/**
 * MastraAuthOkta - Okta authentication provider for Mastra with SSO support.
 *
 * Supports OAuth 2.0 / OIDC login flow with client_secret and session management.
 */
import type { ISSOProvider, ISessionProvider, IUserProvider, MastraAuthRequest, Session, SSOCallbackResult, SSOLoginConfig } from './_types/@internal_auth/dist/index.d.ts';
import { MastraAuthProvider } from './_types/@internal_auth/dist/provider/index.d.ts';
import type { OktaUser, MastraAuthOktaOptions } from './types.js';
/**
 * Mastra authentication provider for Okta with SSO support.
 *
 * Implements OAuth 2.0 / OIDC login flow with encrypted session cookies.
 *
 * @example Basic usage with SSO
 * ```typescript
 * import { MastraAuthOkta } from '@mastra/auth-okta';
 *
 * const auth = new MastraAuthOkta({
 *   domain: 'dev-123456.okta.com',
 *   clientId: 'your-client-id',
 *   clientSecret: 'your-client-secret',
 *   redirectUri: 'http://localhost:4111/api/auth/callback',
 * });
 * ```
 */
export declare class MastraAuthOkta extends MastraAuthProvider<OktaUser> implements ISSOProvider<OktaUser>, ISessionProvider<Session>, IUserProvider<OktaUser> {
    protected domain: string;
    protected clientId: string;
    protected clientSecret: string;
    protected issuer: string;
    protected endpointBase: string;
    protected redirectUri: string;
    protected audience: string | string[];
    protected scopes: string[];
    protected cookieName: string;
    protected cookieMaxAge: number;
    protected cookiePassword: string;
    protected secureCookies: boolean;
    protected apiToken?: string;
    private jwks;
    constructor(options?: MastraAuthOktaOptions);
    /**
     * Authenticate a token from the request.
     * First tries to read from session cookie, then falls back to Authorization header.
     */
    authenticateToken(token: string, request: MastraAuthRequest): Promise<OktaUser | null>;
    /**
     * Authorize a user.
     */
    authorizeUser(user: OktaUser, _request: MastraAuthRequest): boolean;
    /**
     * Get the current user from the request session.
     */
    getCurrentUser(request: Request): Promise<OktaUser | null>;
    /**
     * Get a user by ID via the Okta Users API.
     * Requires an API token (set OKTA_API_TOKEN or pass apiToken in options).
     * Returns null if no API token is configured or user is not found.
     */
    getUser(userId: string): Promise<OktaUser | null>;
    /**
     * Get user from session cookie.
     */
    private getUserFromSession;
    /**
     * Extract the raw ID token from the encrypted session cookie.
     * Used to provide id_token_hint for Okta logout.
     */
    private getIdTokenFromSession;
    /**
     * Get the URL to redirect users to for Okta login.
     * Uses client_secret authentication (no PKCE) since this is a confidential client.
     */
    getLoginUrl(redirectUri: string, state: string): string;
    /**
     * Handle the OAuth callback from Okta.
     * Note: The server passes only the stateId (UUID part), not the full state.
     */
    handleCallback(code: string, stateId: string): Promise<SSOCallbackResult<OktaUser>>;
    /**
     * Get the URL to redirect users to for logout.
     * Includes id_token_hint from session when available (required by Okta).
     */
    getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null>;
    /**
     * Get cookies to set during login.
     */
    getLoginCookies(_state: string): string[];
    /**
     * Get the configuration for rendering the login button.
     */
    getLoginButtonConfig(): SSOLoginConfig;
    createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session>;
    validateSession(_sessionId: string): Promise<Session | null>;
    destroySession(_sessionId: string): Promise<void>;
    refreshSession(_sessionId: string): Promise<Session | null>;
    getSessionIdFromRequest(_request: Request): string | null;
    getSessionHeaders(_session: Session): Record<string, string>;
    getClearSessionHeaders(): Record<string, string>;
    /**
     * Build consistent cookie attribute string for set/clear operations.
     */
    private cookieFlags;
    /**
     * Get the Okta domain.
     */
    getDomain(): string;
    /**
     * Get the configured client ID.
     */
    getClientId(): string;
    /**
     * Get the configured redirect URI.
     */
    getRedirectUri(): string;
    /**
     * Get the issuer URL.
     */
    getIssuer(): string;
}
//# sourceMappingURL=auth-provider.d.ts.map