import { AuthTypes, HttpTypes } from "@medusajs/types";
import { Client } from "../client.js";
import { ClientHeaders, Config } from "../types.js";
/**
 * Redirect response returned when an authentication provider requires the user
 * to continue authentication on another page.
 */
export type AuthRedirectResponse = {
    /**
     * The URL to redirect the user to.
     */
    location: string;
};
/**
 * Response returned when authentication succeeds but must be completed with
 * a multi-factor authentication (MFA) challenge before issuing a token.
 */
export type AuthMfaRequiredResponse = {
    /**
     * A token without an actor type (permissions) attached to it. Used to request and confirm verifications.
     */
    token: string;
    /**
     * Indicates that the client must complete the returned MFA challenge.
     */
    mfa_required: true;
    /**
     * The MFA challenge to complete.
     */
    mfa_challenge: AuthTypes.AuthMfaChallengeDTO;
};
/**
 * Response returned when authentication succeeds but must be completed with
 * verification before issuing a token.
 *
 * @since 2.15.5
 */
export type AuthVerificationRequiredResponse = {
    /**
     * A token without an actor type (permissions) attached to it. Used to request and confirm verifications.
     */
    token: string;
    /**
     * Indicates that the client must complete verification.
     */
    verification_required: true;
    /**
     * The verification state to show to the caller.
     */
    verification?: AuthTypes.AuthVerificationDTO;
};
/**
 * Response returned from a registration attempt.
 *
 * @since 2.15.5
 */
export type AuthRegisterResponse = string;
/**
 * Response returned from an authentication attempt.
 */
export type AuthLoginResponse = string | AuthRedirectResponse | AuthMfaRequiredResponse | AuthVerificationRequiredResponse;
/**
 * Response returned from an authentication callback.
 */
export type AuthCallbackResponse = string | AuthMfaRequiredResponse | AuthVerificationRequiredResponse;
/**
 * Response returned from a token refresh attempt.
 */
export type AuthRefreshResponse = {
    token: string;
} | AuthMfaRequiredResponse | AuthVerificationRequiredResponse;
/**
 * Response containing the authenticated identity's MFA factors.
 */
export type AuthMfaListResponse = {
    /**
     * The MFA factors configured for the authenticated identity.
     */
    mfa_factors: AuthTypes.AuthMfaDTO[];
};
/**
 * Response returned when starting MFA setup.
 */
export type AuthMfaSetupResponse = {
    /**
     * The pending MFA factor.
     */
    mfa_factor: AuthTypes.AuthMfaDTO;
    /**
     * The setup secret. For TOTP, this can be entered manually in an
     * authenticator app.
     */
    secret?: string;
    /**
     * The setup URI. For TOTP, this can be rendered as a QR code.
     */
    otpauth_url?: string;
};
/**
 * Response containing a single MFA factor.
 */
export type AuthMfaFactorResponse = {
    /**
     * The MFA factor.
     */
    mfa_factor: AuthTypes.AuthMfaDTO;
};
/**
 * Response containing newly generated MFA recovery codes.
 */
export type AuthMfaRecoveryCodesResponse = {
    /**
     * The recovery codes. These are only returned once and should be stored by
     * the user.
     */
    recovery_codes: string[];
};
/**
 * Payload used to start MFA setup.
 */
export type AuthMfaStartPayload = {
    /**
     * The MFA provider to set up.
     */
    provider: AuthTypes.AuthMfaProviderMethod;
    /**
     * Optional label for the MFA factor.
     */
    label?: string | null;
    /**
     * Optional issuer name. For TOTP, authenticator apps show this as the
     * service name.
     */
    issuer?: string;
    /**
     * Optional metadata to store with the MFA factor.
     */
    metadata?: Record<string, unknown> | null;
};
/**
 * Payload used to verify a pending MFA setup.
 */
export type AuthMfaVerifyPayload = {
    /**
     * The verification code from the MFA provider.
     */
    code: string;
};
/**
 * Payload used to disable an MFA factor.
 */
export type AuthMfaDisablePayload = {
    /**
     * Optional challenge method used to authorize disabling MFA when configured.
     */
    method?: AuthTypes.AuthMfaChallengeMethod;
    /**
     * Optional verification code for the selected challenge method.
     */
    code?: string;
};
/**
 * Payload used to generate recovery codes.
 */
export type AuthMfaGenerateRecoveryCodesPayload = {
    /**
     * Number of recovery codes to generate.
     */
    count?: number;
};
/**
 * Payload used to verify an MFA challenge.
 */
export type AuthMfaVerifyChallengePayload = {
    /**
     * The MFA challenge method used for verification.
     */
    method: AuthTypes.AuthMfaChallengeMethod;
    /**
     * The verification code for the selected challenge method.
     */
    code: string;
};
/**
 * Payload used to request a verification token.
 *
 * @since 2.15.5
 */
export type AuthVerificationRequestPayload = {
    /**
     * The provider identity to verify.
     */
    entity_id: string;
    /**
     * The kind of entity being verified, such as `email` or `phone_number`.
     */
    entity_type: string;
    /**
     * The verification provider to use. Defaults to `token`.
     */
    code_provider?: string;
    /**
     * Optional metadata to include in the verification request event.
     */
    metadata?: Record<string, unknown>;
};
/**
 * Payload used to confirm a verification code.
 *
 * @since 2.15.5
 */
export type AuthVerificationConfirmPayload = {
    /**
     * The verification code delivered to the user, such as an OTP or pseudorandom token.
     */
    code: string;
    /**
     * The verification provider to use. Defaults to `token`.
     */
    code_provider?: string;
};
/**
 * Response returned after requesting a verification token.
 *
 * @since 2.15.5
 */
export type AuthVerificationRequestResponse = {
    /**
     * The verification state.
     */
    verification: AuthTypes.AuthVerificationDTO;
};
/**
 * Response returned after confirming verification.
 *
 * @since 2.15.5
 */
export type AuthVerificationConfirmResponse = {
    /**
     * The verified entity identifier.
     */
    entity_id: string;
    /**
     * The kind of entity that was verified.
     */
    entity_type: string;
    /**
     * The verification provider that confirmed the verification.
     */
    code_provider: string;
    /**
     * When the verification was confirmed.
     */
    verified_at: Date | string;
};
/**
 * This class provides methods for authentication operations including login, registration, logout, and MFA management.
 */
export declare class Auth {
    private client;
    private config;
    constructor(client: Client, config: Config);
    /**
     * Methods for managing and completing multi-factor authentication (MFA).
     */
    mfa: {
        /**
         * This method retrieves the MFA factors configured for the authenticated
         * identity. It sends a request to the
         * [List MFA Factors](https://docs.medusajs.com/api/admin/multi-factor-authentication/list-mfa-factors)
         * API route.
         *
         * @param headers - Headers to pass in the request.
         * @returns The configured MFA factors.
         *
         * @tags auth
         *
         * @example
         * const { mfa_factors } = await sdk.auth.mfa.list()
         */
        list: (headers?: ClientHeaders) => Promise<AuthMfaListResponse>;
        /**
         * This method starts MFA setup for the authenticated identity. It sends a
         * request to the
         * [Create MFA Factor](https://docs.medusajs.com/api/admin/multi-factor-authentication/start-mfa-factor-enrollment)
         * API route.
         *
         * @param body - The MFA setup details.
         * @param headers - Headers to pass in the request.
         * @returns The pending MFA factor and any setup details returned by the provider.
         *
         * @tags auth
         *
         * @example
         * const setup = await sdk.auth.mfa.start({
         *   provider: "totp",
         *   label: "Authenticator app"
         * })
         *
         * // Render setup.otpauth_url as a QR code or show setup.secret manually.
         */
        start: (body: AuthMfaStartPayload, headers?: ClientHeaders) => Promise<AuthMfaSetupResponse>;
        /**
         * This method verifies a pending MFA factor setup. It sends a request to the
         * [Verify MFA Factor](https://docs.medusajs.com/api/admin/multi-factor-authentication/verify-and-enable-mfa-factor)
         * API route.
         *
         * @param id - The ID of the MFA factor to verify.
         * @param body - The verification details.
         * @param headers - Headers to pass in the request.
         * @returns The verified MFA factor.
         *
         * @tags auth
         *
         * @example
         * const { mfa_factor } = await sdk.auth.mfa.verify("authmfa_123", {
         *   code: "123456"
         * })
         */
        verify: (id: string, body: AuthMfaVerifyPayload, headers?: ClientHeaders) => Promise<AuthMfaFactorResponse>;
        /**
         * This method disables an MFA factor for the authenticated identity. It
         * sends a request to the
         * [Delete MFA Factor](https://docs.medusajs.com/api/admin/auth/disable-mfa-factor)
         * API route.
         *
         * @param id - The ID of the MFA factor to disable.
         * @param body - Optional verification details required by the server configuration.
         * @param headers - Headers to pass in the request.
         * @returns The disabled MFA factor.
         *
         * @tags auth
         *
         * @example
         * const { mfa_factor } = await sdk.auth.mfa.disable("authmfa_123")
         */
        disable: (id: string, body?: AuthMfaDisablePayload, headers?: ClientHeaders) => Promise<AuthMfaFactorResponse>;
        /**
         * This method generates new recovery codes for the authenticated identity.
         * It sends a request to the
         * [Generate MFA Recovery Codes](https://docs.medusajs.com/api/admin/multi-factor-authentication/generate-mfa-recovery-codes)
         * API route.
         *
         * @param body - Optional recovery code generation details.
         * @param headers - Headers to pass in the request.
         * @returns The generated recovery codes.
         *
         * @tags auth
         *
         * @example
         * const { recovery_codes } = await sdk.auth.mfa.generateRecoveryCodes()
         */
        generateRecoveryCodes: (body?: AuthMfaGenerateRecoveryCodesPayload, headers?: ClientHeaders) => Promise<AuthMfaRecoveryCodesResponse>;
        /**
         * This method verifies an MFA challenge returned from `sdk.auth.login` or
         * `sdk.auth.callback`. It sends a request to the
         * [Verify MFA Challenge](https://docs.medusajs.com/api/admin/multi-factor-authentication/verify-mfa-challenge)
         * API route.
         *
         * If verification succeeds, the returned token is stored based on the SDK's
         * auth configuration, matching `sdk.auth.login`.
         *
         * @param id - The ID of the MFA challenge to verify.
         * @param body - The challenge verification details.
         * @param headers - Headers to pass in the request.
         * @returns The authentication JWT token.
         *
         * @tags auth
         *
         * @example
         * const result = await sdk.auth.login("user", "emailpass", {
         *   email: "user@example.com",
         *   password: "secret"
         * })
         *
         * if (typeof result === "object" && "mfa_challenge" in result) {
         *   await sdk.auth.mfa.verifyChallenge(result.mfa_challenge.id, {
         *     method: "totp",
         *     code: "123456"
         *   })
         * }
         */
        verifyChallenge: (id: string, body: AuthMfaVerifyChallengePayload, headers?: ClientHeaders) => Promise<string>;
    };
    /**
     * Methods for requesting and confirming verification.
     *
     * @since 2.15.5
     */
    verification: {
        /**
         * This method requests a verification token for an auth identity.
         *
         * @param body - The verification request details.
         * @param headers - Headers to pass in the request. Must include a bearer token for the auth identity.
         *
         * @tags auth
         */
        request: (body: AuthVerificationRequestPayload, headers?: ClientHeaders) => Promise<AuthVerificationRequestResponse>;
        /**
         * This method confirms a verification code.
         *
         * @param body - The verification code details.
         * @param headers - Headers to pass in the request.
         *
         * @tags auth
         */
        confirm: (body: AuthVerificationConfirmPayload, headers?: ClientHeaders) => Promise<AuthVerificationConfirmResponse>;
    };
    /**
     * This method is used to retrieve a registration JWT token for a user, customer, or custom actor type. It sends a request to the
     * [Retrieve Registration Token API route](https://docs.medusajs.com/api/store/auth/retrieve-registration-jwt-token).
     *
     * Then, it stores the returned token and passes it in the header of subsequent requests. So, you can call the
     * [store.customer.create](https://docs.medusajs.com/resources/references/js-sdk/store/customer#create) method,
     * for example, after calling this method.
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer` for customer.
     * @param method - The authentication provider to use. For example, `emailpass` or `google`.
     * @param payload - The data to pass in the request's body for authentication. When using the `emailpass` provider,
     * you pass the email and password.
     * @param options - Optional behavior for multi-step registration responses.
     * @returns The JWT token used for registration later.
     *
     * @tags auth
     *
     * @example
     * await sdk.auth.register(
     *   "customer",
     *   "emailpass",
     *   {
     *     email: "customer@gmail.com",
     *     password: "supersecret"
     *   }
     * )
     *
     * // all subsequent requests will use the token in the header
     * const { customer } = await sdk.store.customer.create({
     *   email: "customer@gmail.com",
     *   password: "supersecret"
     * })
     */
    register: (actor: string, method: string, payload: HttpTypes.AdminSignUpWithEmailPassword | Record<string, unknown>) => Promise<AuthRegisterResponse>;
    /**
     * This method retrieves the JWT authenticated token for an admin user, customer, or custom
     * actor type. It sends a request to the [Authenticate API Route](https://docs.medusajs.com/api/admin/auth/authenticate-user).
     *
     * ### Third-Party Authentication
     *
     * If the API route returns a `location` property, it means that the authentication requires additional steps,
     * typically in a third-party service. The `location` property is returned so that you
     * can redirect the user to the appropriate page.
     *
     * :::note
     *
     * For an example of implementing third-party authentication, refer to the
     * [Third-Party Login in Storefront](https://docs.medusajs.com/resources/storefront-development/customers/third-party-login) guide.
     *
     * :::
     *
     * ### Session Authentication
     *
     * If the `auth.type` of the SDK is set to `session`, this method will also send a request to the
     * [Set Authentication Session API route](https://docs.medusajs.com/api/admin/auth/set-authentication-session).
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * ### Automatic Authentication
     *
     * If the authentication was successful, subsequent requests using the SDK will automatically have the necessary authentication headers / session
     * set, based on your JS SDK authentication configurations.
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer` for customer.
     * @param method - The authentication provider to use. For example, `emailpass` or `google`.
     * @param payload - The data to pass in the request's body for authentication. When using the `emailpass` provider,
     * you pass the email and password.
     * @returns The authentication JWT token
     *
     * @tags auth
     *
     * @example
     * const result = await sdk.auth.login(
     *   "customer",
     *   "emailpass",
     *   {
     *     email: "customer@gmail.com",
     *     password: "supersecret"
     *   }
     * )
     *
     * if (typeof result !== "string") {
     *   alert("Authentication requires additional steps")
     *   // replace with the redirect logic of your application
     *   window.location.href = result.location
     *   return
     * }
     *
     * // customer is now authenticated
     * // all subsequent requests will use the token in the header
     * const { customer } = await sdk.store.customer.retrieve()
     */
    login: (actor: string, method: string, payload: HttpTypes.AdminSignInWithEmailPassword | Record<string, unknown>) => Promise<AuthLoginResponse>;
    /**
     * This method is used to validate an Oauth callback from a third-party service, such as Google, for an admin user, customer, or custom actor types.
     * It sends a request to the [Validate Authentication Callback](https://docs.medusajs.com/api/admin/auth/validate-authentication-callback).
     *
     * The method stores the returned token and passes it in the header of subsequent requests. So, you can call the
     * [store.customer.create](https://docs.medusajs.com/resources/references/js-sdk/store/customer#create) or {@link refresh} methods,
     * for example, after calling this method.
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer`.
     * @param method - The authentication provider to use. For example, `google`.
     * @param query - The query parameters from the Oauth callback, which should be passed to the API route. This includes query parameters like
     * `code` and `state`.
     * @returns The authentication JWT token
     *
     * @tags auth
     *
     * @example
     * await sdk.auth.callback(
     *   "customer",
     *   "google",
     *   {
     *     code: "123",
     *     state: "456"
     *   }
     * )
     *
     * // all subsequent requests will use the token in the header
     * const { customer } = await sdk.store.customer.create({
     *   email: "customer@gmail.com",
     *   password: "supersecret"
     * })
     *
     * @privateRemarks
     * The callback expects all query parameters from the Oauth callback to be passed to
     * the backend, and the provider is in charge of parsing and validating them
     */
    callback: (actor: string, method: string, query?: Record<string, unknown>) => Promise<AuthCallbackResponse>;
    /**
     * This method refreshes a JWT authentication token, which is useful after validating the Oauth callback
     * with {@link callback}. It sends a request to the [Refresh Authentication Token API route](https://docs.medusajs.com/api/admin/auth/refresh-authentication-token).
     *
     * The method stores the returned token and passes it in the header of subsequent requests. So, you can call other
     * methods that require authentication after calling this method.
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * For an example of implementing third-party authentication, refer to the
     * [Third-Party Login in Storefront](https://docs.medusajs.com/resources/storefront-development/customers/third-party-login) guide.
     *
     * @param headers - Headers to pass in the request
     *
     * @returns The refreshed JWT authentication token, or any requirements such as MFA or verification.
     *
     * @tags auth
     *
     * @example
     * const token = await sdk.auth.refresh()
     *
     * // all subsequent requests will use the token in the header
     * const { customer } = await sdk.store.customer.retrieve()
     */
    refresh: (headers?: ClientHeaders) => Promise<AuthRefreshResponse>;
    /**
     * This method logs out the currently authenticated user based on your JS SDK authentication configurations.
     *
     * If the `auth.type` of the SDK is set to `session`, this method will also send a request to the
     * [Delete Authentication Session API route](https://docs.medusajs.com/api/admin/auth/delete-authentication-session).
     *
     * The method also clears any stored tokens or sessions, based on your JS SDK authentication configurations.
     *
     * Learn more in the [JS SDK Authentication](https://docs.medusajs.com/resources/js-sdk/auth/overview) guide.
     *
     * @tags auth
     *
     * @example
     * await sdk.auth.logout()
     *
     * // user is now logged out
     * // you can't send any requests that require authentication
     */
    logout: () => Promise<void>;
    /**
     * This method requests a reset password token for an admin user, customer, or custom actor type.
     * It sends a request to the [Generate Reset Password Token API route](https://docs.medusajs.com/api/admin/auth/generate-reset-password-token).
     *
     * To reset the password later using the token delivered to the user, use the {@link updateProvider} method.
     *
     * Related guide: [How to allow customers to reset their passwords in a storefront](https://docs.medusajs.com/resources/storefront-development/customers/reset-password).
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer` for customer.
     * @param provider - The authentication provider to use. For example, `emailpass`.
     * @param body - The data required to identify the user.
     *
     * @tags auth
     *
     * @example
     * sdk.auth.resetPassword(
     *   "customer",
     *   "emailpass",
     *   {
     *     identifier: "customer@gmail.com"
     *   }
     * )
     * .then(() => {
     *   // user receives token
     * })
     */
    resetPassword: (actor: string, provider: string, body: {
        /**
         * The user's identifier. For example, when using the `emailpass` provider,
         * this would be the user's email.
         */
        identifier: string;
        /**
         * Optional metadata to include in the reset password request.
         *
         * @since 2.12.4
         */
        metadata?: Record<string, unknown>;
    }) => Promise<void>;
    /**
     * This method is used to update user-related data authentication data.
     *
     * More specifically, use this method when updating the password of an admin user, customer, or
     * custom actor type after requesting to reset their password with {@link resetPassword}.
     *
     * This method sends a request to [this API route](https://docs.medusajs.com/api/admin/auth/reset-password).
     *
     * Related guide: [How to allow customers to reset their passwords in a storefront](https://docs.medusajs.com/resources/storefront-development/customers/reset-password).
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer` for customer.
     * @param provider - The authentication provider to use. For example, `emailpass`.
     * @param body - The data necessary to update the user's authentication data. When resetting the user's password,
     * send the `password` property.
     *
     * @tags auth
     *
     * @example
     * sdk.auth.updateProvider(
     *   "customer",
     *   "emailpass",
     *   {
     *     password: "supersecret"
     *   },
     *   token
     * )
     * .then(() => {
     *   // password updated
     * })
     */
    updateProvider: (actor: string, provider: string, body: HttpTypes.AdminUpdateProvider, token: string) => Promise<void>;
    /**
     * This method lists the authentication providers available for an actor type.
     * It sends a request to the [List Auth Providers API route](https://docs.medusajs.com/api/admin#auth_getactor_typeproviders).
     *
     * This is a public, pre-authentication endpoint. A frontend can use it to
     * render the available login options, such as an email/password form or
     * "Continue with ..." redirect buttons, based on each provider's `flow`.
     *
     * @param actor - The actor type. For example, `user` for admin user, or `customer` for customer.
     * @param headers - Headers to pass in the request.
     * @returns The list of available auth providers.
     *
     * @tags auth
     *
     * @example
     * const { providers } = await sdk.auth.listProviders("user")
     */
    listProviders: (actor: string, headers?: ClientHeaders) => Promise<HttpTypes.AuthProvidersListResponse>;
    /**
     * This method creates or links the `user` (admin) actor for a redirect-based
     * authentication provider after a successful callback. An existing user with
     * a matching, identity-provider-verified email is linked; otherwise a new
     * user is created. It sends a request to the [Provision Auth User API route](https://docs.medusajs.com/api/admin#auth_postauth_provideruser).
     *
     * The token returned by {@link callback} is actorless until the user is
     * provisioned. Pass that token in the `Authorization` header, then call
     * {@link refresh} to obtain a token bound to the newly linked user.
     *
     * @param provider - The authentication provider instance ID. For example, `okta`.
     * @param headers - Headers to pass in the request, typically the `Authorization`
     * bearer token returned by the callback.
     * @returns The created or linked user.
     *
     * @tags auth
     *
     * @example
     * const token = await sdk.auth.callback("user", "okta", queryParams)
     * await sdk.auth.createUser("okta", { Authorization: `Bearer ${token}` })
     * await sdk.auth.refresh()
     */
    createUser: (provider: string, headers?: ClientHeaders) => Promise<HttpTypes.AdminUserResponse>;
    /**
     * @ignore
     */
    private setToken_;
}
//# sourceMappingURL=index.d.ts.map