/**
 * OIDC Single Sign-On
 *
 * Supports enterprise SSO with Okta, Auth0, Azure AD, and generic OIDC providers.
 * Handles user authentication, role mapping, and SCIM provisioning.
 *
 * @module enterprise/auth/oidc
 */
/**
 * Supported OIDC providers
 */
export type OIDCProvider = "okta" | "auth0" | "azure-ad" | "google" | "custom";
/**
 * OIDC configuration
 */
export interface OIDCConfig {
    /** Provider type */
    provider: OIDCProvider;
    /** Client ID */
    clientId: string;
    /** Client Secret */
    clientSecret: string;
    /** Issuer URL (e.g., https://company.okta.com) */
    issuerUrl: string;
    /** Redirect URI after authentication */
    redirectUri: string;
    /** Requested scopes */
    scopes?: string[];
    /** Custom endpoints (for custom providers) */
    endpoints?: {
        authorization?: string;
        token?: string;
        userinfo?: string;
        jwks?: string;
    };
    /** Role mapping from OIDC claims to Vaspera roles */
    roleMapping?: RoleMapping;
}
/**
 * Role mapping configuration
 */
export interface RoleMapping {
    /** Claim to use for roles (default: "groups" or "roles") */
    rolesClaim: string;
    /** Map from OIDC group/role to Vaspera role */
    mappings: Record<string, VasperaRole>;
    /** Default role if no mapping matches */
    defaultRole: VasperaRole;
}
/**
 * Vaspera roles
 */
export type VasperaRole = "viewer" | "auditor" | "certifier" | "admin";
/**
 * OIDC user information
 */
export interface OIDCUser {
    /** User ID (sub claim) */
    id: string;
    /** Email address */
    email: string;
    /** Display name */
    name?: string;
    /** Given/first name */
    givenName?: string;
    /** Family/last name */
    familyName?: string;
    /** Profile picture URL */
    picture?: string;
    /** Mapped Vaspera role */
    role: VasperaRole;
    /** Raw OIDC claims */
    claims: Record<string, unknown>;
    /** Provider this user came from */
    provider: OIDCProvider;
    /** When the session expires */
    expiresAt: string;
}
/**
 * OIDC tokens
 */
export interface OIDCTokens {
    /** Access token */
    accessToken: string;
    /** ID token (JWT) */
    idToken: string;
    /** Refresh token */
    refreshToken?: string;
    /** Token type (usually "Bearer") */
    tokenType: string;
    /** Expiration time in seconds */
    expiresIn: number;
    /** Scope granted */
    scope?: string;
}
/**
 * Authorization state
 */
export interface AuthState {
    /** PKCE code verifier */
    codeVerifier: string;
    /** State parameter */
    state: string;
    /** Nonce for ID token validation */
    nonce: string;
    /** Original redirect URL */
    redirectUri: string;
    /** When this state expires */
    expiresAt: number;
}
/**
 * OIDC Client for enterprise authentication
 */
export declare class OIDCClient {
    private config;
    private discoveryCache;
    private pendingStates;
    constructor(config: OIDCConfig);
    /**
     * Discover OIDC endpoints from issuer
     */
    discover(): Promise<Record<string, unknown>>;
    /**
     * Get authorization URL
     */
    getAuthorizationUrl(): Promise<{
        url: string;
        state: AuthState;
    }>;
    /**
     * Exchange authorization code for tokens
     */
    exchangeCode(code: string, state: string): Promise<{
        tokens: OIDCTokens;
        user: OIDCUser;
    }>;
    /**
     * Get user information from tokens
     */
    getUserInfo(tokens: OIDCTokens, expectedNonce?: string): Promise<OIDCUser>;
    /**
     * Refresh tokens
     */
    refreshTokens(refreshToken: string): Promise<OIDCTokens>;
    /**
     * Map OIDC claims to Vaspera role
     */
    private mapRole;
    /**
     * Validate ID token
     */
    validateIdToken(idToken: string): Promise<boolean>;
}
/**
 * SCIM user representation
 */
export interface SCIMUser {
    schemas: string[];
    id: string;
    userName: string;
    name?: {
        givenName?: string;
        familyName?: string;
    };
    emails?: Array<{
        value: string;
        primary?: boolean;
    }>;
    active: boolean;
    groups?: Array<{
        value: string;
        display: string;
    }>;
}
/**
 * SCIM group representation
 */
export interface SCIMGroup {
    schemas: string[];
    id: string;
    displayName: string;
    members?: Array<{
        value: string;
        display: string;
    }>;
}
/**
 * SCIM client for user provisioning
 */
export declare class SCIMClient {
    private baseUrl;
    private bearerToken;
    constructor(baseUrl: string, bearerToken: string);
    /**
     * Get all users
     */
    getUsers(): Promise<SCIMUser[]>;
    /**
     * Get user by ID
     */
    getUser(id: string): Promise<SCIMUser | null>;
    /**
     * Create user
     */
    createUser(user: Omit<SCIMUser, "id">): Promise<SCIMUser>;
    /**
     * Update user
     */
    updateUser(id: string, user: Partial<SCIMUser>): Promise<SCIMUser>;
    /**
     * Delete user
     */
    deleteUser(id: string): Promise<void>;
    /**
     * Get all groups
     */
    getGroups(): Promise<SCIMGroup[]>;
    /**
     * Make SCIM request
     */
    private request;
}
/**
 * Create OIDC client for a provider
 */
export declare function createOIDCClient(config: OIDCConfig): OIDCClient;
/**
 * Create SCIM client
 */
export declare function createSCIMClient(baseUrl: string, bearerToken: string): SCIMClient;
//# sourceMappingURL=oidc.d.ts.map