import { AuthResult } from "emdash";
import { JWTPayload } from "jose";

//#region src/auth/cloudflare-access.d.ts
/**
 * Configuration for Cloudflare Access authentication
 *
 * Note: This interface is duplicated in ../index.ts for config-time usage.
 * Keep them in sync.
 */
interface AccessConfig {
  /**
   * Your Cloudflare Access team domain
   * @example "myteam.cloudflareaccess.com"
   */
  teamDomain: string;
  /**
   * Application Audience (AUD) tag from Access application settings.
   * For Cloudflare Workers, use `audienceEnvVar` instead to read at runtime.
   */
  audience?: string;
  /**
   * Environment variable name containing the audience tag.
   * Read at runtime from environment.
   * @default "CF_ACCESS_AUDIENCE"
   */
  audienceEnvVar?: string;
  /**
   * Role level for users not matching any group in roleMapping
   * @default 30 (Editor)
   */
  defaultRole?: number;
  /**
   * Map IdP group names to EmDash role levels
   */
  roleMapping?: Record<string, number>;
}
/**
 * Cloudflare Access JWT payload extends standard JWT with email claim
 */
interface AccessJwtPayload extends JWTPayload {
  /** User's email address (Access-specific claim) */
  email: string;
}
/**
 * Group from IdP (returned by get-identity endpoint)
 */
interface AccessGroup {
  id: string;
  name: string;
  email?: string;
}
/**
 * Full identity from Access get-identity endpoint
 */
interface AccessIdentity {
  /** Unique identity ID */
  id: string;
  /** User's display name (may be undefined if IdP doesn't provide it) */
  name?: string;
  /** User's email address */
  email: string;
  /** Groups from IdP */
  groups: AccessGroup[];
  /** Identity provider info */
  idp: {
    id: string;
    type: string;
  };
  /** Custom OIDC claims from IdP */
  oidc_fields?: Record<string, unknown>;
  /** SAML attributes from IdP */
  saml_attributes?: Record<string, unknown>;
  /** User's country (from geo) */
  geo?: {
    country: string;
  };
}
declare function authenticate(request: Request, config: unknown): Promise<AuthResult>;
//#endregion
export { type AccessConfig, type AccessGroup, type AccessIdentity, type AccessJwtPayload, authenticate };