import * as core from 'aws-cdk-lib';
import { aws_dynamodb as dynamodb, aws_logs as logs, RemovalPolicy } from 'aws-cdk-lib';
import * as constructs from 'constructs';
/**
 * Provisioning-channel authentication mode.
 *
 * - `OAUTH_CLIENT_CREDENTIALS` (default): the IdP exchanges a client id + secret
 *   at the token endpoint for a short-lived, KMS-signed JWT, which it presents on
 *   SCIM calls. No long-lived secret on the wire.
 * - `AWS_IAM`: the Function URL enforces SigV4; the caller is an AWS principal.
 *   Genuinely secretless. No token endpoint.
 * - `WIF`: the IdP federates (RFC 7523 JWT bearer assertion); no stored secret.
 *   A designed-in upgrade, enabled where the IdP exposes WIF for a custom app.
 * - `STATIC_BEARER`: constant-time compare against a Secrets Manager secret.
 *   The legacy path (Microsoft no longer onboards it); opt-in only.
 */
export declare enum ScimAuthMode {
    OAUTH_CLIENT_CREDENTIALS = "OAUTH_CLIENT_CREDENTIALS",
    AWS_IAM = "AWS_IAM",
    WIF = "WIF",
    STATIC_BEARER = "STATIC_BEARER"
}
/** Trust parameters for the WIF (RFC 7523) assertion exchange. */
export interface ScimWifConfig {
    /** The IdP assertion issuer, e.g. `https://login.microsoftonline.com/<tid>/v2.0`. */
    readonly assertionIssuer: string;
    /** The IdP JWKS URI, e.g. `https://login.microsoftonline.com/<tid>/discovery/v2.0/keys`. */
    readonly assertionJwksUri: string;
    /** Expected `aud` on the assertion (the Workload Identity App ID). */
    readonly expectedAudience: string;
    /** Expected `azp` on the assertion (the Provisioning Client 1P App ID). */
    readonly expectedAzp: string;
}
/**
 * Props for {@link ScimProvisioningService}. Every consumer/IdP/domain value is
 * a prop with a generic default; nothing project-specific is baked in.
 */
export interface ScimProvisioningServiceProps {
    /** Auth mode for the provisioning channel. @default OAUTH_CLIENT_CREDENTIALS */
    readonly authMode?: ScimAuthMode;
    /** SCIM base path. @default '/scim/v2' */
    readonly scimBasePath?: string;
    /** OAuth token endpoint path (OAUTH_CLIENT_CREDENTIALS / WIF). @default '/oauth2/token' */
    readonly tokenEndpointPath?: string;
    /** JWKS path where the token signing public key is served. @default '/.well-known/jwks.json' */
    readonly jwksPath?: string;
    /** Issued access-token lifetime. @default Duration.hours(1) */
    readonly accessTokenValidity?: core.Duration;
    /**
     * Issuer (`iss`) stamped on issued tokens; also the audience the SCIM handler
     * requires. @default derived from the Function URL at deploy time.
     */
    readonly tokenIssuer?: string;
    /** WIF trust parameters. Required when {@link authMode} is `WIF`. */
    readonly wif?: ScimWifConfig;
    /** DynamoDB table name. @default CDK-auto-generated. */
    readonly tableName?: string;
    /** Removal policy for table + any secret. @default RETAIN_ON_UPDATE_OR_DELETE */
    readonly removalPolicy?: RemovalPolicy;
    /** Log retention. @default RetentionDays.ONE_MONTH */
    readonly logRetention?: logs.RetentionDays;
    /** Lambda timeout. @default Duration.seconds(30) */
    readonly timeout?: core.Duration;
}
/**
 * A generic, reusable SCIM 2.0 provisioning service: an IdP provisions users and
 * groups into a construct-owned DynamoDB table over SCIM 2.0, authenticating with
 * short-lived OAuth 2.0 client-credentials tokens minted by a token endpoint the
 * construct hosts itself. A consuming application reads the table with a single
 * `GetItem(USER#<externalId>)` to resolve an external id to `active` + a group-id
 * list.
 *
 * Consumer- and IdP-agnostic: pass props. horton (ADR-0003.5) is the first
 * adopter. CloudFront/WAF/origin-access is out of scope; adopt {@link functionUrl}
 * as an origin in a downstream distribution stack.
 */
export declare class ScimProvisioningService extends constructs.Construct {
    /** Base HTTPS URL of the service (Function URL). */
    readonly functionUrl: string;
    /** SCIM base URL (functionUrl + scimBasePath). */
    readonly scimUrl: string;
    /** Token endpoint URL (OAUTH_CLIENT_CREDENTIALS / WIF); undefined otherwise. */
    readonly tokenUrl?: string;
    /** JWKS URL (where a token endpoint exists); undefined otherwise. */
    readonly jwksUrl?: string;
    /** The provisioned-directory table; grant your consumer read on it. */
    readonly table: dynamodb.ITable;
    readonly tableArn: string;
    /** OAUTH_CLIENT_CREDENTIALS: the IdP's client-secret ARN (value set out-of-band). */
    readonly clientSecretArn?: string;
    /** STATIC_BEARER only: the bearer-secret ARN. */
    readonly staticBearerSecretArn?: string;
    constructor(scope: constructs.Construct, id: string, props?: ScimProvisioningServiceProps);
}