import * as core from "@terrascript/core";

export interface AuthorizerArgs extends core.ResourceArgs {
  /**
   * (Optional) The credentials required for the authorizer. To specify an IAM Role for API Gateway to as
   * sume, use the IAM Role ARN.
   */
  authorizerCredentials?: string | core.StringOut;

  /**
   * (Optional) The TTL of cached authorizer results in seconds. Defaults to `300`.
   */
  authorizerResultTtlInSeconds?: number | core.NumberOut;

  /**
   * (Optional, required for type `TOKEN`/`REQUEST`) The authorizer's Uniform Resource Identifier (URI).
   * This must be a well-formed Lambda function URI in the form of `arn:aws:apigateway:{region}:lambda:pa
   * th/{service_api}`,
   */
  authorizerUri?: string | core.StringOut;

  /**
   * (Optional) The source of the identity in an incoming request. Defaults to `method.request.header.Aut
   * horization`. For `REQUEST` type, this may be a comma-separated list of values, including headers, qu
   * ery string parameters and stage variables - e.g., `"method.request.header.SomeHeaderName,method.requ
   * est.querystring.SomeQueryStringName,stageVariables.SomeStageVariableName"`
   */
  identitySource?: string | core.StringOut;

  /**
   * (Optional) A validation expression for the incoming identity. For `TOKEN` type, this value should be
   * a regular expression. The incoming token from the client is matched against this expression, and wi
   * ll proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized
   * response.
   */
  identityValidationExpression?: string | core.StringOut;

  /**
   * (Required) The name of the authorizer
   */
  name: string | core.StringOut;

  /**
   * (Optional, required for type `COGNITO_USER_POOLS`) A list of the Amazon Cognito user pool ARNs. Each
   * element is of this format: `arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}`.
   */
  providerArns?: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required) The ID of the associated REST API
   */
  restApiId: string | core.StringOut;

  /**
   * (Optional) The type of the authorizer. Possible values are `TOKEN` for a Lambda function using a sin
   * gle authorization token submitted in a custom header, `REQUEST` for a Lambda function using incoming
   * request parameters, or `COGNITO_USER_POOLS` for using an Amazon Cognito user pool. Defaults to `TOK
   * EN`.
   */
  type?: string | core.StringOut;
}

export class Authorizer extends core.Resource<AuthorizerArgs> {
  /**
   * Amazon Resource Name (ARN) of the API Gateway Authorizer
   */
  @core.attr(String, { computed: true })
  public arn!: string | core.StringOut;

  /**
   * (Optional) The credentials required for the authorizer. To specify an IAM Role for API Gateway to as
   * sume, use the IAM Role ARN.
   */
  @core.attr(String)
  public authorizerCredentials?: string | core.StringOut;

  /**
   * (Optional) The TTL of cached authorizer results in seconds. Defaults to `300`.
   */
  @core.attr(Number)
  public authorizerResultTtlInSeconds?: number | core.NumberOut;

  /**
   * (Optional, required for type `TOKEN`/`REQUEST`) The authorizer's Uniform Resource Identifier (URI).
   * This must be a well-formed Lambda function URI in the form of `arn:aws:apigateway:{region}:lambda:pa
   * th/{service_api}`,
   */
  @core.attr(String)
  public authorizerUri?: string | core.StringOut;

  /**
   * The Authorizer identifier.
   */
  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Optional) The source of the identity in an incoming request. Defaults to `method.request.header.Aut
   * horization`. For `REQUEST` type, this may be a comma-separated list of values, including headers, qu
   * ery string parameters and stage variables - e.g., `"method.request.header.SomeHeaderName,method.requ
   * est.querystring.SomeQueryStringName,stageVariables.SomeStageVariableName"`
   */
  @core.attr(String)
  public identitySource?: string | core.StringOut;

  /**
   * (Optional) A validation expression for the incoming identity. For `TOKEN` type, this value should be
   * a regular expression. The incoming token from the client is matched against this expression, and wi
   * ll proceed if the token matches. If the token doesn't match, the client receives a 401 Unauthorized
   * response.
   */
  @core.attr(String)
  public identityValidationExpression?: string | core.StringOut;

  /**
   * (Required) The name of the authorizer
   */
  @core.attr(String)
  public name!: string | core.StringOut;

  /**
   * (Optional, required for type `COGNITO_USER_POOLS`) A list of the Amazon Cognito user pool ARNs. Each
   * element is of this format: `arn:aws:cognito-idp:{region}:{account_id}:userpool/{user_pool_id}`.
   */
  @core.attr(String, { kind: "array" })
  public providerArns?: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required) The ID of the associated REST API
   */
  @core.attr(String)
  public restApiId!: string | core.StringOut;

  /**
   * (Optional) The type of the authorizer. Possible values are `TOKEN` for a Lambda function using a sin
   * gle authorization token submitted in a custom header, `REQUEST` for a Lambda function using incoming
   * request parameters, or `COGNITO_USER_POOLS` for using an Amazon Cognito user pool. Defaults to `TOK
   * EN`.
   */
  @core.attr(String)
  public type?: string | core.StringOut;

  constructor(name: string, args?: AuthorizerArgs) {
    super(name, "aws_api_gateway_authorizer", args);
  }

  public override getNamespace(): string {
    return "aws_api_gateway";
  }
}