/**
 * Okta RBAC provider for Mastra.
 *
 * Maps Okta groups to Mastra permissions using a configurable role mapping.
 * Can be used with any auth provider (Auth0, Clerk, etc.) or with MastraAuthOkta.
 */
import type { IRBACProvider, RoleMapping } from './_types/@internal_auth/dist/ee/index.d.ts';
import type { OktaUser, MastraRBACOktaOptions } from './types.js';
/**
 * Okta RBAC provider that maps Okta groups to Mastra permissions.
 *
 * This provider fetches user groups from Okta and translates them into
 * Mastra permissions using a configurable role mapping.
 *
 * @example Basic usage with Okta auth
 * ```typescript
 * import { MastraAuthOkta, MastraRBACOkta } from '@mastra/auth-okta';
 *
 * const mastra = new Mastra({
 *   server: {
 *     auth: new MastraAuthOkta(),
 *     rbac: new MastraRBACOkta({
 *       roleMapping: {
 *         'Engineering': ['agents:*', 'workflows:*'],
 *         'Admin': ['*'],
 *         '_default': [],
 *       },
 *     }),
 *   },
 * });
 * ```
 *
 * @example Cross-provider usage (Auth0 + Okta RBAC)
 * ```typescript
 * import { MastraAuthAuth0 } from '@mastra/auth-auth0';
 * import { MastraRBACOkta } from '@mastra/auth-okta';
 *
 * const mastra = new Mastra({
 *   server: {
 *     auth: new MastraAuthAuth0(),
 *     rbac: new MastraRBACOkta({
 *       getUserId: (user) => user.metadata?.oktaUserId || user.email,
 *       roleMapping: {
 *         'Engineering': ['agents:*', 'workflows:*'],
 *         'Admin': ['*'],
 *         '_default': [],
 *       },
 *     }),
 *   },
 * });
 * ```
 */
export declare class MastraRBACOkta implements IRBACProvider<OktaUser> {
    private oktaClient;
    private options;
    /**
     * Single cache for roles (the expensive Okta API call).
     * Permissions are derived from roles on-the-fly (cheap, synchronous).
     * Storing promises handles concurrent request deduplication.
     */
    private rolesCache;
    /**
     * Expose roleMapping for middleware access.
     * This allows the authorization middleware to resolve permissions
     * without needing to call the async methods.
     */
    get roleMapping(): RoleMapping;
    /**
     * Create a new Okta RBAC provider.
     *
     * @param options - RBAC configuration options
     */
    constructor(options: MastraRBACOktaOptions);
    /**
     * Get all roles (groups) for a user from Okta.
     *
     * If the user object already has groups attached, uses those.
     * Otherwise, fetches groups from Okta API and caches the result.
     *
     * @param user - User to get roles for
     * @returns Array of group names
     */
    getRoles(user: OktaUser): Promise<string[]>;
    /**
     * Resolve the Okta user ID from the user object.
     * Uses custom getUserId function if provided, otherwise falls back to oktaId or id.
     */
    private resolveUserId;
    /**
     * Fetch groups from Okta API.
     * Errors propagate to the caller so the cache eviction in getRoles() works.
     */
    private fetchGroupsFromOkta;
    /**
     * Check if a user has a specific role (group).
     *
     * @param user - User to check
     * @param role - Group name to check for
     * @returns True if user has the group
     */
    hasRole(user: OktaUser, role: string): Promise<boolean>;
    /**
     * Get all permissions for a user by mapping their Okta groups.
     *
     * @param user - User to get permissions for
     * @returns Array of permission strings
     */
    getPermissions(user: OktaUser): Promise<string[]>;
    /**
     * Check if a user has a specific permission.
     *
     * @param user - User to check
     * @param permission - Permission to check for (supports wildcards)
     * @returns True if user has the permission
     */
    hasPermission(user: OktaUser, permission: string): Promise<boolean>;
    /**
     * Check if a user has ALL of the specified permissions.
     *
     * @param user - User to check
     * @param permissions - Permissions to check for
     * @returns True if user has all permissions
     */
    hasAllPermissions(user: OktaUser, permissions: string[]): Promise<boolean>;
    /**
     * Check if a user has ANY of the specified permissions.
     *
     * @param user - User to check
     * @param permissions - Permissions to check for
     * @returns True if user has at least one permission
     */
    hasAnyPermission(user: OktaUser, permissions: string[]): Promise<boolean>;
}
//# sourceMappingURL=rbac-provider.d.ts.map