import { Config } from '@backstage/config';
import { AuthService, BackstageCredentials } from '@backstage/backend-plugin-api';
import { CatalogClient } from '@backstage/catalog-client';
import { Request } from 'express';
import { LiteLLMClient } from './client';
import { UserInfo, ProvisioningDefaults, RoleConfig } from './types';
/**
 * Converts a Backstage user entity ref to a LiteLLM user_id.
 *
 * When userIdDomain is configured, the entity name is suffixed with the domain
 * so that LiteLLM user_ids match the organisation's email addresses:
 *   "user:default/andrea.carmisciano" + "example.com"
 *   → "andrea.carmisciano@example.com"
 *
 * Without a domain the bare entity name is returned unchanged, which works for
 * deployments where LiteLLM users were created with plain usernames.
 */
export declare function toLiteLLMUserId(userEntityRef: string, userIdDomain?: string): string;
/**
 * Reads the provisioning block from config, applying safe defaults for every
 * field so the feature works out-of-the-box without any YAML required.
 *
 * Safe defaults rationale:
 *   maxBudget:      $10  — prevents runaway spend on a forgotten test account
 *   budgetDuration: 30d  — monthly reset, aligns with typical billing cycles
 *   models:         []   — empty means all proxy models are allowed;
 *                          restrict here or at team level for tighter control
 *   teams:          []   — no automatic team assignment; add IDs to enrol users
 *   tpmLimit:       none — LiteLLM global / team limits still apply
 *   rpmLimit:       none — same
 *   metadata:       backstage source tag only
 */
export declare function readRoleConfigs(config: Config): RoleConfig[];
/**
 * Merges role config over defaults. Role fields override defaults only when explicitly set.
 */
export declare function applyRoleOverrides(defaults: ProvisioningDefaults, role: RoleConfig): ProvisioningDefaults;
export declare function readProvisioningDefaults(config: Config): {
    enabled: boolean;
    defaults: ProvisioningDefaults;
};
/**
 * Extracts the authenticated Backstage user identity from the request token.
 * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
 * the request carries no user credential (service-to-service calls).
 */
export declare function resolveUserId(req: Request, auth: AuthService): Promise<string | undefined>;
/**
 * Like resolveUserId, but returns the raw BackstageCredentials object
 * (rather than just the entity ref) for passing into PermissionsService.authorize().
 */
export declare function resolveCredentials(req: Request, auth: AuthService): Promise<BackstageCredentials | undefined>;
/**
 * Profile data extracted from a Backstage Catalog User entity, used to
 * populate user_email / user_alias on the LiteLLM record.
 */
export interface BackstageUserProfile {
    email?: string;
    displayName?: string;
}
/**
 * Looks up the catalog User entity for the authenticated user and returns
 * the profile block. Returns an empty object when the user has no catalog
 * entity (e.g. dangerouslyAllowSignInWithoutUserInCatalog was used) — the
 * caller falls back to deriving identity from userIdDomain.
 */
export declare function resolveUserProfile(userEntityRef: string, catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<BackstageUserProfile>;
/**
 * Creates a LiteLLM user for the given Backstage identity using the configured
 * defaults. Returns the UserInfo of the newly created account.
 */
export declare function provisionUser(client: LiteLLMClient, userId: string, defaults: ProvisioningDefaults, profile: BackstageUserProfile, backstageEntity: string | undefined, logger: any): Promise<UserInfo | null>;
export declare class ProvisioningError extends Error {
    status: number;
    body: {
        error: string;
        hint: string;
        provisioning: boolean;
    };
    constructor(message: string, hint: string, provisioning: boolean, status?: number);
}
/**
 * Ensures the LiteLLM user exists, returning its UserInfo.
 * When the user is missing and provisioning is enabled, attempts to create it.
 * When provisioning is disabled, throws a ProvisioningError with a clear message.
 */
export declare function getOrProvisionUser(client: LiteLLMClient, tokenEntityRef: string | undefined, userId: string | undefined, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, roleConfigs: RoleConfig[], catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<UserInfo>;
/**
 * Returns true when the user is a member of the given Backstage group entity ref.
 * Used for RBAC gates (e.g. audit log visibility) without the role-config machinery.
 */
export declare function isUserMemberOfGroup(userEntityRef: string, group: string, catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<boolean>;
/**
 * Fetches the user's Backstage group memberships and returns the first matching
 * role config (priority order), or undefined when no role matches.
 */
export declare function resolveUserRole(userEntityRef: string, roleConfigs: RoleConfig[], catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<RoleConfig | undefined>;