *
 * @deprecated Use the `credentials` method of `HttpAuthService` from `@backstage/backend-plugin-api` instead
 * @public
 */
declare function getBearerTokenFromAuthorizationHeader(authorizationHeader: unknown): string | undefined;

/**
 * Options to request the identity from a Backstage backend request
 *
 * @public
 */
type IdentityApiGetIdentityRequest = {
    request: Request<unknown>;
};
/**
 * An identity client api to authenticate Backstage
 * tokens
 *
 * @experimental This is not a stable API yet
 * @public
 */
interface IdentityApi {
    /**
     * Verifies the given backstage identity token
     * Returns a BackstageIdentity (user) matching the token.
     * The method throws an error if verification fails.
     */
    getIdentity(options: IdentityApiGetIdentityRequest): Promise<BackstageIdentityResponse | undefined>;
}

/**
 * An identity client options object which allows extra configurations
 *
 * @experimental This is not a stable API yet
 * @public
 */
type IdentityClientOptions = {
    discovery: DiscoveryService;
    issuer?: string;
    /** JWS "alg" (Algorithm) Header Parameter values. Defaults to an array containing just ES256.
     * More info on supported algorithms: https://github.com/panva/jose */
    algorithms?: string[];
};
/**
 * An identity client to interact with auth-backend and authenticate Backstage
 * tokens
 *
 * @experimental This is not a stable API yet
 * @public
 */
declare class DefaultIdentityClient implements IdentityApi {
    private readonly discovery;
    private readonly issuer?;
    private readonly algorithms?;
    private keyStore?;
    private keyStoreUpdated;
    /**
     * Create a new {@link DefaultIdentityClient} instance.
     */
    static create(options: IdentityClientOptions): DefaultIdentityClient;
    private constructor();
    getIdentity(options: IdentityApiGetIdentityRequest): Promise<BackstageIdentityResponse | undefined>;
    /**
     * Verifies the given backstage identity token
     * Returns a BackstageIdentity (user) matching the token.
     * The method throws an error if verification fails.
     *
     * @deprecated You should start to use getIdentity instead of authenticate to retrieve the user
     * identity.
     */
    authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
    /**
     * If the last keystore refresh is stale, update the keystore URL to the latest
     */
    private refreshKeyStore;
}

/**
 * An identity client to interact with auth-backend and authenticate Backstage
 * tokens
 *
 * @public
 * @experimental This is not a stable API yet
 * @deprecated Please migrate to the DefaultIdentityClient.
 */
declare class IdentityClient {
    private readonly defaultIdentityClient;
    static create(options: IdentityClientOptions): IdentityClient;
    private constructor();
    /**
     * Verifies the given backstage identity token
     * Returns a BackstageIdentity (user) matching the token.
     * The method throws an error if verification fails.
     *
     * @deprecated You should start to use IdentityApi#getIdentity instead of authenticate
     * to retrieve the user identity.
     */
    authenticate(token: string | undefined): Promise<BackstageIdentityResponse>;
}

/**
 * A type for the serialized value in the `state` parameter of the OAuth authorization flow
 * @public
 */
type OAuthState = {
    nonce: string;
    env: string;
    origin?: string;
    scope?: string;
    redirectUrl?: string;
    flow?: string;
    audience?: string;
};
/** @public */
type OAuthStateTransform = (state: OAuthState, context: {
    req: Request;
}) => Promise<{
    state: OAuthState;
}>;
/** @public */
declare function encodeOAuthState(state: OAuthState): string;
/** @public */
declare function decodeOAuthState(encodedState: string): OAuthState;

/** @public */
interface OAuthSession {
    accessToken: string;
    tokenType: string;
    idToken?: string;
    scope: string;
    expiresInSeconds?: number;
    refreshToken?: string;
    refreshTokenExpiresInSeconds?: number;
}
/** @public */
interface OAuthAuthenticatorScopeOptions {
    persist?: boolean;
    required?: string[];
    transform?: (options: {
        /** Scopes requested by the client */
        requested: Iterable<string>;
        /** Scopes which have already been granted */
        granted: Iterable<string>;
        /** Scopes that are required for the authenticator to function */
        required: Iterable<string>;
        /** Additional scopes added through configuration */
        additional: Iterable<string>;
    }) => Iterable<string>;
}
/** @public */
interface OAuthAuthenticatorStartInput {
    scope: string;
    state: string;
    req: Request;
}
/** @public */
interface OAuthAuthenticatorAuthenticateInput {
    req: Request;
}
/** @public */
interface OAuthAuthenticatorRefreshInput {
    /**
     * Signals whether the requested scope has already been granted for the session. Will only be set if the `scopes.persist` option is enabled.
     */
    scopeAlreadyGranted?: boolean;
    scope: string;
    refreshToken: string;
    req: Request;
}
/** @public */
interface OAuthAuthenticatorLogoutInput {
    accessToken?: string;
    refreshToken?: string;
    req: Request;
}
/** @public */
interface OAuthAuthenticatorResult<TProfile> {
    fullProfile: TProfile;
    session: OAuthSession;
}
/** @public */
interface OAuthAuthenticator<TContext, TProfile> {
    defaultProfileTransform: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
    /** @deprecated use `scopes.persist` instead */
    shouldPersistScopes?: boolean;
    scopes?: OAuthAuthenticatorScopeOptions;
    initialize(ctx: {
        callbackUrl: string;
        config: Config;
    }): TContext;
    start(input: OAuthAuthenticatorStartInput, ctx: TContext): Promise<{
        url: string;
        status?: number;
    }>;
    authenticate(input: OAuthAuthenticatorAuthenticateInput, ctx: TContext): Promise<OAuthAuthenticatorResult<TProfile>>;
    refresh(input: OAuthAuthenticatorRefreshInput, ctx: TContext): Promise<OAuthAuthenticatorResult<TProfile>>;
    logout?(input: OAuthAuthenticatorLogoutInput, ctx: TContext): Promise<void>;
}
/** @public */
declare function createOAuthAuthenticator<TContext, TProfile>(authenticator: OAuthAuthenticator<TContext, TProfile>): OAuthAuthenticator<TContext, TProfile>;

/** @public */
interface OAuthRouteHandlersOptions<TProfile> {
    authenticator: OAuthAuthenticator<any, TProfile>;
    appUrl: string;
    baseUrl: string;
    isOriginAllowed: (origin: string) => boolean;
    providerId: string;
    config: Config;
    resolverContext: AuthResolverContext;
    additionalScopes?: string[];
    stateTransform?: OAuthStateTransform;
    profileTransform?: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
    cookieConfigurer?: CookieConfigurer;
    signInResolver?: SignInResolver<OAuthAuthenticatorResult<TProfile>>;
}
/** @public */
declare function createOAuthRouteHandlers<TProfile>(options: OAuthRouteHandlersOptions<TProfile>): AuthProviderRouteHandlers;

/** @public */
type PassportProfile = Profile & {
    avatarUrl?: string;
    email?: string;
    photo?: string;
};
/** @public */
type PassportDoneCallback<TResult, TPrivateInfo = never> = (err?: Error, result?: TResult, privateInfo?: TPrivateInfo) => void;

/** @public */
declare class PassportHelpers {
    private constructor();
    static transformProfile: (profile: PassportProfile, idToken?: string) => ProfileInfo;
    static executeRedirectStrategy(req: Request, providerStrategy: Strategy, options: Record<string, string>): Promise<{
        /**
         * URL to redirect to
         */
        url: string;
        /**
         * Status code to use for the redirect
         */
        status?: number;
    }>;
    static executeFrameHandlerStrategy<TResult, TPrivateInfo = never>(req: Request, providerStrategy: Strategy, options?: Record<string, string>): Promise<{
        result: TResult;
        privateInfo: TPrivateInfo;
    }>;
    static executeRefreshTokenStrategy(providerStrategy: Strategy, refreshToken: string, scope: string): Promise<{
        /**
         * An access token issued for the signed in user.
         */
        accessToken: string;
        /**
         * Optionally, the server can issue a new Refresh Token for the user
         */
        refreshToken?: string;
        params: any;
    }>;
    static executeFetchUserProfileStrategy(providerStrategy: Strategy, accessToken: string): Promise<PassportProfile>;
}

/** @public */
type PassportOAuthResult = {
    fullProfile: PassportProfile;
    params: {
        id_token?: string;
        scope: string;
        token_type?: string;
        expires_in: number;
    };
    accessToken: string;
};
/** @public */
type PassportOAuthPrivateInfo = {
    refreshToken?: string;
};
/** @public */
type PassportOAuthDoneCallback = PassportDoneCallback<PassportOAuthResult, PassportOAuthPrivateInfo>;
/** @public */
declare class PassportOAuthAuthenticatorHelper {
    #private;
    static defaultProfileTransform: ProfileTransform<OAuthAuthenticatorResult<PassportProfile>>;
    static from(strategy: Strategy): PassportOAuthAuthenticatorHelper;
    private constructor();
    start(input: OAuthAuthenticatorStartInput, options: Record<string, string>): Promise<{
        url: string;
        status?: number;
    }>;
    authenticate(input: OAuthAuthenticatorAuthenticateInput, options?: Record<string, string>): Promise<OAuthAuthenticatorResult<PassportProfile>>;
    refresh(input: OAuthAuthenticatorRefreshInput): Promise<OAuthAuthenticatorResult<PassportProfile>>;
    fetchProfile(accessToken: string): Promise<PassportProfile>;
}

/** @public */
declare class OAuthEnvironmentHandler implements AuthProviderRouteHandlers {
    private readonly handlers;
    static mapConfig(config: Config, factoryFunc: (envConfig: Config) => AuthProviderRouteHandlers): OAuthEnvironmentHandler;
    constructor(handlers: Map<string, AuthProviderRouteHandlers>);
    start(req: express.Request, res: express.Response): Promise<void>;
    frameHandler(req: express.Request, res: express.Response): Promise<void>;
    refresh(req: express.Request, res: express.Response): Promise<void>;
    logout(req: express.Request, res: express.Response): Promise<void>;
    private getEnvFromRequest;
    private getProviderForEnv;
}

/** @public */
interface SignInResolverFactory<TAuthResult = any, TOptions = any> {
    (...options: undefined extends TOptions ? [options?: TOptions] : [options: TOptions]): SignInResolver<TAuthResult>;
    optionsJsonSchema?: JsonObject;
}
/** @public */
interface SignInResolverFactoryOptions<TAuthResult, TOptionsOutput, TOptionsInput> {
    optionsSchema?: ZodSchema<TOptionsOutput, ZodTypeDef, TOptionsInput>;
    create(options: TOptionsOutput): SignInResolver<TAuthResult>;
}
/** @public */
declare function createSignInResolverFactory<TAuthResult, TOptionsOutput, TOptionsInput>(options: SignInResolverFactoryOptions<TAuthResult, TOptionsOutput, TOptionsInput>): SignInResolverFactory<TAuthResult, TOptionsInput>;

/** @public */
declare function createOAuthProviderFactory<TProfile>(options: {
    authenticator: OAuthAuthenticator<unknown, TProfile>;
    additionalScopes?: string[];
    stateTransform?: OAuthStateTransform;
    profileTransform?: ProfileTransform<OAuthAuthenticatorResult<TProfile>>;
    signInResolver?: SignInResolver<OAuthAuthenticatorResult<TProfile>>;
    signInResolverFactories?: {
        [name in string]: SignInResolverFactory;
    };
}): AuthProviderFactory;

/** @public */
interface ProxyAuthenticator<TContext, TResult, TProviderInfo = undefined> {
    defaultProfileTransform: ProfileTransform<TResult>;
    initialize(ctx: {
        config: Config;
    }): TContext;
    authenticate(options: {
        req: Request;
    }, ctx: TContext): Promise<{
        result: TResult;
        providerInfo?: TProviderInfo;
    }>;
}
/** @public */
declare function createProxyAuthenticator<TContext, TResult, TProviderInfo>(authenticator: ProxyAuthenticator<TContext, TResult, TProviderInfo>): ProxyAuthenticator<TContext, TResult, TProviderInfo>;

/** @public */
interface ReadDeclarativeSignInResolverOptions<TAuthResult> {
    config: Config;
    signInResolverFactories: {
        [name in string]: SignInResolverFactory<TAuthResult, unknown>;
    };
}
/** @public */
declare function readDeclarativeSignInResolver<TAuthResult>(options: ReadDeclarativeSignInResolverOptions<TAuthResult>): SignInResolver<TAuthResult> | undefined;

/**
 * A collection of common sign-in resolvers that work with any auth provider.
 *
 * @public
 */
declare namespace commonSignInResolvers {
    /**
     * A common sign-in resolver that looks up the user using their email address
     * as email of the entity.
     */
    const emailMatchingUserEntityProfileEmail: SignInResolverFactory<unknown, {
        allowedDomains?: string[] | undefined;
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
    /**
     * A common sign-in resolver that looks up the user using the local part of
     * their email address as the entity name.
     */
    const emailLocalPartMatchingUserEntityName: SignInResolverFactory<unknown, {
        allowedDomains?: string[] | undefined;
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
}

/** @public */
declare function createProxyAuthProviderFactory<TResult>(options: {
    authenticator: ProxyAuthenticator<unknown, TResult, unknown>;
    profileTransform?: ProfileTransform<TResult>;
    signInResolver?: SignInResolver<TResult>;
    signInResolverFactories?: Record<string, SignInResolverFactory>;
}): AuthProviderFactory;

/** @public */
interface ProxyAuthRouteHandlersOptions<TResult> {
    authenticator: ProxyAuthenticator<any, TResult, unknown>;
    config: Config;
    resolverContext: AuthResolverContext;
    signInResolver: SignInResolver<TResult>;
    profileTransform?: ProfileTransform<TResult>;
}
/** @public */
declare function createProxyAuthRouteHandlers<TResult>(options: ProxyAuthRouteHandlersOptions<TResult>): AuthProviderRouteHandlers;

export { type AuthOwnershipResolutionExtensionPoint, type AuthOwnershipResolver, type AuthProviderConfig, type AuthProviderFactory, type AuthProviderRegistrationOptions, type AuthProviderRouteHandlers, type AuthProvidersExtensionPoint, type AuthResolverCatalogUserQuery, type AuthResolverContext, type BackstageIdentityResponse, type BackstageSignInResult, type BackstageUserIdentity, type ClientAuthResponse, type CookieConfigurer, DefaultIdentityClient, type IdentityApi, type IdentityApiGetIdentityRequest, IdentityClient, type IdentityClientOptions, type OAuthAuthenticator, type OAuthAuthenticatorAuthenticateInput, type OAuthAuthenticatorLogoutInput, type OAuthAuthenticatorRefreshInput, type OAuthAuthenticatorResult, type OAuthAuthenticatorScopeOptions, type OAuthAuthenticatorStartInput, OAuthEnvironmentHandler, type OAuthRouteHandlersOptions, type OAuthSession, type OAuthState, type OAuthStateTransform, type PassportDoneCallback, PassportHelpers, PassportOAuthAuthenticatorHelper, type PassportOAuthDoneCallback, type PassportOAuthPrivateInfo, type PassportOAuthResult, type PassportProfile, type ProfileInfo, type ProfileTransform, type ProxyAuthRouteHandlersOptions, type ProxyAuthenticator, type ReadDeclarativeSignInResolverOptions, type SignInInfo, type SignInResolver, type SignInResolverFactory, type SignInResolverFactoryOptions, type TokenParams, type WebMessageResponse, authOwnershipResolutionExtensionPoint, authProvidersExtensionPoint, commonSignInResolvers, createOAuthAuthenticator, createOAuthProviderFactory, createOAuthRouteHandlers, createProxyAuthProviderFactory, createProxyAuthRouteHandlers, createProxyAuthenticator, createSignInResolverFactory, decodeOAuthState, encodeOAuthState, getBearerTokenFromAuthorizationHeader, prepareBackstageIdentityResponse, readDeclarativeSignInResolver, sendWebMessageResponse, tokenTypes };
