@syndew/oluso-auth 0.0.0-stage → 0.0.1

package/types/syndew-oluso-auth.d.ts

@@ -0,0 +1,776 @@
+import { Observable } from 'rxjs';
+import * as _angular_core from '@angular/core';
+import { InjectionToken } from '@angular/core';
+import { CanActivateFn } from '@angular/router';
+import { HttpInterceptorFn, HttpErrorResponse, HttpRequest, HttpClient } from '@angular/common/http';
+
+interface AuthUser {
+    id: string;
+    email: string;
+    name?: string;
+    userName?: string;
+    displayName?: string;
+    firstName?: string;
+    lastName?: string;
+    picture?: string;
+    emailVerified?: boolean;
+    roles?: string[];
+    permissions?: string[];
+    metadata?: Record<string, unknown>;
+    organizationIds?: string[];
+    organizationRoles?: Record<string, string>;
+    isOrgAdmin?: boolean;
+}
+
+interface OrganizationContext {
+    id: string;
+    name: string;
+    slug?: string;
+    type?: 'personal' | 'team' | 'enterprise';
+    role?: string;
+    permissions?: string[];
+}
+
+interface AuthState {
+    user: AuthUser | null;
+    accessToken: string | null;
+    refreshToken?: string | null;
+    idToken?: string | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    error: string | null;
+    currentTenantId: string | null;
+    currentOrganization: OrganizationContext | null;
+    isSuperAdmin: boolean;
+}
+
+interface LoginRequest {
+    username: string;
+    password: string;
+}
+
+interface LoginResponse {
+    user: AuthUser;
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresIn?: number;
+}
+
+interface OidcConfig {
+    authority: string;
+    clientId: string;
+    redirectUri: string;
+    postLogoutRedirectUri?: string;
+    scope?: string;
+    responseType?: string;
+    silentRedirectUri?: string;
+    automaticSilentRenew?: boolean;
+    loadUserInfo?: boolean;
+}
+
+interface TokenPayload {
+    sub: string;
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    email?: string;
+    name?: string;
+    roles?: string[];
+    permissions?: string[];
+    tenant_id?: string;
+    [key: string]: unknown;
+}
+
+interface AuthRefreshResult {
+    isAuthenticated: boolean;
+    accessToken: string | null;
+}
+/**
+ * Implemented by the host app to bridge auth concerns to whatever auth library
+ * (angular-auth-oidc-client, MSAL, etc.) is in use. Keeps libs/auth free of
+ * library-specific dependencies — swapping providers is a single-file change.
+ */
+declare abstract class AuthProvider {
+    abstract readonly isAuthenticated$: Observable<boolean>;
+    abstract getAccessToken(): Observable<string | null>;
+    abstract forceRefreshSession(): Observable<AuthRefreshResult>;
+    /**
+     * Refreshes the session into another tenant: the library's new tokens (access and refresh) are for
+     * `tenantId`, and later refreshes stay there. Errors when the server refuses the tenant (the user has no
+     * access to it); the session stays signed in, where it was.
+     */
+    abstract switchTenant(tenantId: string): Observable<AuthRefreshResult>;
+    abstract authorize(): void;
+}
+declare class NoOpAuthProvider extends AuthProvider {
+    readonly isAuthenticated$: Observable<boolean>;
+    getAccessToken(): Observable<string | null>;
+    forceRefreshSession(): Observable<AuthRefreshResult>;
+    switchTenant(): Observable<AuthRefreshResult>;
+    authorize(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<NoOpAuthProvider, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<NoOpAuthProvider>;
+}
+
+/**
+ * Serialises token refreshes against the auth library's own background renew.
+ *
+ * With silent renew on, the library refreshes on a timer. If an API call fails
+ * with 401 while that renew is still in flight, a second refresh request is
+ * declined by the library, which reports "no session" even though the renew is
+ * about to succeed. Left alone, the interceptor would treat that as a signed-out
+ * user and redirect to login. Instead, wait for the running renew to settle and
+ * answer with the token it produced.
+ *
+ * Library-agnostic: the adapter supplies the "renew started" and "renew settled"
+ * streams and the single-shot refresh call.
+ */
+declare abstract class RenewAwareAuthProvider extends AuthProvider {
+    /** How long to wait for a running renew before giving up; matches the library's own timeout. */
+    protected renewWaitMs: number;
+    private renewInFlight;
+    private readonly settled$;
+    /** One refresh attempt through the library. Reports unauthenticated when the library declines. */
+    protected abstract refreshOnce(): Observable<AuthRefreshResult>;
+    /**
+     * Adapters call this once, in their constructor, with the library's events:
+     * `started$` whenever a background renew begins, `settled$` with true/false
+     * whenever a renew (or any authentication result) completes.
+     */
+    protected trackRenew(started$: Observable<unknown>, settled$: Observable<boolean>): void;
+    forceRefreshSession(): Observable<AuthRefreshResult>;
+    /**
+     * A refresh that switches tenant: {@link requestTenantSwitch} adds the token endpoint's `tenant` parameter to
+     * that one refresh request, outside the library, so the library neither keeps it for later refreshes nor sees
+     * a refusal (which it would answer by signing the user out). A renew already running is let finish first, so
+     * the switch redeems the refresh token it leaves behind. Errors unless the new token is for `tenantId`; the
+     * session is left where it was.
+     */
+    switchTenant(tenantId: string): Observable<AuthRefreshResult>;
+    private awaitRenew;
+}
+/** The tenant an access token is for (its `tenant_id` claim), or null when it names none or is not a JWT. */
+declare function tenantOfToken(accessToken: string): string | null;
+
+/**
+ * Tells the app's other tabs when a refresh token has been spent, and hands them what it was exchanged for.
+ *
+ * Refresh tokens are single use. Tabs can hold the same one: a duplicated tab starts with a copy of its
+ * opener's session, and remembered sign-ins share one store across every tab. When one tab redeems it, the
+ * others must take the rotated tokens rather than present the spent one, which the server refuses.
+ *
+ * The tokens travel encrypted under a key derived from the spent refresh token, so only a tab that already
+ * held that token can read them; any other tab of the app (another user's session-only sign-in, say) learns
+ * nothing. An answer is kept for {@link ROTATION_ANSWER_TTL_MS}, well inside the 120 s the OIDC client
+ * allows between an ID token being issued and accepted.
+ */
+/** The token entries of the OIDC client's stored state, as written after a refresh. */
+type RotatedTokens = Record<string, unknown>;
+declare class TokenRotationChannel {
+    private readonly answers;
+    private readonly waiters;
+    private readonly publications;
+    private readonly listeners;
+    private readonly channel;
+    constructor(channelName?: string);
+    /**
+     * Records that `spentRefreshToken` was exchanged for `tokens` and tells the other tabs. Resolves once the
+     * other tabs have been told.
+     */
+    publish(spentRefreshToken: string, tokens: RotatedTokens): Promise<void>;
+    /** Resolves once this tab has published the rotation of `refreshToken`, or after `timeoutMs`. */
+    awaitPublished(refreshToken: string, timeoutMs: number): Promise<void>;
+    /** What `refreshToken` was exchanged for, in this tab or another, while that answer is fresh; else null. */
+    answerFor(refreshToken: string): Promise<RotatedTokens | null>;
+    /** {@link answerFor}, waiting up to `timeoutMs` for another tab's rotation of `refreshToken` to arrive. */
+    waitForAnswer(refreshToken: string, timeoutMs: number): Promise<RotatedTokens | null>;
+    /** Calls `listener` with the id of every rotation that arrives from another tab. Returns the unsubscribe. */
+    onRotation(listener: (id: string) => void): () => void;
+    /** Whether `refreshToken` is the token a rotation with `id` spent. */
+    isSpentBy(refreshToken: string, id: string): Promise<boolean>;
+    private remember;
+    private publication;
+}
+
+/**
+ * Token storage that follows the user's "Remember me" choice at sign-in.
+ *
+ * The OIDC client hands this one JSON blob per configuration. Until sign-in
+ * completes the blob only holds the pending state (nonce, code verifier) and
+ * stays in session storage, which the callback in the same tab can read. Once
+ * the blob contains a token response, the ID token says whether the sign-in was
+ * remembered: remembered sessions move to local storage, so they survive a
+ * browser restart and are shared across tabs; session-only sign-ins stay per
+ * tab and vanish when it closes. Sign-out removes both copies.
+ *
+ * Refresh tokens are single use, and tabs can hold the same one (a duplicated
+ * tab starts with a copy of its opener's session; remembered sessions share
+ * one store). When a write replaces the refresh token, the spent token and the
+ * new tokens go to the app's other tabs; a tab still holding the spent token
+ * takes the new ones, so it never presents a token the server has retired.
+ *
+ * Kept free of the OIDC library: it matches the storage contract by shape and
+ * is registered by the app's auth provider.
+ */
+declare class RememberMeSecurityStorage {
+    private readonly rotations;
+    private readonly pendingRotations;
+    constructor(rotations?: TokenRotationChannel | null);
+    read(key: string): string | null;
+    write(key: string, value: string): void;
+    private publishRotation;
+    /** Takes the tokens another tab rotated to, for every stored session still holding the token it spent. */
+    private adoptRotation;
+    private authKeys;
+    private store;
+    remove(key: string): void;
+    clear(): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<RememberMeSecurityStorage, [{ optional: true; }]>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<RememberMeSecurityStorage>;
+}
+
+/** The parts of the app's OIDC client the startup check needs; the library's security service fits as is. */
+interface StartupAuthClient<R extends {
+    isAuthenticated: boolean;
+}> {
+    /** Validates the stored tokens (or completes a sign-in callback) without calling the server. */
+    checkAuth(): Observable<R>;
+    /** {@link checkAuth}, then, when that finds no valid session, a refresh with the stored refresh token. */
+    checkAuthIncludingServer(): Observable<R>;
+    getRefreshToken(): Observable<string | null | undefined>;
+}
+/**
+ * The app's startup auth check. A stored access token that has expired (or is inside the renew window) makes the
+ * plain check report "signed out", and the app would send the user through sign-in again although the refresh
+ * token is good for days. When a refresh token is stored this renews with it instead, which also restarts the
+ * library's background renew. A sign-in callback is completed by the plain check alone, and a refresh the server
+ * refuses (refresh token expired or revoked) leaves the user signed out, as before.
+ *
+ * The refresh goes through the app's HttpClient, so the token-refresh interceptor still coordinates it with the
+ * app's other tabs.
+ */
+declare function checkAuthRenewingSession<R extends {
+    isAuthenticated: boolean;
+}>(client: StartupAuthClient<R>, url?: string): Observable<R>;
+
+/**
+ * Auth Store
+ *
+ * Signal-based authentication state management.
+ * This mirrors the Zustand authSlice from the React codebase.
+ *
+ * Features:
+ * - Persistent state via localStorage
+ * - Tenant/organization context
+ * - Super admin support
+ */
+declare class AuthStore {
+    private readonly authProvider;
+    private readonly _user;
+    private readonly _accessToken;
+    private readonly _refreshToken;
+    private readonly _idToken;
+    private readonly _isLoading;
+    private readonly _error;
+    private readonly _currentTenantId;
+    /** True once the user has picked a tenant in the UI; only then do requests carry X-Tenant-ID. */
+    private readonly _tenantSwitched;
+    private readonly _currentOrganization;
+    private readonly _isSuperAdmin;
+    private readonly _hasHydrated;
+    /** Read-only computed state */
+    readonly user: _angular_core.Signal<AuthUser | null>;
+    readonly accessToken: _angular_core.Signal<string | null>;
+    readonly refreshToken: _angular_core.Signal<string | null>;
+    readonly idToken: _angular_core.Signal<string | null>;
+    readonly isLoading: _angular_core.Signal<boolean>;
+    readonly error: _angular_core.Signal<string | null>;
+    readonly currentTenantId: _angular_core.Signal<string | null>;
+    readonly tenantSwitched: _angular_core.Signal<boolean>;
+    readonly currentOrganization: _angular_core.Signal<OrganizationContext | null>;
+    readonly isSuperAdmin: _angular_core.Signal<boolean>;
+    readonly hasHydrated: _angular_core.Signal<boolean>;
+    readonly isAuthenticated: _angular_core.Signal<boolean>;
+    /** Full state snapshot */
+    readonly state: _angular_core.Signal<AuthState>;
+    constructor();
+    /**
+     * Set user and tokens after successful login.
+     * Extracts tenant_id from the JWT access token if present.
+     */
+    login(user: AuthUser, accessToken: string, refreshToken?: string, idToken?: string): void;
+    /**
+     * Makes the current tenant the one the token is for. A switch mints a token for its target, so a current
+     * tenant naming any other was left by an earlier session (or another app on the origin): it is replaced, and
+     * the session counts as not switched, so requests carry no X-Tenant-ID.
+     */
+    alignTenantWithToken(accessToken: string): void;
+    /**
+     * Clear authentication state on logout
+     */
+    logout(): void;
+    /**
+     * Update user information
+     */
+    setUser(user: AuthUser | null): void;
+    /**
+     * Update access token
+     */
+    setAccessToken(token: string | null): void;
+    /**
+     * Update refresh token
+     */
+    setRefreshToken(token: string | null): void;
+    /**
+     * Set current tenant ID (for super admin)
+     */
+    setCurrentTenantId(tenantId: string | null): void;
+    /**
+     * Adopt a tenant switch: the new context and the token minted for it.
+     *
+     * Both move together deliberately. Roles and permissions are per-tenant, so a
+     * moment where the header names one tenant and the token carries another
+     * either over-grants or under-grants — and a persist() between the two writes
+     * would make that state survive a reload.
+     */
+    switchTenant(tenantId: string, accessToken: string): void;
+    /**
+     * Set current organization context
+     */
+    setCurrentOrganization(organization: OrganizationContext | null): void;
+    /**
+     * Set super admin status
+     */
+    setSuperAdmin(isSuperAdmin: boolean): void;
+    /**
+     * Set loading state
+     */
+    setLoading(isLoading: boolean): void;
+    /**
+     * Set error message
+     */
+    setError(error: string | null): void;
+    /**
+     * Hydrate state from localStorage
+     */
+    private hydrate;
+    /**
+     * Persist state to localStorage
+     */
+    private persist;
+    /**
+     * Clear localStorage
+     */
+    private clearStorage;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthStore, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthStore>;
+}
+
+/**
+ * Auth Service
+ *
+ * Handles authentication operations including login, logout, token refresh,
+ * and user management.
+ *
+ * This mirrors the auth services from the React codebase.
+ */
+declare class AuthService {
+    private readonly http;
+    private readonly authStore;
+    private apiBaseUrl;
+    /**
+     * Configure the API base URL
+     */
+    setApiBaseUrl(url: string): void;
+    /**
+     * Login with email and password
+     */
+    login(request: LoginRequest): Observable<LoginResponse>;
+    /**
+     * Logout the current user
+     */
+    logout(): Observable<void>;
+    /**
+     * Logout locally without API call
+     */
+    logoutLocal(): void;
+    /**
+     * Refresh the access token
+     */
+    refreshToken(): Observable<{
+        accessToken: string;
+        refreshToken?: string;
+    }>;
+    /**
+     * Get the current user profile
+     */
+    getProfile(): Observable<AuthUser>;
+    /**
+     * Update the current user profile
+     */
+    updateProfile(data: Partial<AuthUser>): Observable<AuthUser>;
+    /**
+     * Check if the current access token is expired
+     */
+    isTokenExpired(): boolean;
+    /**
+     * Decode a JWT token
+     */
+    decodeToken(token: string): TokenPayload;
+    /**
+     * Get the current access token
+     */
+    getAccessToken(): string | null;
+    /**
+     * Check if the user is authenticated
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Get the current user
+     */
+    getUser(): AuthUser | null;
+    /**
+     * Check if the user is a super admin
+     */
+    isSuperAdmin(): boolean;
+    /**
+     * Get the current tenant ID
+     */
+    getCurrentTenantId(): string | null;
+    /**
+     * Set the current tenant ID (for super admin)
+     */
+    setCurrentTenantId(tenantId: string | null): void;
+    static ɵfac: _angular_core.ɵɵFactoryDeclaration<AuthService, never>;
+    static ɵprov: _angular_core.ɵɵInjectableDeclaration<AuthService>;
+}
+
+/**
+ * Auth Guard
+ *
+ * Protects routes that require authentication.
+ * Redirects to login if user is not authenticated.
+ */
+declare const authGuard: CanActivateFn;
+/**
+ * Guest Guard
+ *
+ * Protects routes that should only be accessible to non-authenticated users.
+ * Redirects to dashboard if user is already authenticated.
+ */
+declare const guestGuard: CanActivateFn;
+/**
+ * Super Admin Guard
+ *
+ * Protects routes that require super admin privileges.
+ * Checks PermissionsService which is set during login/permission loading.
+ */
+declare const superAdminGuard: CanActivateFn;
+/**
+ * Org Admin Guard
+ *
+ * Protects routes that require org admin or super admin privileges.
+ * Super admins can also access org admin routes.
+ * Requires a valid organization context (currentOrganization) in the auth store.
+ */
+declare const orgAdminGuard: CanActivateFn;
+
+/**
+ * How long a permission guard waits for the app to load the current user's
+ * permissions before denying. Override to tune per app.
+ */
+declare const PERMISSION_GUARD_TIMEOUT_MS: InjectionToken<number>;
+/**
+ * Permission Guard
+ *
+ * Protects routes that require specific permissions.
+ * Configure the required permission in route data.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'users',
+ *   component: UsersPageComponent,
+ *   canActivate: [permissionGuard],
+ *   data: { permission: 'users.read' }
+ * }
+ * ```
+ */
+declare const permissionGuard: CanActivateFn;
+/**
+ * Any Permission Guard
+ *
+ * Allows access if user has any of the specified permissions.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'resources',
+ *   component: ResourcesPageComponent,
+ *   canActivate: [anyPermissionGuard],
+ *   data: { permissions: ['resources.read', 'resources.write'] }
+ * }
+ * ```
+ */
+declare const anyPermissionGuard: CanActivateFn;
+/**
+ * All Permissions Guard
+ *
+ * Allows access only if user has all of the specified permissions.
+ *
+ * Usage:
+ * ```typescript
+ * {
+ *   path: 'admin',
+ *   component: AdminPageComponent,
+ *   canActivate: [allPermissionsGuard],
+ *   data: { permissions: ['admin.read', 'admin.write'] }
+ * }
+ * ```
+ */
+declare const allPermissionsGuard: CanActivateFn;
+
+/**
+ * Helpers for the tenant-aware SSO landing flow shared across host portals.
+ *
+ * The "Login with SSO" affordance on the landing page resolves a tenant by
+ * identifier and persists its issuer URI to sessionStorage. The host's OIDC
+ * config picks that up at module load (next page navigation) so the OIDC
+ * authority points at the tenant's identity-server subdomain instead of the
+ * platform default. After resolve + persist, the landing reloads with
+ * `pendingAuthorize` set so the post-load handler can call authorize() with
+ * the right authority and the tenant's domain_hint / policy / ui_mode.
+ */
+interface TenantSso {
+    identifier: string;
+    issuerUri: string;
+    defaultIdpScheme?: string;
+    defaultSignInPolicyId?: string;
+    defaultSsoUiMode?: 'Journey' | 'Standalone';
+}
+/**
+ * Extract tenant identifier from hostname subdomain.
+ * e.g., "acme.auth.example.com" → "acme"
+ * Returns undefined for localhost, IP addresses, or hostnames with fewer than 3 parts.
+ */
+declare function resolveTenantFromHostname(): string | undefined;
+/**
+ * Returns the tenant SSO authority persisted in sessionStorage, or the given
+ * default. Safe in SSR / non-browser contexts.
+ */
+declare function resolveTenantSsoAuthority(defaultAuthority: string): string;
+/**
+ * Returns the tenant identifier, issuer URI, and any persisted SSO defaults,
+ * or null if none is set.
+ */
+declare function readTenantSso(): TenantSso | null;
+/**
+ * Persists the tenant SSO context resolved by the landing page. Set
+ * `markPendingAuthorize` so the post-reload landing handler kicks off
+ * authorize() with the tenant's authority + the stored hints.
+ *
+ * Wipes angular-auth-oidc-client's cached well-known + state on the way
+ * out — the cache is keyed by config id, not authority, so switching
+ * tenants would otherwise reuse the previous authority's discovery doc
+ * and throw issuer-mismatch on the next authorize call.
+ */
+declare function writeTenantSso(sso: TenantSso, markPendingAuthorize?: boolean): void;
+/**
+ * Build the customParams object to pass to oidcSecurityService.authorize()
+ * from a remembered tenant SSO. Returns undefined if there's nothing worth
+ * passing. Callers feed this into the `customParams` field of the authorize
+ * call so domain_hint / policy / ui_mode reach /connect/authorize.
+ */
+declare function tenantSsoAuthorizeParams(sso: TenantSso): Record<string, string> | undefined;
+/**
+ * Returns true (and clears the flag) when a pending authorize call was queued
+ * by the landing's SSO submit. Use on landing init to auto-trigger
+ * oidcSecurityService.authorize() after a reload picked up the new authority.
+ */
+declare function consumePendingAuthorize(): boolean;
+/**
+ * Removes all persisted tenant SSO state. Call from logout flows and the
+ * "Use a different organisation" affordance on the landing.
+ *
+ * Also clears angular-auth-oidc-client's sessionStorage cache (well-known
+ * discovery doc, in-flight state) — those entries are keyed by config id,
+ * not by authority URL, so without wiping them a previously-cached
+ * discovery for a different tenant authority survives the switch and
+ * throws an "issuer mismatch" on the next authorize call.
+ */
+declare function clearTenantSso(): void;
+
+/**
+ * Auth Interceptor
+ *
+ * Adds the Authorization header with the access token to outgoing requests.
+ * Handles 401 errors by attempting to refresh the token.
+ */
+declare const authInterceptor: HttpInterceptorFn;
+
+/**
+ * Token attachment fallback + 401 retry with refresh deduplication. On refresh
+ * failure, stashes the current route in sessionStorage under an opaque key so
+ * the post-login callback can restore navigation without leaking the route to
+ * URL/history/server logs.
+ *
+ * Skips the OIDC token endpoint to avoid infinite loops if /connect/token 401s.
+ */
+declare const authRefreshInterceptor: HttpInterceptorFn;
+/**
+ * Remembers the page the user is on before a sign-in redirect ends their session, so the callback page can
+ * bring them back to it ({@link readAndClearReturnUrl}). The callback, renew and error pages, and the root,
+ * are not remembered.
+ */
+declare function rememberReturnUrl(): void;
+/**
+ * Helper for callback pages to restore the pre-login route.
+ */
+declare function readAndClearReturnUrl(): string | null;
+
+/**
+ * Makes each refresh token redeem exactly once across all of the app's tabs, and keeps that redemption alive
+ * through a brief server outage.
+ *
+ * Refresh tokens are single use. Three things would otherwise present one twice:
+ * - the OIDC client abandons a renew it considers slow (its periodic check cancels the request every few
+ *   seconds) and later starts another with the same token;
+ * - in one tab, a 401 and the background renew can both ask for a refresh;
+ * - tabs can hold the same token (a duplicated tab copies its opener's session; remembered sessions share one
+ *   store), and each renews on its own timer.
+ * So one exchange runs per refresh token whether or not its caller still listens, refreshes are taken in turn
+ * across tabs under a Web Lock, and a request for a token another exchange already redeemed — here or in
+ * another tab ({@link tokenRotationChannel}) — is answered with what it was exchanged for, its lifetime
+ * counted from when the server issued it.
+ *
+ * The client also deletes the session on any HTTP error, so a 502 from the proxy while the API restarts would
+ * sign the user out although the refresh token is still good. Transient statuses are retried after the
+ * server's Retry-After (up to 30 s), else 1 s doubling to 10 s; a refusal such as invalid_grant still reaches
+ * the client.
+ */
+declare const tokenRefreshRetryInterceptor: HttpInterceptorFn;
+/** The refresh token a token request redeems, or null for any other request. */
+declare function refreshTokenOf(req: HttpRequest<unknown>): string | null;
+/**
+ * Makes the next refresh a switch to `tenantId` (the token endpoint's `tenant` parameter), or cancels a switch
+ * not yet sent. The parameter rides that one request only: the auth library never holds it, so later refreshes
+ * carry none (the refresh token remembers the tenant), and a refused switch never reaches the library as a
+ * failure — it is answered by a plain refresh instead.
+ */
+declare function requestTenantSwitch(tenantId: string | null): void;
+/** Wait before retry number `attempt` (1-based): the server's Retry-After seconds when it sends them (at most
+ * 30 s), else 1 s doubling to 10 s. */
+declare function refreshRetryDelayMs(error: HttpErrorResponse, attempt: number): number;
+
+/**
+ * Tenant Interceptor
+ *
+ * Adds the X-Tenant-ID header to outgoing API requests when the user
+ * has selected a tenant context.
+ *
+ * This is used in the Admin UI to allow super admins to manage
+ * resources across different tenants. The backend validates
+ * whether the user is authorized to access the specified tenant.
+ *
+ * OIDC protocol endpoints are excluded — they must always use the
+ * global (non-tenant) context so the issuer stays consistent.
+ */
+declare const tenantInterceptor: HttpInterceptorFn;
+/**
+ * Organization Interceptor
+ *
+ * Adds the X-Organization-ID header to outgoing requests when the user
+ * has selected an organization context.
+ *
+ * This is used for multi-tenant applications where users can belong
+ * to multiple organizations.
+ */
+declare const organizationInterceptor: HttpInterceptorFn;
+
+/**
+ * Ngrok Interceptor
+ *
+ * Adds the ngrok-skip-browser-warning header to skip the ngrok interstitial page.
+ * This header is required when making API calls through ngrok tunnels.
+ */
+declare const ngrokInterceptor: HttpInterceptorFn;
+
+/**
+ * Error Interceptor
+ *
+ * Catches HTTP error responses and displays user-friendly toast notifications.
+ * Extracts error messages from backend responses when available.
+ * Skips 401 errors (handled by the auth interceptor).
+ */
+declare const errorInterceptor: HttpInterceptorFn;
+
+/**
+ * The browser's DPoP key (RFC 9449): an ECDSA P-256 key pair whose private half the page can sign with but
+ * never read, so a token bound to it cannot be used anywhere else.
+ *
+ * The pair is kept in IndexedDB, shared by every tab of the app and surviving reloads, because refresh tokens
+ * are bound to it: a remembered session's next refresh needs the same key. Where IndexedDB is unavailable the
+ * key lives for the page only, and the session ends with it.
+ */
+/** The public half, as it goes in a proof's <c>jwk</c> header. */
+interface DPoPPublicJwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+interface DPoPKey {
+    readonly privateKey: CryptoKey;
+    readonly publicJwk: DPoPPublicJwk;
+}
+/** Whether this page can hold a DPoP key: Web Crypto, which browsers offer only in secure contexts. */
+declare function dpopSupported(): boolean;
+/** The app's DPoP key, loaded or created once per page. */
+declare function dpopKey(): Promise<DPoPKey>;
+/** Forgets the key held by this page, so the next {@link dpopKey} reads storage again (tests). */
+declare function resetDPoPKeyForTests(): void;
+
+/** What a DPoP proof (RFC 9449 §4.2) is for: one HTTP request, and the access token it presents if any. */
+interface DPoPProofTarget {
+    method: string;
+    url: string;
+    accessToken?: string | null;
+    nonce?: string | null;
+}
+/** A DPoP proof JWT signed by `key` for one request. */
+declare function createDPoPProof(key: DPoPKey, target: DPoPProofTarget): Promise<string>;
+/** The request URI a proof names: absolute, without query or fragment. */
+declare function proofUri(url: string): string;
+/** The <c>ath</c> claim: the base64url SHA-256 of the access token. */
+declare function accessTokenHash(accessToken: string): Promise<string>;
+
+/**
+ * Sender-constrains the app's tokens with DPoP (RFC 9449).
+ *
+ * - Token requests (any grant) carry a proof, so the server binds the tokens it issues — access and refresh —
+ *   to this browser's key ({@link dpopKey}); a copied token is useless without it.
+ * - A request presenting a DPoP-bound access token (one whose <c>cnf.jkt</c> names a key) is sent under the
+ *   DPoP scheme with a proof for that request and token instead of as a bearer token, which the server refuses.
+ * - When a server asks for a nonce (<c>use_dpop_nonce</c>), the request is retried once with it.
+ *
+ * Register it after the interceptors that attach the access token, so it sees the final request.
+ * Pages without Web Crypto (non-secure contexts) send requests unchanged; their tokens are not bound.
+ */
+declare const dpopInterceptor: HttpInterceptorFn;
+/** The access token a request presents, when it is bound to a DPoP key; else null. */
+declare function boundAccessTokenOf(req: HttpRequest<unknown>): string | null;
+/** Whether a JWT access token is bound to a DPoP key (has <c>cnf.jkt</c>). */
+declare function isDPoPBound(token: string): boolean;
+
+/**
+ * A `fetch` that sends through the app's HttpClient, so its interceptors apply: the signed-in user's access token,
+ * the tenant, DPoP proofs and the refresh-and-retry on an expired token. Give it to the Oluso SDK
+ * (`new OlusoClient({ ..., fetch: httpClientFetch(http) })`) to run journeys the app's backend started for the user.
+ * Answers with an error status resolve like fetch's do, so the SDK reads the server's message.
+ */
+declare function httpClientFetch(http: HttpClient): typeof fetch;
+
+export { AuthProvider, AuthService, AuthStore, NoOpAuthProvider, PERMISSION_GUARD_TIMEOUT_MS, RememberMeSecurityStorage, RenewAwareAuthProvider, accessTokenHash, allPermissionsGuard, anyPermissionGuard, authGuard, authInterceptor, authRefreshInterceptor, boundAccessTokenOf, checkAuthRenewingSession, clearTenantSso, consumePendingAuthorize, createDPoPProof, dpopInterceptor, dpopKey, dpopSupported, errorInterceptor, guestGuard, httpClientFetch, isDPoPBound, ngrokInterceptor, orgAdminGuard, organizationInterceptor, permissionGuard, proofUri, readAndClearReturnUrl, readTenantSso, refreshRetryDelayMs, refreshTokenOf, rememberReturnUrl, requestTenantSwitch, resetDPoPKeyForTests, resolveTenantFromHostname, resolveTenantSsoAuthority, superAdminGuard, tenantInterceptor, tenantOfToken, tenantSsoAuthorizeParams, tokenRefreshRetryInterceptor, writeTenantSso };
+export type { AuthRefreshResult, AuthState, AuthUser, DPoPKey, DPoPProofTarget, DPoPPublicJwk, LoginRequest, LoginResponse, OidcConfig, OrganizationContext, StartupAuthClient, TenantSso, TokenPayload };