import { Construct } from 'constructs';
import { RemovalPolicy } from 'aws-cdk-lib';
import { IRole, PolicyStatement } from 'aws-cdk-lib/aws-iam';
import { CfnIdentityPool, CfnUserPoolDomain, CfnUserPoolGroup, CfnIdentityPoolProps, UserPoolProps, UserPoolClientProps, IUserPool, IUserPoolClient, CfnUserPoolUser } from 'aws-cdk-lib/aws-cognito';
interface GroupConfig {
    /**
     * The name of the group
     */
    groupName: string;
    /**
     * LogicalId for the RestApi resource for in-place upgrades. For more
     * info, see [Naming](https://full-stack-pattern.matthewkeil.com/docs/naming)
     */
    logicalId?: string;
    /**
     * Prevents IAM from being created
     */
    noIam?: boolean;
    /**
     * Can pass in a IRole or role arn to use for the group Role
     */
    role?: IRole | string;
    /**
     * PolicyStatements to add to the group role
     */
    policyStatements?: PolicyStatement[];
    /**
     * For each userEmail, will add a user to the UserPool and attach the user
     * to the group
     */
    userEmails?: string[];
}
declare type IdentityPoolConfig = CfnIdentityPoolProps & {
    removalPolicy?: RemovalPolicy;
};
interface WithLogicalId {
    logicalId?: string;
}
interface UserPoolDomainProps extends WithLogicalId {
    /**
     * The root domain to use for the UserPoolDomain
     * @example 'example.com'
     */
    rootDomain?: string;
    /**
     * The subDomain to user for the UserPoolDomain. Does one of two things.
     *
     * 1) When not using a customDomain this is the prefix for the url that
     * gets assigned by cognito.  Usually in the format of:
     * `https://${subDomain}.auth.${region}.amazoncognito.com`
     *
     * 2) Optionally, when using a custom rootDomain, this is the subDomain
     * that you want to host the login page at. default is 'auth'
     * ex. `auth.example.com` and `dev.auth.example.com`
     */
    subDomain?: string;
    /**
     * The stage of the website that is being hosted. ex. Using `qa` as the
     * stage will host the site at the sub-domain `qa.example.com`.  This also
     * applies to the login page that is hosted by cognito when using your
     * own domain.  Auth will be hosted at `auth.example.com` for prod and
     * `qa.auth.example.com` for qa.
     *
     * @default 'prod'
     */
    stage?: string;
    /**
     * ACM Certificate to use for the UserPoolDomain TLS/SSL
     */
    certificateArn?: string;
}
export interface CognitoConstructProps {
    /**
     * The prefix to use with resource names. If `prefix` and `name` are
     * provided then the apiName will be `${prefix}-${name}`.  If no name
     * is provided then the apiName will be `prefix`. For more info, see
     * [Naming](https://full-stack-pattern.matthewkeil.com/docs/naming)
     */
    prefix?: string;
    /**
     * Option to not use fixed logicalId's for the RestApi resource. For more
     * info, see [Naming](https://full-stack-pattern.matthewkeil.com/docs/naming)
     */
    dontOverrideLogicalId?: boolean;
    /**
     * Will reuse an existing UserPool by passing in the `userPoolId`.  Will
     * ignore the `userPool` prop when using an existing UserPool
     */
    userPoolId?: string;
    /**
     * Full configuration of the UserPool that will be created in addition
     * to having control over the logicalId
     */
    userPool?: UserPoolProps & WithLogicalId;
    /**
     * Will reuse an existing UserPoolClient by passing in the `userPoolClientId`
     * Will ignore the `userPoolClient` prop when using an existing UserPoolClient
     */
    userPoolClientId?: string;
    /**
     * Full configuration of the UserPoolClient that will be created in addition
     * to having control over the logicalId
     */
    userPoolClient?: Omit<UserPoolClientProps, 'userPool'> & WithLogicalId;
    /**
     * Full configuration of the UserPoolDomain that will be created
     */
    userPoolDomain?: UserPoolDomainProps;
    /**
     * Full configuration of the IdentityPool that will be created in addition
     * to having control over the logicalId
     */
    identityPool?: IdentityPoolConfig & WithLogicalId;
    /**
     * Takes an IRole or an arn instead of building an AuthenticatedRole when
     * an IdentityPool is created.  If IdentityPool is not created, this will
     * trigger the creation of one and associate this role
     */
    authenticatedRole?: IRole | string;
    /**
     * PolicyStatements to attach when building an AuthenticatedRole. If an
     * authenticatedRole is not provided, one will be created.  If the
     * IdentityPool is not created, this will trigger the creation of one and
     * associate the authenticatedRole
     */
    authenticatedPolicyStatements?: PolicyStatement[];
    /**
     * Create groups for the user pool and, optionally, the identity pool
     */
    groups?: GroupConfig[];
    /**
     * Will provision the users in the UserPool.  Sets userEmail as the username
     * and optionally attaches the user to any number of groups
     */
    users?: {
        userEmail: string;
        groupNames: string[];
    }[];
    /**
     * CSS string to be used for the user pool UI customization.
     * For more info see [Cognito UI Customizations](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpooluicustomizationattachment.html#cfn-cognito-userpooluicustomizationattachment-css)
     */
    css?: string;
    /**
     * RemovalPolicy to apply to all resources.  If a RemovalPolicy prop is provided
     * for a specific resource, ie the `props.userPool.removalPolicy`, it will
     * override this value
     */
    removalPolicy?: RemovalPolicy;
}
export declare class CognitoConstruct extends Construct {
    private props;
    userPool: IUserPool;
    userPoolClient: IUserPoolClient;
    userPoolDomain?: CfnUserPoolDomain;
    identityPool?: CfnIdentityPool;
    authenticatedRole?: IRole;
    groups?: {
        [groupName: string]: {
            group: CfnUserPoolGroup;
            role?: IRole;
        };
    };
    constructor(scope: Construct, id: string, props: CognitoConstructProps);
    private buildUserPool;
    private buildRole;
    private buildIdentityPool;
    private addUserToGroup;
    addUser({ userEmail, groupNames }: {
        userEmail: string;
        groupNames?: string[];
    }): CfnUserPoolUser;
    addGroup({ groupName, logicalId, policyStatements, role, noIam, userEmails }: GroupConfig): void;
}
export {};