import * as _backstage_plugin_auth_node from '@backstage/plugin-auth-node';
import { JsonPrimitive } from '@backstage/types';
import * as _backstage_backend_plugin_api from '@backstage/backend-plugin-api';

/**
 * The data extracted from an IAP token.
 *
 * @public
 */
type GcpIapTokenInfo = {
    /**
     * The unique, stable identifier for the user.
     */
    sub: string;
    /**
     * User email address.
     */
    email: string;
    /**
     * Other fields.
     */
    [key: string]: JsonPrimitive;
};
/**
 * The result of the initial auth challenge. This is the input to the auth
 * callbacks.
 *
 * @public
 */
type GcpIapResult = {
    /**
     * The data extracted from the IAP token header.
     */
    iapToken: GcpIapTokenInfo;
};

/** @public */
declare const gcpIapAuthenticator: _backstage_plugin_auth_node.ProxyAuthenticator<{
    jwtHeader: string;
    tokenValidator: (token: string) => Promise<GcpIapTokenInfo>;
}, {
    iapToken: GcpIapTokenInfo;
}, {
    iapToken: GcpIapTokenInfo;
}>;

/** @public */
declare const authModuleGcpIapProvider: _backstage_backend_plugin_api.BackendFeature;

/**
 * Available sign-in resolvers for the Google auth provider.
 *
 * @public
 */
declare namespace gcpIapSignInResolvers {
    /**
     * Looks up the user by matching their email to the `google.com/email` annotation.
     */
    const emailMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, {
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
    /**
     * Looks up the user by matching their user ID to the `google.com/user-id` annotation.
     */
    const idMatchingUserEntityAnnotation: _backstage_plugin_auth_node.SignInResolverFactory<GcpIapResult, {
        dangerouslyAllowSignInWithoutUserInCatalog?: boolean | undefined;
    } | undefined>;
}

export { authModuleGcpIapProvider as default, gcpIapAuthenticator, gcpIapSignInResolvers };
export type { GcpIapResult, GcpIapTokenInfo };