/**
 * SmartyMeet Dev03 API REST
 * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
 *
 * The version of the OpenAPI document: 1.0.1
 * Contact: developer@smartymeet.com
 *
 * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
 * https://openapi-generator.tech
 * Do not edit the class manually.
 */
import type { TenantSsoAttributesSchemaDomainsInner } from './TenantSsoAttributesSchemaDomainsInner';
/**
 * Enterprise SSO configuration for one tenant. The connection itself is written only by POST /v1/tenants/{tenantId}/sso (sysowner); the policy subset in TenantSsoPolicySchema is also reachable by the tenant's owner through PATCH. The generic tenant PATCH strips settings.sso.
 * @export
 * @interface TenantSsoAttributesSchema
 */
export interface TenantSsoAttributesSchema {
    /**
     * Identity provider family behind the tenant's IdP
     * @type {TenantSsoAttributesSchemaProviderEnum}
     * @memberof TenantSsoAttributesSchema
     */
    provider?: TenantSsoAttributesSchemaProviderEnum;
    /**
     * GUID of the customer's Entra tenant. One Cognito IdP serves exactly one Entra tenant: Cognito compares the token iss to a single configured issuer and Entra mints iss per tenant, so a multi-tenant issuer can never match. NOTE: CreateIdentityProvider accepts a /common issuer without error and only sign-in fails, which is why 'common' is rejected here.
     * @type {string}
     * @memberof TenantSsoAttributesSchema
     */
    entraTenantId?: string;
    /**
     * Derived server-side as ms-{shortCode} and ignored if sent. The name carries the tenant, which is how the auth triggers resolve it without scanning; it must fit Cognito's 32-character IdP name limit.
     * @type {string}
     * @memberof TenantSsoAttributesSchema
     */
    readonly idpName?: string;
    /**
     * Email domains of the customer. A domain gates JIT and auto-link ONLY once it carries verifiedAt - uniqueness in the claim registry is not proof of ownership. Public mail providers (gmail.com and friends) are rejected: a shared domain can never prove its holder employs the person signing in.
     * @type {Array<TenantSsoAttributesSchemaDomainsInner>}
     * @memberof TenantSsoAttributesSchema
     */
    domains?: Array<TenantSsoAttributesSchemaDomainsInner>;
    /**
     * Role granted when a pending JIT user is APPROVED - never granted by the act of signing in. Domain-gated JIT makes the whole customer workforce eligible, so an automatic operational role would expose candidate data to anyone who can authenticate at the customer's IdP. Privileged roles (owner/admin/sysowner) are rejected.
     * @type {string}
     * @memberof TenantSsoAttributesSchema
     */
    defaultRole?: string;
    /**
     * When true, password login is refused for this tenant's users. Owner and sysowner are always exempt - a break-glass account, because an outage in the customer's Entra must not lock them out of the product.
     * @type {boolean}
     * @memberof TenantSsoAttributesSchema
     */
    required?: boolean;
    /**
     * When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default.
     * @type {boolean}
     * @memberof TenantSsoAttributesSchema
     */
    autoApprove?: boolean;
    /**
     * Whether a Cognito identity provider exists for this tenant. Owned by the provisioning step and ignored if sent.
     * @type {boolean}
     * @memberof TenantSsoAttributesSchema
     */
    readonly enabled?: boolean;
    /**
     * The admin-consent link an operator sends to the customer's IT. Built server-side so the app registration id is never hardcoded in a client. Absent if the platform Microsoft provider cannot be read.
     * @type {string}
     * @memberof TenantSsoAttributesSchema
     */
    readonly adminConsentUrl?: string;
    /**
     * POST response, present ONLY on the transition to required=true: how many accounts were signed out everywhere. The PreAuthentication gate stops new password sign-ins but never fires on token refresh, and a refresh token lives 30 days - so without this sweep the switch would take a month to take effect for anyone already signed in. Nobody is exempt, including the break-glass roles: they keep their password and simply sign in again.
     * @type {number}
     * @memberof TenantSsoAttributesSchema
     */
    readonly sessionsRevoked?: number;
    /**
     * POST response, alongside sessionsRevoked: accounts the sweep could not sign out. Non-zero means the door is partially open - those sessions keep working until their refresh token expires - and the operator is the only one positioned to see it, which is why it is returned rather than only logged.
     * @type {number}
     * @memberof TenantSsoAttributesSchema
     */
    readonly sessionsFailed?: number;
    /**
     * DELETE response only: whether the customer's Cognito identity provider was actually removed. False when it was already gone, so a retry of the teardown reads as success rather than an error.
     * @type {boolean}
     * @memberof TenantSsoAttributesSchema
     */
    readonly idpDeleted?: boolean;
    /**
     * DELETE response only: the domains freed in the global claim registry, i.e. the ones another tenant may now claim. Empty when the tenant held none or another tenant owned them.
     * @type {Array<string>}
     * @memberof TenantSsoAttributesSchema
     */
    readonly domainsReleased?: Array<string>;
    /**
     * Ready-made login link for this customer's employees (a tile in their Entra My Apps, an intranet bookmark, the welcome email), of the form https://myaccount.{domain}/sso?idp=ms-{shortCode}. It points at the APP, never at Cognito's authorize endpoint: nextauth refuses a callback it did not initiate, because the state, nonce and PKCE verifier it validates against live in cookies it sets while building the authorize URL itself - a hand-assembled Cognito link fails with 'State cookie was missing' however correct its parameters are. The page forwards idp as identity_provider, which also keeps the enterprise client's hosted page from drawing a button for every customer IdP on it. There is deliberately no email-domain discovery endpoint: Cognito's own domain routing is SAML-only, and a public discovery endpoint would be an oracle for whether a given company is our customer. Lands in the myaccount app, which every role can reach - a JIT employee in the pending state has no role yet, so a role-scoped app would refuse them and the link would look broken. Derived on read, never stored.
     * @type {string}
     * @memberof TenantSsoAttributesSchema
     */
    readonly loginUrl?: string;
}
/**
 * @export
 */
export declare const TenantSsoAttributesSchemaProviderEnum: {
    readonly Microsoft: "microsoft";
};
export type TenantSsoAttributesSchemaProviderEnum = typeof TenantSsoAttributesSchemaProviderEnum[keyof typeof TenantSsoAttributesSchemaProviderEnum];
/**
 * Check if a given object implements the TenantSsoAttributesSchema interface.
 */
export declare function instanceOfTenantSsoAttributesSchema(value: object): value is TenantSsoAttributesSchema;
export declare function TenantSsoAttributesSchemaFromJSON(json: any): TenantSsoAttributesSchema;
export declare function TenantSsoAttributesSchemaFromJSONTyped(json: any, ignoreDiscriminator: boolean): TenantSsoAttributesSchema;
export declare function TenantSsoAttributesSchemaToJSON(json: any): TenantSsoAttributesSchema;
export declare function TenantSsoAttributesSchemaToJSONTyped(value?: Omit<TenantSsoAttributesSchema, 'idpName' | 'enabled' | 'adminConsentUrl' | 'sessionsRevoked' | 'sessionsFailed' | 'idpDeleted' | 'domainsReleased' | 'loginUrl'> | null, ignoreDiscriminator?: boolean): any;
//# sourceMappingURL=TenantSsoAttributesSchema.d.ts.map