import * as core from 'aws-cdk-lib';
import { aws_cognito as cognito, aws_iam as iam, aws_lambda as lambda } from 'aws-cdk-lib';
import * as constructs from 'constructs';
type AccountTakeoverRiskConfig = cognito.CfnUserPoolRiskConfigurationAttachment.AccountTakeoverRiskConfigurationTypeProperty;
type CompromisedCredentialsRiskConfig = cognito.CfnUserPoolRiskConfigurationAttachment.CompromisedCredentialsRiskConfigurationTypeProperty;
/**
 * Specification for one Cognito app client (e.g. one brand or one front-end).
 * Public SPA clients: no secret, PKCE (authorization-code grant), SRP.
 */
export interface CognitoAppClientSpec {
    /** Logical key used as the construct id and the key in {@link CognitoCustomerPool.userPoolClients}. */
    readonly key: string;
    /** OAuth2 callback URLs for this client (used only by the social/hosted redirect flow). */
    readonly callbackUrls?: string[];
    /** Logout URLs for this client. */
    readonly logoutUrls?: string[];
    /** Identity providers this client supports. @default [COGNITO] */
    readonly supportedIdentityProviders?: cognito.UserPoolClientIdentityProvider[];
    /** Generate a client secret. @default false (public SPA client) */
    readonly generateSecret?: boolean;
}
/**
 * Optional Cognito Identity Pool + ABAC (attributes-for-access-control) config.
 * Maps token claims to principal tags so downstream IAM can scope on them.
 */
export interface CognitoIdentityPoolAbacConfig {
    /** Allow unauthenticated (guest) identities. @default false */
    readonly allowUnauthenticatedIdentities?: boolean;
    /**
     * Claim → principal-tag mapping, e.g. `{ sub: 'customer-id' }`. Applied to the
     * user-pool provider so authenticated sessions carry these as `aws:PrincipalTag/*`.
     */
    readonly principalTags?: Record<string, string>;
    /** Managed policies for the authenticated role. @default none (attach your own). */
    readonly authenticatedRoleManagedPolicies?: iam.IManagedPolicy[];
}
/**
 * Props for {@link CognitoCustomerPool}. Every value is generic — no
 * project/brand/domain specifics are baked in; pass them here.
 */
export interface CognitoCustomerPoolProps {
    /** User pool name. */
    readonly userPoolName?: string;
    /** Cognito hosted-UI domain prefix (globally unique). */
    readonly cognitoDomainPrefix: string;
    /** App clients to create (typically one per brand/front-end). At least one. */
    readonly appClients: CognitoAppClientSpec[];
    /** Enable self-service sign-up. @default false */
    readonly selfSignUpEnabled?: boolean;
    /** MFA enforcement. @default REQUIRED */
    readonly mfa?: cognito.Mfa;
    /** Second factors. @default { otp: true, sms: false } */
    readonly mfaSecondFactor?: cognito.MfaSecondFactor;
    /** Password policy. @default minLength 12, upper/lower/digits/symbols. */
    readonly passwordPolicy?: cognito.PasswordPolicy;
    /** Advanced security mode (threat protection). @default OFF */
    readonly advancedSecurityMode?: cognito.AdvancedSecurityMode;
    /** Standard attributes config. */
    readonly standardAttributes?: cognito.StandardAttributes;
    /** Custom attributes. */
    readonly customAttributes?: {
        [key: string]: cognito.ICustomAttribute;
    };
    /** Enable the CUSTOM_AUTH flow on app clients. @default false */
    readonly enableCustomAuthFlow?: boolean;
    /** Access token validity. @default 1 hour */
    readonly accessTokenValidity?: core.Duration;
    /** ID token validity. @default 1 hour */
    readonly idTokenValidity?: core.Duration;
    /** Refresh token validity. @default 30 days */
    readonly refreshTokenValidity?: core.Duration;
    /** Cognito groups to create. */
    readonly groups?: string[];
    /**
     * Pre-token-generation Lambda (V2). @default a bundled no-op library Lambda is
     * created. Pass your own to customise emitted claims.
     */
    readonly preTokenGenerationLambda?: lambda.IFunction;
    /**
     * L1 account-takeover risk configuration (requires {@link advancedSecurityMode}
     * ENFORCED/AUDIT). Passed through to CfnUserPoolRiskConfigurationAttachment.
     */
    readonly accountTakeoverRiskConfiguration?: AccountTakeoverRiskConfig;
    /** L1 compromised-credentials risk configuration. */
    readonly compromisedCredentialsRiskConfiguration?: CompromisedCredentialsRiskConfig;
    /** Optional identity pool + ABAC configuration. */
    readonly identityPool?: CognitoIdentityPoolAbacConfig;
    /** Removal policy for the pool. @default RETAIN */
    readonly removalPolicy?: core.RemovalPolicy;
}
/**
 * A generic, reusable secure Cognito **customer** user pool for the custom-UI
 * (client-side SRP) authentication pattern: public PKCE app clients, MFA,
 * strong password policy, optional advanced-security threat protection,
 * per-client (per-brand) app clients, and an optional identity pool with ABAC.
 *
 * Provisions ONLY the identity provider. It knows nothing about CloudFront,
 * sessions, or any specific project — pair it with `CognitoSessionBackend`
 * (session substrate) and `CognitoCustomUiAuth` (edge/CDN).
 */
export declare class CognitoCustomerPool extends constructs.Construct {
    readonly userPool: cognito.UserPool;
    /** App clients keyed by {@link CognitoAppClientSpec.key}. */
    readonly userPoolClients: Record<string, cognito.UserPoolClient>;
    /** The first app client, for convenience. */
    readonly userPoolClient: cognito.UserPoolClient;
    readonly userPoolDomain: cognito.UserPoolDomain;
    /** Hosted-UI domain URL, e.g. `<prefix>.auth.<region>.amazoncognito.com`. */
    readonly cognitoDomainUrl: string;
    readonly identityPool?: cognito.CfnIdentityPool;
    readonly authenticatedRole?: iam.Role;
    constructor(scope: constructs.Construct, id: string, props: CognitoCustomerPoolProps);
}
export {};