/**
 * Shared types for Okta integration.
 */
import type { EEUser, RoleMapping } from './_types/@internal_auth/dist/ee/index.d.ts';
import type { JWTPayload } from 'jose';
/**
 * Extended EEUser with Okta-specific fields.
 */
export interface OktaUser extends EEUser {
    /** Okta user ID */
    oktaId: string;
    /** User's Okta groups (if fetched) */
    groups?: string[];
}
/**
 * Maps Okta JWT claims to OktaUser format.
 *
 * @param payload - JWT payload from Okta token
 * @returns OktaUser object
 */
export declare function mapOktaClaimsToUser(payload: JWTPayload): OktaUser;
/**
 * Session configuration options for MastraAuthOkta.
 */
export interface OktaSessionOptions {
    /** Cookie name (default: 'okta_session') */
    cookieName?: string;
    /** Cookie max age in seconds (default: 86400 = 24 hours) */
    cookieMaxAge?: number;
    /**
     * Password for encrypting session cookies.
     * Must be at least 32 characters.
     * Defaults to OKTA_COOKIE_PASSWORD env var.
     */
    cookiePassword?: string;
    /**
     * Set the Secure flag on session cookies.
     * Defaults to true when NODE_ENV=production, false otherwise.
     */
    secureCookies?: boolean;
}
/**
 * Options for MastraAuthOkta.
 */
export interface MastraAuthOktaOptions {
    /** Okta domain (e.g., 'dev-123456.okta.com'). Defaults to OKTA_DOMAIN env var. */
    domain?: string;
    /** Okta OAuth client ID. Defaults to OKTA_CLIENT_ID env var. */
    clientId?: string;
    /** Okta OAuth client secret. Defaults to OKTA_CLIENT_SECRET env var. Required for SSO. */
    clientSecret?: string;
    /**
     * Token issuer URL.
     * Defaults to OKTA_ISSUER env var or `https://{domain}/oauth2/default`.
     */
    issuer?: string;
    /**
     * OAuth redirect URI for SSO callback.
     * Defaults to OKTA_REDIRECT_URI env var.
     */
    redirectUri?: string;
    /**
     * Expected `aud` claim when verifying bearer tokens.
     * Defaults to OKTA_AUDIENCE env var, then to the client ID (the ID-token audience).
     *
     * Set this to accept Okta access tokens:
     * - org authorization server: `https://{domain}`
     * - custom authorization server: the configured audience, e.g. `api://default`
     *
     * Pass an array to accept more than one, e.g. ID tokens from the browser and
     * access tokens from service callers against the same provider.
     */
    audience?: string | string[];
    /**
     * OAuth scopes to request.
     * Default: ['openid', 'profile', 'email', 'groups']
     */
    scopes?: string[];
    /**
     * Okta API token for user lookups via the Users API.
     * Required for getUser() to return user data by ID.
     * Defaults to OKTA_API_TOKEN env var.
     */
    apiToken?: string;
    /** Session configuration */
    session?: OktaSessionOptions;
    /** Custom provider name (default: 'okta') */
    name?: string;
}
/**
 * Cache configuration options for RBAC permission caching.
 */
export interface PermissionCacheOptions {
    /** Maximum number of users to cache (default: 1000) */
    maxSize?: number;
    /** Time-to-live in milliseconds (default: 60000) */
    ttlMs?: number;
}
/**
 * Options for MastraRBACOkta.
 */
export interface MastraRBACOktaOptions {
    /** Okta domain (e.g., 'dev-123456.okta.com'). Defaults to OKTA_DOMAIN env var. */
    domain?: string;
    /** Okta API token for management SDK. Defaults to OKTA_API_TOKEN env var. */
    apiToken?: string;
    /**
     * Map Okta groups to Mastra permissions.
     *
     * @example
     * ```typescript
     * roleMapping: {
     *   'Engineering': ['agents:*', 'workflows:*'],
     *   'Admin': ['*'],
     *   'Viewer': ['agents:read', 'workflows:read'],
     *   '_default': [],
     * }
     * ```
     */
    roleMapping: RoleMapping;
    /**
     * Function to extract Okta user ID from any user object.
     * Use this when using a different auth provider (e.g., Auth0) with Okta RBAC.
     *
     * @example
     * ```typescript
     * getUserId: (user) => user.metadata?.oktaUserId || user.email
     * ```
     */
    getUserId?: (user: unknown) => string | undefined;
    /** Permission cache configuration */
    cache?: PermissionCacheOptions;
}
//# sourceMappingURL=types.d.ts.map