import type { FabricPrincipal } from "@fabric-harness/sdk";
export interface DatabricksAppUserAuthorizationInspection {
    principal: FabricPrincipal;
    workspaceIdentity: {
        id: string;
        userName?: string;
        displayName?: string;
    };
    token: {
        issuedAt?: string;
        expiresAt?: string;
        remainingSeconds?: number;
    };
}
export interface DatabricksAppAuthenticatedPrincipal {
    id: string;
    kind: "user" | "service-principal" | "app-principal";
    displayName?: string;
    provider: "databricks-apps";
    tenantId: string;
    permissions: string[];
    ucPrincipal?: string;
}
export interface DatabricksAppUserAuthenticatorOptions {
    host: string;
    fetchImpl?: typeof fetch;
    /** Maximum validation-cache lifetime. It is always bounded by token expiry. Default 5 minutes. */
    cacheTtlMs?: number;
    /** Override the default per-user tenant mapping for an explicitly shared application tenant. */
    tenantId?: (inspection: DatabricksAppUserAuthorizationInspection) => string;
    /** Override the least-privilege permissions granted to an authenticated App user. */
    permissions?: string[];
    /**
     * Trust Databricks Apps reverse-proxy user identity headers when this authenticator is used only
     * behind Databricks Apps ingress. This authenticates the caller's workspace identity without
     * granting an on-behalf-of token to downstream code.
     */
    trustForwardedUserIdentity?: boolean;
    /**
     * Trust Databricks Apps reverse-proxy identity headers for M2M API calls that do not carry an
     * OBO user token. Enable only when this server is exclusively behind Databricks Apps ingress.
     */
    trustForwardedServicePrincipal?: boolean;
    /**
     * Treat requests without an OBO user token as App authorization and bind them to this App's
     * injected service principal. Enable only behind Databricks Apps ingress.
     */
    appPrincipalId?: string;
    /**
     * Service-principal IDs allowed to use App authorization when Databricks forwards their M2M
     * token through the OBO header. Values are matched against proxy identity headers and safe JWT
     * identity claims. Other forwarded tokens remain on the fail-closed OBO path.
     */
    appAuthorizedCallerIds?: string[];
    now?: () => number;
}
export declare const DATABRICKS_APP_USER_PERMISSIONS: readonly ["agent:invoke", "approval:read", "approval:write", "artifact:read", "mcp:invoke", "session:abort", "session:delete", "session:read"];
/**
 * Authenticate Databricks Apps forwarded user tokens and isolate each user by default.
 * Validation calls the workspace current-user API once per token digest; raw tokens are never
 * stored as cache keys or returned to Fabric Harness.
 */
export declare function createDatabricksAppUserAuthenticator(options: DatabricksAppUserAuthenticatorOptions): (request: {
    headers: Headers | Record<string, string | string[] | undefined>;
}) => Promise<DatabricksAppAuthenticatedPrincipal | false | undefined>;
/** Stable, non-reversible tenant scope for Databricks App principals. */
export declare function databricksPrincipalTenantId(kind: "user" | "service-principal" | "app", id: string): string;
/**
 * Validate a Databricks Apps forwarded user token and return non-secret
 * identity/lifetime metadata suitable for OBO lifecycle certification.
 * The access token is never returned or included in an error.
 */
export declare function inspectDatabricksAppUserAuthorization(options: {
    headers: Headers | Record<string, string | string[] | undefined>;
    host: string;
    fetchImpl?: typeof fetch;
    now?: () => number;
}): Promise<DatabricksAppUserAuthorizationInspection>;
//# sourceMappingURL=app-user-authorization.d.ts.map