/**
 * Shared validation utilities for OAuth providers
 *
 * Security-first validation helpers to prevent SSRF, injection attacks,
 * and other common OAuth configuration vulnerabilities.
 */
/**
 * Validates that a domain string is safe from common attacks
 *
 * Prevents SSRF attacks by blocking private IPs, localhost, cloud metadata endpoints,
 * and non-HTTP protocols.
 *
 * @param domain - Domain string to validate (e.g., 'example.okta.com' or 'https://example.okta.com')
 * @param providerName - Name of provider for error messages
 * @returns Validated hostname (without protocol)
 * @throws Error if domain is invalid or unsafe
 */
export declare function validateDomainSafety(domain: string, providerName: string): string;
/**
 * Validates that a domain matches an allowlist of permitted suffixes
 *
 * Use after validateDomainSafety() to ensure domains match expected patterns
 * (e.g., *.okta.com, *.auth0.com)
 *
 * @param hostname - Validated hostname (from validateDomainSafety)
 * @param allowedSuffixes - Array of allowed domain suffixes (e.g., ['.okta.com', '.okta-emea.com'])
 * @param providerName - Name of provider for error messages
 * @throws Error if hostname doesn't match any allowed suffix
 */
export declare function validateDomainAllowlist(hostname: string, allowedSuffixes: string[], providerName: string): void;
/**
 * Validates email domain format
 *
 * Prevents injection attacks by blocking CRLF, null bytes, and control characters.
 *
 * @param emailDomain - Email domain to validate (e.g., 'example.com')
 * @throws Error if domain contains dangerous characters
 */
export declare function validateEmailDomain(emailDomain: string): void;
/**
 * Validates tenant ID format
 *
 * Ensures tenant IDs are safe for URLs and file paths. Enforces length limits
 * and character restrictions.
 *
 * @param tenantId - Tenant ID to validate
 * @throws Error if tenant ID is invalid or unsafe
 */
export declare function validateTenantId(tenantId: string): void;
/**
 * Sanitizes tenant name for safe HTML output
 *
 * Prevents XSS attacks by HTML-escaping special characters.
 *
 * @param name - Tenant name to sanitize
 * @returns HTML-escaped tenant name
 */
export declare function sanitizeTenantName(name: string): string;
/**
 * Validates Azure tenant ID format
 *
 * Valid formats: GUID, 'common', 'organizations', or 'consumers'
 *
 * @param tenantId - Azure tenant ID to validate
 * @throws Error if tenant ID is invalid
 */
export declare function validateAzureTenantId(tenantId: string): void;