import logger from 'lambda-log';
/**
 * A generic JWT authorizer base class, presupposing the presence of an issuer, a number of authorization claims, an
 * admin permission claim and optionally a separate URL to a JWKS to use if the issuers well-known URL does not
 * point to it in its metadata.
 */
export declare abstract class JwtAuthorizer {
    protected issuerUrl: string;
    protected groupClaim: string;
    protected adminClaim: string;
    protected jwksUrl?: string | undefined;
    /**
     * The claims of the authenticated user.
     */
    protected claims?: {
        [name: string]: string | number | boolean | string[];
    };
    protected constructor(issuerUrl: string, groupClaim: string, adminClaim: string, jwksUrl?: string | undefined);
    /**
     * Returns an array of groups the user belongs to, or an empty array if the user
     * is not authenticated or has no groups.
     */
    getGroups(): string[];
    /**
     * Returns true if the user belongs to the specified group, false otherwise.
     * @param group The name of the group to check.
     */
    hasGroup(group: string): boolean;
    /**
     * Authenticates the user and sets the claims.
     */
    abstract authenticate(): Promise<void>;
    /**
     * Returns true if the user is authenticated, false otherwise.
     */
    isAuthenticated(): boolean;
    /**
     * Throws an UnauthenticatedError if the user is not authenticated.
     */
    assertAuthenticated(): void;
    /**
     * Throws a ForbiddenError if the user is not authenticated or does not belong
     * to the specified group.
     * @param group The name of the group to check.
     */
    assertGroup(group: string): void;
    /**
     * Returns true if the user belongs to the 'admin' group, false otherwise.
     */
    isAdmin(): boolean;
    /**
     * Throws a ForbiddenError if the user is not authenticated or is not an admin.
     */
    assertAdmin(): void;
    /**
     * Returns the email of the authenticated user.
     */
    getEMail(): string;
    /**
     * Returns the subject of the authenticated user.
     */
    getSubject(): string;
    /**
     * Returns the value of the claim with the specified name, or undefined if the
     * claim does not exist.
     * @param name The name of the claim to retrieve.
     */
    getClaim(name: string): string | number | boolean | string[] | undefined;
}
/**
 * CognitoAuthorizer is an abstract class representing an authorizer
 * that can be used to authenticate and authorize a user through Cognito.
 */
export declare abstract class CognitoAuthorizer extends JwtAuthorizer {
    protected constructor();
}
/**
 * Implements authorization on API Gateway v1 (Rest API) using JWT.
 */
export declare class ApiGatewayv1JwtAuthorizer extends JwtAuthorizer {
    protected event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent;
    protected _logger: logger.LambdaLog;
    constructor(event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent, //FIXME: Learn about possible requestContext.authorizer sources in API gateway
    adminClaim: string, _logger: logger.LambdaLog);
    /**
     * Authenticates the user using the claims provided by the API Gateway event or
     * by decoding a JWT token from the 'Authorization' header.
     */
    authenticate(): Promise<void>;
}
/**
 * Implements JWT Authorization on API Gateway v2 (HTTP API).
 */
export declare class ApiGatewayv2JwtAuthorizer extends JwtAuthorizer {
    protected event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer;
    protected _logger: logger.LambdaLog;
    constructor(event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer, _logger: logger.LambdaLog);
    /**
     * Authenticates the user using the claims provided by the API Gateway event or
     * by decoding a JWT token from the 'Authorization' header.
     */
    authenticate(): Promise<void>;
}
/**
 * ApiGatewayv1CognitoAuthorizer is a specialization of an ApiGatewayv1JwtAuthorizer
 * and implements authentication logic for API Gateway v1 requests when using Cognito..
 */
export declare class ApiGatewayv1CognitoAuthorizer extends ApiGatewayv1JwtAuthorizer {
    protected event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent;
    protected _logger: logger.LambdaLog;
    /**
     * The event that triggered the authorization check.
     */
    constructor(event: AWSLambda.APIGatewayProxyWithCognitoAuthorizerEvent, _logger: logger.LambdaLog);
}
/**
 * ApiGatewayv2CognitoAuthorizer is a class that extends CognitoAuthorizer
 * and implements authentication logic for API Gateway v2 requests with a
 * JWT authorizer.
 */
export declare class ApiGatewayv2CognitoAuthorizer extends ApiGatewayv2JwtAuthorizer {
    protected event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer;
    protected _logger: logger.LambdaLog;
    /**
     * The event that triggered the authorization check.
     */
    constructor(event: AWSLambda.APIGatewayProxyEventV2WithJWTAuthorizer, _logger: logger.LambdaLog);
}
/**
 * AppSyncCognitoAuthorizer is a class that extends CognitoAuthorizer
 * and implements authentication logic for AppSync resolver events with a
 * Cognito authorizer.
 */
export declare class AppSyncCognitoAuthorizer extends CognitoAuthorizer {
    protected event: AWSLambda.AppSyncResolverEvent<any>;
    /**
     * The event that triggered the authorization check.
     */
    constructor(event: AWSLambda.AppSyncResolverEvent<any>);
    /**
     * Authenticates the user using the claims provided by the AppSync event.
     */
    authenticate(): Promise<void>;
}