import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
import { PassportProfile } from '@backstage/plugin-auth-node';
import * as crypto from 'crypto';
import * as jose from 'jose';
import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';

/**
 * JWT header extraction result, containing the raw value and the parsed JWT
 * payload.
 *
 * @public
 */
type AwsAlbResult = {
    fullProfile: PassportProfile;
    expiresInSeconds?: number;
    accessToken: string;
};

/** @public */
declare const awsAlbAuthenticator: _backstage_plugin_auth_node.ProxyAuthenticator<{
    issuer: string;
    signer: string | undefined;
    getKey: (header: jose.JWTHeaderParameters) => Promise<crypto.KeyObject>;
}, AwsAlbResult, {
    accessToken: string;
    expiresInSeconds: number;
}>;

/** @public */
declare const authModuleAwsAlbProvider: _backstage_backend_plugin_api.BackendFeature;

/**
 * Available sign-in resolvers for the AWS ALB auth provider.
 *
 * @public
 */
declare namespace awsAlbSignInResolvers {
    const emailMatchingUserEntityProfileEmail: _backstage_plugin_auth_node.SignInResolverFactory<AwsAlbResult, {
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
}

export { authModuleAwsAlbProvider, awsAlbAuthenticator, awsAlbSignInResolvers, authModuleAwsAlbProvider as default };
export type { AwsAlbResult };