import type { TSsoProvisioningMode, IGroupRoleMapping, ISsoAttributeMapping, ISsoDomainVerification } from '../data/ssoconnection.js';
/**
 * Client-facing SSO connection shape. IdP signing certificates are public
 * material and stay included; the raw metadata XML is omitted.
 */
export interface ISsoConnectionDto {
    id: string;
    data: {
        organizationId: string;
        type: 'saml';
        displayName: string;
        status: 'active' | 'disabled';
        emailDomains: string[];
        /** Present on servers that enforce DNS ownership verification. */
        domainVerifications?: ISsoDomainVerification[];
        idp: {
            entityId: string;
            ssoUrl: string;
            signingCertificates: string[];
        };
        provisioning: {
            mode: TSsoProvisioningMode;
            defaultOrgRoles: string[];
        };
        groupMappings: IGroupRoleMapping[];
        attributeMapping?: ISsoAttributeMapping;
        createdAt: number;
        updatedAt: number;
    };
}
/**
 * Client-facing SCIM token shape. Never carries the token hash; the
 * plaintext token is returned exactly once by createScimToken.
 */
export interface IScimTokenDto {
    id: string;
    data: {
        organizationId: string;
        label: string;
        tokenPrefix: string;
        createdAt: number;
        expiresAt?: number;
        lastUsedAt?: number;
        revoked: boolean;
    };
}
/**
 * Service-provider side details an org admin needs to configure their IdP.
 */
export interface ISsoSpDetailsDto {
    /** SP entityID to register at the customer IdP */
    spEntityId: string;
    /** Assertion consumer service URL (HTTP-POST binding) */
    acsUrl: string;
    /** URL serving the SP metadata XML */
    metadataUrl: string;
    /** Base URL of the SCIM v2 endpoint for this org */
    scimBaseUrl: string;
}