wcz-layout/dist/auth.d.mts

import { scopes } from "virtual:wcz-layout";
//#region src/lib/auth/authHandlers.d.ts
/**
 * GET /auth/login — start the flow: stash PKCE + state + provider, redirect to the IdP.
 * Without `?provider=` and with more than one provider registered, sends the user to
 * the chooser at `/login` instead; a single provider (whichever it is) starts right away.
 */
export declare function handleLogin(): Promise<Response>;
/** GET /auth/callback — finish the flow: validate state, exchange code, set session. */
export declare function handleCallback(): Promise<Response>;
/** GET /auth/logout — clear the local session and sign out of the provider's session. */
export declare function handleLogout(): Promise<Response>;
//#endregion
//#region src/lib/auth/tokens.d.ts
type ScopeKey = keyof typeof scopes;
/**
 * Delegated access token for the signed-in user, minted from the session refresh
 * token. Providers that rotate the refresh token return a new one, which is
 * persisted back. Server-only — stripped from the client bundle.
 */
export declare const getAccessToken: (scopeKey: ScopeKey) => Promise<string>;
/**
 * Client-credentials (app-only) token, for background jobs with no user.
 * Entra-only: the AWS population signs in interactively, so a Cognito app client
 * for M2M has no caller yet (and Cognito bills M2M per token request).
 */
export declare const getAppToken: (scopeKey: ScopeKey) => Promise<string>;
//#endregion
//# sourceMappingURL=auth.d.mts.map