import * as core from "@terrascript/core";

export interface TokenValidityUnitsArgs extends core.SchemaArgs {
  accessToken: string | core.StringOut;

  idToken: string | core.StringOut;

  refreshToken: string | core.StringOut;
}

export class TokenValidityUnits extends core.Schema<TokenValidityUnitsArgs> {
  @core.attr(String, { computed: true })
  public accessToken!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public idToken!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public refreshToken!: string | core.StringOut;
}

export interface AnalyticsConfigurationArgs extends core.SchemaArgs {
  applicationArn: string | core.StringOut;

  applicationId: string | core.StringOut;

  externalId: string | core.StringOut;

  roleArn: string | core.StringOut;

  userDataShared: boolean | core.BooleanOut;
}

export class AnalyticsConfiguration extends core.Schema<AnalyticsConfigurationArgs> {
  @core.attr(String, { computed: true })
  public applicationArn!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public applicationId!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public externalId!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public roleArn!: string | core.StringOut;

  @core.attr(Boolean, { computed: true })
  public userDataShared!: boolean | core.BooleanOut;
}

export interface DsUserPoolClientArgs {
  /**
   * (Required) Client Id of the user pool.
   */
  clientId: string | core.StringOut;

  /**
   * (Required) User pool the client belongs to.
   */
  userPoolId: string | core.StringOut;
}

export class DsUserPoolClient extends core.Data<DsUserPoolClientArgs> {
  /**
   * (Optional) Time limit, between 5 minutes and 1 day, after which the access token is no longer valid
   * and cannot be used. This value will be overridden if you have entered a value in `token_validity_uni
   * ts`.
   */
  @core.attr(Number, { computed: true })
  public accessTokenValidity!: number | core.NumberOut;

  /**
   * (Optional) List of allowed OAuth flows (code, implicit, client_credentials).
   */
  @core.attr(String, { computed: true, kind: "array" })
  public allowedOauthFlows!: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Optional) Whether the client is allowed to follow the OAuth protocol when interacting with Cognito
   * user pools.
   */
  @core.attr(Boolean, { computed: true })
  public allowedOauthFlowsUserPoolClient!: boolean | core.BooleanOut;

  /**
   * (Optional) List of allowed OAuth scopes (phone, email, openid, profile, and aws.cognito.signin.user.
   * admin).
   */
  @core.attr(String, { computed: true, kind: "array" })
  public allowedOauthScopes!:
    | core.Array<string>
    | core.ArrayOut<core.StringOut>;

  /**
   * (Optional) Configuration block for Amazon Pinpoint analytics for collecting metrics for this user po
   * ol. [Detailed below](#analytics_configuration).
   */
  @core.attr(AnalyticsConfiguration, { computed: true, kind: "array" })
  public analyticsConfiguration!:
    | core.Array<AnalyticsConfiguration>
    | core.ArrayOut<AnalyticsConfiguration>;

  /**
   * (Optional) List of allowed callback URLs for the identity providers.
   */
  @core.attr(String, { computed: true, kind: "array" })
  public callbackUrls!: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Required) Client Id of the user pool.
   */
  @core.attr(String)
  public clientId!: string | core.StringOut;

  @core.attr(String, { computed: true })
  public clientSecret!: string | core.StringOut;

  /**
   * (Optional) Default redirect URI. Must be in the list of callback URLs.
   */
  @core.attr(String, { computed: true })
  public defaultRedirectUri!: string | core.StringOut;

  @core.attr(Boolean, { computed: true })
  public enablePropagateAdditionalUserContextData!: boolean | core.BooleanOut;

  /**
   * (Optional) Enables or disables token revocation.
   */
  @core.attr(Boolean, { computed: true })
  public enableTokenRevocation!: boolean | core.BooleanOut;

  /**
   * (Optional) List of authentication flows (ADMIN_NO_SRP_AUTH, CUSTOM_AUTH_FLOW_ONLY, USER_PASSWORD_AUT
   * H, ALLOW_ADMIN_USER_PASSWORD_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH,
   * ALLOW_REFRESH_TOKEN_AUTH).
   */
  @core.attr(String, { computed: true, kind: "array" })
  public explicitAuthFlows!: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Optional) Should an application secret be generated.
   */
  @core.attr(Boolean, { computed: true })
  public generateSecret!: boolean | core.BooleanOut;

  @core.attr(String, { computed: true })
  public id!: string | core.StringOut;

  /**
   * (Optional) Time limit, between 5 minutes and 1 day, after which the ID token is no longer valid and
   * cannot be used. This value will be overridden if you have entered a value in `token_validity_units`.
   */
  @core.attr(Number, { computed: true })
  public idTokenValidity!: number | core.NumberOut;

  /**
   * (Optional) List of allowed logout URLs for the identity providers.
   */
  @core.attr(String, { computed: true, kind: "array" })
  public logoutUrls!: core.Array<string> | core.ArrayOut<core.StringOut>;

  @core.attr(String, { computed: true })
  public name!: string | core.StringOut;

  /**
   * (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, acc
   * ount confirmation, and password recovery when the user does not exist in the user pool. When set to
   * ENABLED` and the user does not exist, authentication returns an error indicating either the usernam
   * e or password was incorrect, and account confirmation and password recovery return a response indica
   * ting a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `Use
   * rNotFoundException` exception if the user does not exist in the user pool.
   */
  @core.attr(String, { computed: true })
  public preventUserExistenceErrors!: string | core.StringOut;

  /**
   * (Optional) List of user pool attributes the application client can read from.
   */
  @core.attr(String, { computed: true, kind: "array" })
  public readAttributes!: core.Array<string> | core.ArrayOut<core.StringOut>;

  /**
   * (Optional) Time limit in days refresh tokens are valid for.
   */
  @core.attr(Number, { computed: true })
  public refreshTokenValidity!: number | core.NumberOut;

  /**
   * (Optional) List of provider names for the identity providers that are supported on this client. Uses
   * the `provider_name` attribute of `aws_cognito_identity_provider` resource(s), or the equivalent str
   * ing(s).
   */
  @core.attr(String, { computed: true, kind: "array" })
  public supportedIdentityProviders!:
    | core.Array<string>
    | core.ArrayOut<core.StringOut>;

  /**
   * (Optional) Configuration block for units in which the validity times are represented in. [Detailed b
   * elow](#token_validity_units).
   */
  @core.attr(TokenValidityUnits, { computed: true, kind: "array" })
  public tokenValidityUnits!:
    | core.Array<TokenValidityUnits>
    | core.ArrayOut<TokenValidityUnits>;

  /**
   * (Required) User pool the client belongs to.
   */
  @core.attr(String)
  public userPoolId!: string | core.StringOut;

  /**
   * (Optional) List of user pool attributes the application client can write to.
   */
  @core.attr(String, { computed: true, kind: "array" })
  public writeAttributes!: core.Array<string> | core.ArrayOut<core.StringOut>;

  constructor(name: string, args?: DsUserPoolClientArgs) {
    super(name, "aws_cognito_user_pool_client", args);
  }

  public override getNamespace(): string {
    return "aws_cognito";
  }
}
