/**
 * This lambda verifies access token in Bearer authorization header using Cognito.
 *
 * Expects the following environment variables:
 * - USER_POOL_ID
 * - REQUIRED_SCOPE (optional)
 *   - Set this to require that the access token payload contains the given scope
 * - CREDENTIALS_FOR_INTERNAL_AUTHORIZATION (optional)
 *   - Secret name from which to get basic auth credentials that should be forwarded to backend
 *     integration if authentication succeeds
 *   - Secret value should follow this format: `{"username":"<username>","password":"<password>"}`
 */
import { SecretsManager } from "@aws-sdk/client-secrets-manager";
import type { CognitoAccessTokenPayload } from "aws-jwt-verify/jwt-model";
import type { APIGatewayRequestAuthorizerEventV2, APIGatewaySimpleAuthorizerResult } from "aws-lambda";
type AuthorizerResult = APIGatewaySimpleAuthorizerResult & {
    /**
     * Returning a context object from our authorizer allows our API Gateway to access these variables
     * via `${context.authorizer.<property>}`.
     * https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html
     */
    context?: {
        /**
         * If the token is verified, we return the auth client ID from the token's claims as a context
         * variable (named `authorizer.clientId`). We use this to include the requesting client in the
         * API Gateway access logs (see `defaultAccessLogFormat` in our `ApiGateway` construct). You can
         * also use this when mapping parameters to the backend integration (see
         * `AlbIntegrationProps.mapParameters` on the `ApiGateway` construct).
         */
        clientId: string;
        /**
         * If `CREDENTIALS_FOR_INTERNAL_AUTHORIZATION` is provided, we want to forward basic auth
         * credentials to our backend, as an additional authentication layer. See the docstring on
         * `CognitoUserPoolAuthorizerProps.basicAuthForInternalAuthorization` in the `ApiGateway`
         * construct for more on this.
         */
        internalAuthorizationHeader?: string;
    };
};
export declare const handler: (event: APIGatewayRequestAuthorizerEventV2) => Promise<AuthorizerResult>;
export type TokenVerifier = {
    verify: (accessToken: string) => Promise<CognitoAccessTokenPayload>;
};
/** For overriding dependency creation in tests. */
export declare const dependencies: {
    createTokenVerifier: () => TokenVerifier;
    createSecretsManager: () => SecretsManager;
};
export declare function clearCache(): void;
export {};