import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';
import { RootConfigService } from '@backstage/backend-plugin-api';
import Keyv from 'keyv';
import { SignInResolver as SignInResolver$1, AuthResolverContext, AuthProviderRouteHandlers, AuthProviderFactory } from '@backstage/plugin-auth-node';
import { ClientOptions } from 'ldapts';
import { Request, Response } from 'express';

declare function prepareBackstageIdentityResponse(result: BackstageSignInResult): BackstageIdentityResponse;
declare const defaultSigninResolver: SignInResolver$1<LDAPUser>;
declare const defaultAuthHandler: AuthHandler<LDAPUser>;

declare const defaultCheckUserExists: (options: LdapAuthenticationOptions) => Promise<boolean>;
declare function defaultLDAPAuthentication(username: string, password: string, options: LdapAuthenticationOptions): Promise<LDAPUser>;

/**
 * A representation of a successful Backstage sign-in.
 *
 * Compared to the {@link BackstageIdentityResponse} this type omits
 * the decoded identity information embedded in the token.
 *
 * @public
 */
interface BackstageSignInResult {
    /**
     * The token used to authenticate the user within Backstage.
     */
    token: string;
}
/**
 * Response object containing the {@link BackstageUserIdentity} and the token
 * from the authentication provider.
 *
 * @public
 */
interface BackstageIdentityResponse extends BackstageSignInResult {
    /**
     * A plaintext description of the identity that is encapsulated within the token.
     */
    identity: BackstageUserIdentity;
}
/**
 * User identity information within Backstage.
 *
 * @public
 */
type BackstageUserIdentity = {
    /**
     * The type of identity that this structure represents. In the frontend app
     * this will currently always be 'user'.
     */
    type: "user";
    /**
     * The entityRef of the user in the catalog.
     * For example User:default/sandra
     */
    userEntityRef: string;
    /**
     * The user and group entities that the user claims ownership through
     */
    ownershipEntityRefs: string[];
};
type LDAPResponse = {
    dn: string;
    controls?: [];
    uid: string;
    givenName: string;
    cn: string;
    uidNumber: string;
    gidNumber: string;
    homeDirectory: string;
    mail: string;
    sn: string;
    objectClass: string[];
};
type LDAPUser = Partial<LDAPResponse>;
type BackstageJWTPayload = {
    iss: string;
    sub: string;
    ent: string[];
    aud: string;
    iat: number;
    exp: number;
};

interface LdapAuthenticationOptions {
    ldapOpts: ClientOptions;
    userSearchBase?: string;
    usernameAttribute?: string;
    username?: string;
    adminDn?: string;
    adminPassword?: string;
    starttls?: boolean;
    userPassword?: string;
}

type CookiesOptions = {
    field: string;
    secure: boolean;
};
type BackstageLdapAuthConfiguration = {
    cookies?: Partial<CookiesOptions>;
    ldapAuthenticationOptions: LdapAuthenticationOptions;
};
type Resolvers = {
    checkUserExists?: typeof defaultCheckUserExists;
    ldapAuthentication?: typeof defaultLDAPAuthentication;
};
type SignInResolver = {
    resolver?: typeof defaultSigninResolver;
};
type ProviderCreateOptions = {
    authHandler?: typeof defaultAuthHandler;
    signIn?: SignInResolver;
    resolvers?: Resolvers;
    tokenValidator?: TokenValidator;
};
type ProviderConstructor = {
    cookies: BackstageLdapAuthConfiguration["cookies"];
    ldapAuthenticationOptions: LdapAuthenticationOptions;
    authHandler: typeof defaultAuthHandler;
    signInResolver: typeof defaultSigninResolver;
    checkUserExists: typeof defaultCheckUserExists;
    ldapAuthentication: typeof defaultLDAPAuthentication;
    resolverContext: AuthResolverContext;
    tokenValidator?: TokenValidator;
};

declare const normalizeTime: (date: number) => number;
declare function parseJwtPayload(token: string): BackstageJWTPayload | never;
interface TokenValidator {
    logout(jwt: string, ts: number): Promise<void> | void;
    isValid(jwt: string): Promise<boolean> | boolean;
    invalidateToken(jwt: string): Promise<void> | void;
}
declare class JWTTokenValidator implements TokenValidator {
    protected readonly store: Keyv;
    readonly increaseTokenExpireMs: number;
    constructor(store: Keyv, increaseTokenExpireMs?: number);
    logout(jwt: string, ts: number): Promise<void>;
    invalidateToken(jwt: string): Promise<void>;
    isValid(jwt: string): Promise<boolean>;
}

interface LdapAuthSetter {
    set(opt: ProviderCreateOptions): void;
}
declare const ldapAuthExtensionPoint: _backstage_backend_plugin_api.ExtensionPoint<LdapAuthSetter>;
declare const tokenValidatorRef: _backstage_backend_plugin_api.ServiceRef<TokenValidator, "plugin", "singleton">;
type TokenValidatorOptions = {
    createTokenValidator(config: RootConfigService): TokenValidator | Promise<TokenValidator>;
};
declare const tokenValidatorFactoryWithOptions: (options?: TokenValidatorOptions) => _backstage_backend_plugin_api.ServiceFactory<TokenValidator, "plugin", "singleton">;
declare const tokenValidatorFactory: ((options?: TokenValidatorOptions) => _backstage_backend_plugin_api.ServiceFactory<TokenValidator, "plugin", "singleton">) & _backstage_backend_plugin_api.ServiceFactory<TokenValidator, "plugin", "singleton">;
declare const _default: _backstage_backend_plugin_api.BackendFeature;

declare class ProviderLdapAuthProvider implements AuthProviderRouteHandlers {
    private readonly checkUserExists;
    private readonly ldapAuthentication;
    private readonly authHandler;
    private readonly signInResolver;
    private readonly resolverContext;
    private readonly jwtValidator;
    private readonly ldapAuthenticationOptions;
    private readonly cookies;
    constructor(options: ProviderConstructor);
    start(): Promise<void>;
    frameHandler(): Promise<void>;
    check(uid: string): Promise<void>;
    refresh(req: Request, res: Response): Promise<void>;
    logout(req: Request, res: Response): Promise<void>;
}
declare const ldap: {
    create(options: ProviderCreateOptions): AuthProviderFactory;
};

export { JWTTokenValidator, ProviderLdapAuthProvider, type TokenValidator, _default as default, ldap, ldapAuthExtensionPoint, normalizeTime, parseJwtPayload, prepareBackstageIdentityResponse, tokenValidatorFactory, tokenValidatorFactoryWithOptions, tokenValidatorRef };