// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * SSO/OIDC Type Definitions for Vorion Platform
 *
 * TypeScript interfaces for OIDC authentication flow.
 * This module has no dependency on openid-client to allow static type usage
 * without ESM import issues.
 *
 * @module auth/sso/types
 */
import { z } from 'zod';
// =============================================================================
// Validation Schemas
// =============================================================================
/**
 * Zod schema for provider configuration
 */
export const OIDCProviderConfigSchema = z.object({
    id: z.string().min(1).max(100),
    name: z.string().min(1).max(255),
    type: z.enum(['okta', 'azure_ad', 'google', 'generic']),
    enabled: z.boolean(),
    issuer: z.string().url(),
    clientId: z.string().min(1),
    clientSecret: z.string().optional(),
    redirectUri: z.string().url(),
    scopes: z.array(z.string()).min(1),
    responseType: z.string().default('code'),
    pkceEnabled: z.boolean().default(true),
    accessTokenLifetime: z.number().int().positive().optional(),
    refreshTokenLifetime: z.number().int().positive().optional(),
    requestRefreshToken: z.boolean().default(true),
    tenantMapping: z.enum(['domain', 'claim', 'static']),
    staticTenantId: z.string().optional(),
    tenantClaimName: z.string().optional(),
    domainTenantMap: z.record(z.string()).optional(),
    jitProvisioningEnabled: z.boolean().default(false),
    jitDefaultRoles: z.array(z.string()).optional(),
    jitClaimMappings: z
        .object({
        email: z.string().optional(),
        firstName: z.string().optional(),
        lastName: z.string().optional(),
        displayName: z.string().optional(),
        groups: z.string().optional(),
        custom: z.record(z.string()).optional(),
    })
        .optional(),
    additionalAuthParams: z.record(z.string()).optional(),
    logoutUrl: z.string().url().optional(),
    frontChannelLogout: z.boolean().optional(),
    clockSkewSeconds: z.number().int().min(0).max(300).default(60),
});
/**
 * Zod schema for authorization callback parameters
 */
export const AuthorizationCallbackSchema = z.object({
    code: z.string().min(1),
    state: z.string().min(1),
    error: z.string().optional(),
    error_description: z.string().optional(),
});
/**
 * Default SSOManager configuration
 */
export const DEFAULT_SSO_MANAGER_CONFIG = {
    stateExpirationSeconds: 600, // 10 minutes
    fetchUserInfo: true,
    validateClaims: true,
    defaultScopes: ['openid', 'profile', 'email'],
    maxConcurrentDiscoveries: 5,
    discoveryCacheTtlSeconds: 3600, // 1 hour
};
//# sourceMappingURL=types.js.map