/**
 * This lambda verifies credentials:
 * - Against Cognito user pool if request uses access token in Bearer authorization header
 * - Against credentials saved in Secret Manager if request uses basic auth (and if secret exists)
 *
 * Expects the following environment variables:
 * - USER_POOL_ID
 * - BASIC_AUTH_CREDENTIALS_SECRET_NAME (optional)
 *   - Name of secret in AWS Secrets Manager that stores basic auth credentials. See
 *     `BasicAuthAuthorizerProps` on the `ApiGateway` construct for the supported formats.
 * - REQUIRED_SCOPE (optional)
 *   - Set this to require that the access token payload contains the given scope
 */
import { SecretsManager } from "@aws-sdk/client-secrets-manager";
import type { CognitoAccessTokenPayload } from "aws-jwt-verify/jwt-model";
import type { APIGatewayRequestAuthorizerEventV2, APIGatewaySimpleAuthorizerResult } from "aws-lambda";
type AuthorizerResult = APIGatewaySimpleAuthorizerResult & {
    /**
     * Returning a context object from our authorizer allows our API Gateway to access these variables
     * via `${context.authorizer.<property>}`.
     * https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-parameter-mapping.html
     */
    context?: {
        /**
         * If the request used an access token, and the token was verified, we return the auth client ID
         * from the token's claims in this context variable (named `authorizer.clientId`). We use this
         * to include the requesting client in the API Gateway access logs (see `defaultAccessLogFormat`
         * in our `ApiGateway` construct). You can also use this when mapping parameters to the backend
         * integration (see `AlbIntegrationProps.mapParameters` on the `ApiGateway` construct).
         */
        clientId?: string;
        /**
         * If the request used Basic Auth, and the credentials were verified, we return the username
         * that was used in this context variable (named `authorizer.username`). We use this to include
         * the requesting user in the API Gateway access logs (see `defaultAccessLogFormat` in our
         * `ApiGateway` construct). You can also use this when mapping parameters to the backend
         * integration (see `AlbIntegrationProps.mapParameters` on the `ApiGateway` construct).
         */
        username?: string;
        /**
         * See `CognitoUserPoolAuthorizerProps.basicAuthForInternalAuthorization` on the `ApiGateway`
         * construct (we provide the same context variable here as in the Cognito User Pool authorizer,
         * using the credentials from BASIC_AUTH_CREDENTIALS_SECRET_NAME).
         */
        internalAuthorizationHeader?: string;
    };
};
export declare const handler: (event: APIGatewayRequestAuthorizerEventV2) => Promise<AuthorizerResult>;
export type TokenVerifier = {
    verify: (accessToken: string) => Promise<CognitoAccessTokenPayload>;
};
/** For overriding dependency creation in tests. */
export declare const dependencies: {
    createTokenVerifier: () => TokenVerifier;
    createSecretsManager: () => SecretsManager;
};
export declare function clearCache(): void;
export {};