import * as core from 'aws-cdk-lib';
import { aws_cloudfront as cloudfront, aws_secretsmanager as secretsmanager, aws_kms as kms, aws_iam as iam, aws_s3 as s3 } from 'aws-cdk-lib';
import * as constructs from 'constructs';
import { AuthSecurityTable } from '../authSecurityTable';
export declare enum Extension {
    REQUIRE_AUTH = "REQUIRE_AUTH",
    REQUIRE_TLS_13 = "REQUIRE_TLS_13",
    REWRITE_TO_INDEX_HTML = "REWRITE_TO_INDEX_HTML"
}
export declare enum RoleMatchMode {
    OR = "OR",
    AND = "AND"
}
export interface ExtensionConfig<TRole extends string = string> {
    readonly requiredRoles?: readonly TRole[];
    readonly roleMatchMode?: RoleMatchMode;
}
export interface AddBehaviorOptions<TRole extends string = string> {
    readonly extensions?: Extension[];
    readonly extensionConfig?: ExtensionConfig<TRole>;
    readonly behaviorOptions?: Omit<cloudfront.BehaviorOptions, 'origin'>;
}
export interface CloudFrontWithAzureAuthSplitProps<TRole extends string = string> {
    readonly defaultBehavior: Omit<cloudfront.BehaviorOptions, 'functionAssociations'>;
    readonly additionalBehaviors?: Record<string, Omit<cloudfront.BehaviorOptions, 'edgeLambdas'>>;
    readonly domainNames: string[];
    readonly certificate: any;
    readonly redirectUri?: string;
    readonly cookieDomain?: string;
    readonly webAclId?: string;
    readonly hmacSecretRotationSchedule?: core.Duration;
    readonly securityAlertsTopicArn?: string;
    readonly sessionRevocationTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    readonly auditLogRetentionDays?: number;
    readonly auditArchiveRetentionDays?: number;
    readonly authSsmParamPrefix: string;
    readonly authRegion: string;
    readonly createOAuthCallback?: boolean;
    readonly defaultExtensions?: Extension[];
    readonly defaultExtensionConfig?: ExtensionConfig<TRole>;
    readonly defaultRootObject?: string;
    readonly errorResponsePagePath?: string;
    /** Whether to add custom error responses (SPA routing). Defaults to false. */
    readonly enableErrorResponses?: boolean;
    readonly enableUserInfoInjection?: boolean;
    readonly userInfoNameFields?: string[];
    /** Enable CloudFront standard access logging. @default false */
    readonly enableAccessLogging?: boolean;
    /** S3 bucket for access logs. If not provided, a bucket will be created. @default auto-created bucket */
    readonly accessLogBucket?: s3.IBucket;
    /** Prefix for access log files. @default 'cdn-logs/' */
    readonly accessLogPrefix?: string;
    /** Number of days before access logs transition to Infrequent Access. @default 30 */
    readonly accessLogTransitionDays?: number;
    /** Number of days before access logs are deleted. @default 365 */
    readonly accessLogExpirationDays?: number;
    /** Require MFA (amr claim must contain 'mfa'). Defence in depth — primary enforcement should be via Entra Conditional Access. @default false */
    readonly requireMfa?: boolean;
}
export declare class SecuredCloudFront<TRole extends string = string> extends constructs.Construct {
    readonly distribution: cloudfront.Distribution;
    readonly configSecret: secretsmanager.ISecret;
    readonly secretArn: string;
    readonly kmsKey: kms.IKey;
    readonly authSecurityTable: AuthSecurityTable;
    readonly auditLogArchive: any;
    readonly lambdaEdgeRole: iam.Role;
    readonly accessLogBucket?: s3.IBucket;
    private readonly authCheckFunction;
    private readonly userInfoFunction?;
    private readonly functionComposer;
    private readonly composedFunctions;
    private lastCreatedFunction;
    private readonly tlsOriginRequestPolicy;
    private readonly tenantId;
    private readonly clientId;
    private readonly redirectUri;
    private readonly cookieDomain;
    private readonly kvs;
    private readonly requireMfa;
    constructor(scope: constructs.Construct, id: string, props: CloudFrontWithAzureAuthSplitProps<TRole>);
    addBehavior(pathPattern: string, origin: cloudfront.IOrigin, options?: AddBehaviorOptions<TRole> | cloudfront.BehaviorOptions, applyAuth?: boolean): void;
    private buildFunctionAssociations;
    private generateFunctionCacheKey;
    private generateFunctionId;
    private determineRedirectUri;
    private loadAndReplaceAuthCheckCode;
    private loadAndReplaceUserInfoCode;
}