import * as core from 'aws-cdk-lib';
import { aws_iam as iam } from 'aws-cdk-lib';
import * as constructs from 'constructs';
export interface AppSpec {
    readonly name: string;
    readonly groups?: string[];
}
export interface AuthInfrastructureProps {
    readonly ssmParamPrefix?: string;
    readonly zoneName: string;
    /** Domains permitted as the request host during OAuth callback (e.g. subdomains served by the distribution). @default [zoneName] */
    readonly allowedDomains?: string[];
    readonly tenantId: string;
    readonly clientId: string;
    readonly oauth2CallbackRoleName: string;
    readonly appSpec: AppSpec;
    readonly cookieDomain?: string;
    readonly securityAlertsTopicArn?: string;
    readonly sessionRevocationTopicArn?: string;
    readonly autoRevokeOnReuse?: boolean;
    readonly jwtClaimsWhitelist?: string[];
    readonly hmacSecretRotationSchedule?: core.Duration;
    readonly auditLogRetentionDays?: number;
    readonly auditArchiveRetentionDays?: number;
    readonly auditLogBucketName?: string;
    readonly auditLogDatabaseName?: string;
    /** ARN of an existing OIDC provider to reuse (skips creating a new one). Use when the same tenant already has a provider in this account. */
    readonly existingOidcProviderArn?: string;
    readonly removalPolicy?: core.RemovalPolicy;
    /** URL for the post-auth identity hook. @default undefined */
    readonly postAuthHookUrl?: string;
    /** Timeout in seconds for the post-auth hook. @default 3 */
    readonly postAuthHookTimeout?: number;
    /** Fail closed if hook is unavailable. @default true */
    readonly postAuthHookFailClosed?: boolean;
    /** SigV4-sign the post-auth hook (service `lambda`) so it can be an IAM-gated Function URL. @default false */
    readonly postAuthHookSigv4?: boolean;
    /** Region to SigV4-sign the post-auth hook for. @default web-identity key region / ambient */
    readonly postAuthHookRegion?: string;
    /** Enable refresh token storage. @default false */
    readonly enableRefresh?: boolean;
    /**
     * Ceiling (bytes) on the assembled HMAC session token. Over this, the mint is
     * REFUSED (explicit error, logged) — never truncated, never with resolver
     * role claims or scope principal tags dropped to fit. Mirrors the Cognito
     * session backend's `scopeTokenMaxBytes`.
     * @default 7168 (within the ~8 KB browser cookie budget)
     */
    readonly scopeTokenMaxBytes?: number;
    /**
     * Enable the RS256 **web-identity token** half of the two-token model. When
     * true: an asymmetric KMS signing key is created, the mint also issues a
     * horton-signed RS256 JWT (for `sts:AssumeRoleWithWebIdentity`) carrying the
     * principal-tags brand claim, a JWKS is served at {@link jwksPath}, and a
     * second IAM OIDC provider is created whose url is {@link webIdentityIssuer}
     * (NOT Entra) — exposed as {@link webIdentityOidcProviderArn} so role trust
     * policies can pin it. Default OFF: no new key, no second token, no provider.
     * @default false
     */
    readonly enableWebIdentityToken?: boolean;
    /**
     * Issuer (`iss`/`aud`) for the RS256 web-identity token and the url of its
     * OIDC provider. Also the JWKS-hosting origin. Required when
     * {@link enableWebIdentityToken} is true, e.g. `https://admin.example.com`.
     */
    readonly webIdentityIssuer?: string;
    /**
     * Path the JWKS (the web-identity key's public half) is served at.
     * @default '/.well-known/jwks.json'
     */
    readonly jwksPath?: string;
}
export declare class AuthInfrastructure extends constructs.Construct {
    readonly configSecretArn: string;
    readonly kmsKeyArn: string;
    readonly authTableArn: string;
    readonly kvsArn: string;
    readonly tenantId: string;
    readonly clientId: string;
    readonly oauth2CallbackRoleName: string;
    readonly oidcProvider: iam.IOpenIdConnectProvider;
    /**
     * ARN of the IAM OIDC provider that trusts the RS256 web-identity token
     * (url = `webIdentityIssuer`). Pin role trust policies to this. Only set when
     * `enableWebIdentityToken` is true.
     */
    readonly webIdentityOidcProviderArn?: string;
    /**
     * ARN of the asymmetric KMS key the mint signs the web-identity token with.
     * Only set when `enableWebIdentityToken` is true.
     */
    readonly webIdentityKeyArn?: string;
    constructor(scope: constructs.Construct, id: string, props: AuthInfrastructureProps);
}