/**
 * SSO/OIDC Type Definitions for Vorion Platform
 *
 * TypeScript interfaces for OIDC authentication flow.
 * This module has no dependency on openid-client to allow static type usage
 * without ESM import issues.
 *
 * @module auth/sso/types
 */
import { z } from 'zod';
/**
 * Supported OIDC provider types
 */
export type OIDCProviderType = 'okta' | 'azure_ad' | 'google' | 'generic';
/**
 * Tenant mapping strategy - how to determine tenant from SSO identity
 */
export type TenantMappingStrategy = 'domain' | 'claim' | 'static';
/**
 * OIDC Provider configuration
 */
export interface OIDCProviderConfig {
    /** Unique identifier for this provider */
    id: string;
    /** Human-readable name */
    name: string;
    /** Provider type (okta, azure_ad, google, generic) */
    type: OIDCProviderType;
    /** Whether this provider is enabled */
    enabled: boolean;
    /** Issuer URL (discovery endpoint base) */
    issuer: string;
    /** Client ID from the identity provider */
    clientId: string;
    /** Client secret (for confidential clients) */
    clientSecret?: string;
    /** Redirect URI for authorization callback */
    redirectUri: string;
    /** OIDC scopes to request */
    scopes: string[];
    /** Response type (default: 'code') */
    responseType?: string;
    /** Enable PKCE (Proof Key for Code Exchange) - recommended for all flows */
    pkceEnabled: boolean;
    /** Access token lifetime in seconds (if configurable) */
    accessTokenLifetime?: number;
    /** Refresh token lifetime in seconds */
    refreshTokenLifetime?: number;
    /** Whether to request refresh tokens */
    requestRefreshToken: boolean;
    /** Strategy for mapping SSO identity to Vorion tenant */
    tenantMapping: TenantMappingStrategy;
    /** For 'static' strategy: the fixed tenant ID */
    staticTenantId?: string;
    /** For 'claim' strategy: the claim name containing tenant ID */
    tenantClaimName?: string;
    /** For 'domain' strategy: mapping of email domains to tenant IDs */
    domainTenantMap?: Record<string, string>;
    /** Enable Just-In-Time user provisioning */
    jitProvisioningEnabled: boolean;
    /** Default roles to assign to JIT-provisioned users */
    jitDefaultRoles?: string[];
    /** Claim mappings for JIT provisioning */
    jitClaimMappings?: JITClaimMappings;
    /** Additional parameters to include in authorization request */
    additionalAuthParams?: Record<string, string>;
    /** Custom logout URL (if not using standard OIDC logout) */
    logoutUrl?: string;
    /** Whether to use front-channel logout */
    frontChannelLogout?: boolean;
    /** Allowed clock skew in seconds for token validation */
    clockSkewSeconds?: number;
}
/**
 * Claim mappings for JIT provisioning
 */
export interface JITClaimMappings {
    /** Claim for user's email */
    email?: string;
    /** Claim for user's first name */
    firstName?: string;
    /** Claim for user's last name */
    lastName?: string;
    /** Claim for user's display name */
    displayName?: string;
    /** Claim for user's groups/roles */
    groups?: string;
    /** Custom claim mappings */
    custom?: Record<string, string>;
}
/**
 * Authorization request state - stored during OAuth flow
 */
export interface AuthorizationState {
    /** Random state parameter for CSRF protection */
    state: string;
    /** Nonce for ID token validation */
    nonce: string;
    /** PKCE code verifier (if PKCE is enabled) */
    codeVerifier?: string;
    /** Provider ID this state belongs to */
    providerId: string;
    /** Original URL to redirect to after authentication */
    returnUrl?: string;
    /** Tenant ID if known before authentication */
    tenantId?: string;
    /** Timestamp when this state was created */
    createdAt: Date;
    /** Timestamp when this state expires */
    expiresAt: Date;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Authorization URL result
 */
export interface AuthorizationUrlResult {
    /** The URL to redirect the user to */
    url: string;
    /** The state object to store for validation */
    state: AuthorizationState;
}
/**
 * Token exchange request - parameters from callback
 */
export interface TokenExchangeRequest {
    /** Authorization code from callback */
    code: string;
    /** State parameter from callback */
    state: string;
    /** The stored authorization state for validation */
    storedState: AuthorizationState;
}
/**
 * OIDC tokens received from provider
 */
export interface OIDCTokenSet {
    /** Access token for API calls */
    accessToken: string;
    /** Token type (usually 'Bearer') */
    tokenType: string;
    /** Access token expiration time */
    expiresAt?: Date;
    /** ID token (JWT) */
    idToken?: string;
    /** Refresh token for obtaining new access tokens */
    refreshToken?: string;
    /** Scopes granted by the provider */
    scope?: string;
}
/**
 * Parsed ID token claims
 */
export interface IDTokenClaims {
    /** Issuer */
    iss: string;
    /** Subject (unique user identifier at provider) */
    sub: string;
    /** Audience(s) */
    aud: string | string[];
    /** Expiration time (unix timestamp) */
    exp: number;
    /** Issued at time (unix timestamp) */
    iat: number;
    /** Authentication time (unix timestamp) */
    auth_time?: number;
    /** Nonce */
    nonce?: string;
    /** Access token hash */
    at_hash?: string;
    /** Authorized party */
    azp?: string;
    /** User's email */
    email?: string;
    /** Whether email is verified */
    email_verified?: boolean;
    /** User's full name */
    name?: string;
    /** User's given name */
    given_name?: string;
    /** User's family name */
    family_name?: string;
    /** User's preferred username */
    preferred_username?: string;
    /** URL of user's profile picture */
    picture?: string;
    /** User's locale */
    locale?: string;
    /** User's timezone */
    zoneinfo?: string;
    [key: string]: unknown;
}
/**
 * User info from OIDC userinfo endpoint
 */
export interface OIDCUserInfo {
    /** Subject (same as in ID token) */
    sub: string;
    /** User's email */
    email?: string;
    /** Whether email is verified */
    email_verified?: boolean;
    /** User's full name */
    name?: string;
    /** User's given name */
    given_name?: string;
    /** User's family name */
    family_name?: string;
    /** User's preferred username */
    preferred_username?: string;
    /** URL of user's profile picture */
    picture?: string;
    /** Additional claims */
    [key: string]: unknown;
}
/**
 * Token exchange result
 */
export interface TokenExchangeResult {
    /** The token set */
    tokens: OIDCTokenSet;
    /** Parsed ID token claims */
    claims: IDTokenClaims;
    /** User info (if requested) */
    userInfo?: OIDCUserInfo;
    /** Resolved tenant ID */
    tenantId?: string;
    /** Whether this is a new user (JIT provisioned) */
    isNewUser?: boolean;
    /** User's Vorion user ID (if mapped) */
    userId?: string;
}
/**
 * Token refresh result
 */
export interface TokenRefreshResult {
    /** New token set */
    tokens: OIDCTokenSet;
    /** Updated claims if ID token was refreshed */
    claims?: IDTokenClaims;
}
/**
 * JIT provisioned user data
 */
export interface JITProvisionedUser {
    /** External subject ID from identity provider */
    externalSubjectId: string;
    /** Provider ID this user was provisioned from */
    providerId: string;
    /** User's email */
    email: string;
    /** User's first name */
    firstName?: string;
    /** User's last name */
    lastName?: string;
    /** User's display name */
    displayName?: string;
    /** Assigned roles */
    roles: string[];
    /** Resolved tenant ID */
    tenantId: string;
    /** Additional attributes from claims */
    attributes: Record<string, unknown>;
    /** When the user was provisioned */
    provisionedAt: Date;
}
/**
 * SSO session data stored after authentication
 */
export interface SSOSession {
    /** Session ID */
    id: string;
    /** Vorion user ID */
    userId: string;
    /** Provider ID used for authentication */
    providerId: string;
    /** External subject ID from provider */
    externalSubjectId: string;
    /** Tenant ID */
    tenantId: string;
    /** Current token set */
    tokens: OIDCTokenSet;
    /** ID token claims */
    claims: IDTokenClaims;
    /** When the session was created */
    createdAt: Date;
    /** When the session was last refreshed */
    lastRefreshedAt: Date;
    /** Session metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Zod schema for provider configuration
 */
export declare const OIDCProviderConfigSchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    type: z.ZodEnum<["okta", "azure_ad", "google", "generic"]>;
    enabled: z.ZodBoolean;
    issuer: z.ZodString;
    clientId: z.ZodString;
    clientSecret: z.ZodOptional<z.ZodString>;
    redirectUri: z.ZodString;
    scopes: z.ZodArray<z.ZodString, "many">;
    responseType: z.ZodDefault<z.ZodString>;
    pkceEnabled: z.ZodDefault<z.ZodBoolean>;
    accessTokenLifetime: z.ZodOptional<z.ZodNumber>;
    refreshTokenLifetime: z.ZodOptional<z.ZodNumber>;
    requestRefreshToken: z.ZodDefault<z.ZodBoolean>;
    tenantMapping: z.ZodEnum<["domain", "claim", "static"]>;
    staticTenantId: z.ZodOptional<z.ZodString>;
    tenantClaimName: z.ZodOptional<z.ZodString>;
    domainTenantMap: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    jitProvisioningEnabled: z.ZodDefault<z.ZodBoolean>;
    jitDefaultRoles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    jitClaimMappings: z.ZodOptional<z.ZodObject<{
        email: z.ZodOptional<z.ZodString>;
        firstName: z.ZodOptional<z.ZodString>;
        lastName: z.ZodOptional<z.ZodString>;
        displayName: z.ZodOptional<z.ZodString>;
        groups: z.ZodOptional<z.ZodString>;
        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    }, "strip", z.ZodTypeAny, {
        custom?: Record<string, string>;
        email?: string;
        firstName?: string;
        lastName?: string;
        displayName?: string;
        groups?: string;
    }, {
        custom?: Record<string, string>;
        email?: string;
        firstName?: string;
        lastName?: string;
        displayName?: string;
        groups?: string;
    }>>;
    additionalAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    logoutUrl: z.ZodOptional<z.ZodString>;
    frontChannelLogout: z.ZodOptional<z.ZodBoolean>;
    clockSkewSeconds: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    type?: "okta" | "azure_ad" | "google" | "generic";
    name?: string;
    issuer?: string;
    enabled?: boolean;
    clientId?: string;
    clientSecret?: string;
    redirectUri?: string;
    scopes?: string[];
    responseType?: string;
    pkceEnabled?: boolean;
    accessTokenLifetime?: number;
    refreshTokenLifetime?: number;
    requestRefreshToken?: boolean;
    tenantMapping?: "domain" | "claim" | "static";
    staticTenantId?: string;
    tenantClaimName?: string;
    domainTenantMap?: Record<string, string>;
    jitProvisioningEnabled?: boolean;
    jitDefaultRoles?: string[];
    jitClaimMappings?: {
        custom?: Record<string, string>;
        email?: string;
        firstName?: string;
        lastName?: string;
        displayName?: string;
        groups?: string;
    };
    additionalAuthParams?: Record<string, string>;
    logoutUrl?: string;
    frontChannelLogout?: boolean;
    clockSkewSeconds?: number;
}, {
    id?: string;
    type?: "okta" | "azure_ad" | "google" | "generic";
    name?: string;
    issuer?: string;
    enabled?: boolean;
    clientId?: string;
    clientSecret?: string;
    redirectUri?: string;
    scopes?: string[];
    responseType?: string;
    pkceEnabled?: boolean;
    accessTokenLifetime?: number;
    refreshTokenLifetime?: number;
    requestRefreshToken?: boolean;
    tenantMapping?: "domain" | "claim" | "static";
    staticTenantId?: string;
    tenantClaimName?: string;
    domainTenantMap?: Record<string, string>;
    jitProvisioningEnabled?: boolean;
    jitDefaultRoles?: string[];
    jitClaimMappings?: {
        custom?: Record<string, string>;
        email?: string;
        firstName?: string;
        lastName?: string;
        displayName?: string;
        groups?: string;
    };
    additionalAuthParams?: Record<string, string>;
    logoutUrl?: string;
    frontChannelLogout?: boolean;
    clockSkewSeconds?: number;
}>;
/**
 * Zod schema for authorization callback parameters
 */
export declare const AuthorizationCallbackSchema: z.ZodObject<{
    code: z.ZodString;
    state: z.ZodString;
    error: z.ZodOptional<z.ZodString>;
    error_description: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    code?: string;
    error?: string;
    state?: string;
    error_description?: string;
}, {
    code?: string;
    error?: string;
    state?: string;
    error_description?: string;
}>;
/**
 * SSO-specific error codes
 */
export type SSOErrorCode = 'SSO_PROVIDER_NOT_FOUND' | 'SSO_PROVIDER_DISABLED' | 'SSO_DISCOVERY_FAILED' | 'SSO_STATE_INVALID' | 'SSO_STATE_EXPIRED' | 'SSO_TOKEN_EXCHANGE_FAILED' | 'SSO_TOKEN_VALIDATION_FAILED' | 'SSO_TOKEN_REFRESH_FAILED' | 'SSO_TOKEN_REVOCATION_FAILED' | 'SSO_USERINFO_FAILED' | 'SSO_TENANT_MAPPING_FAILED' | 'SSO_JIT_PROVISIONING_FAILED' | 'SSO_SESSION_NOT_FOUND' | 'SSO_CONFIGURATION_ERROR';
/**
 * SSO error details
 */
export interface SSOErrorDetails {
    code: SSOErrorCode;
    providerId?: string;
    originalError?: string;
    context?: Record<string, unknown>;
}
/**
 * SSO event types for audit logging
 */
export type SSOEventType = 'sso.auth.started' | 'sso.auth.completed' | 'sso.auth.failed' | 'sso.token.refreshed' | 'sso.token.revoked' | 'sso.session.created' | 'sso.session.terminated' | 'sso.user.provisioned' | 'sso.user.updated';
/**
 * SSO audit event
 */
export interface SSOAuditEvent {
    type: SSOEventType;
    timestamp: Date;
    providerId: string;
    userId?: string;
    tenantId?: string;
    externalSubjectId?: string;
    metadata?: Record<string, unknown>;
    error?: SSOErrorDetails;
}
/**
 * SSOManager configuration
 */
export interface SSOManagerConfig {
    /** State expiration time in seconds */
    stateExpirationSeconds: number;
    /** Whether to fetch user info after token exchange */
    fetchUserInfo: boolean;
    /** Whether to validate ID token claims */
    validateClaims: boolean;
    /** Default scopes to request if not specified in provider config */
    defaultScopes: string[];
    /** Maximum number of concurrent provider discoveries */
    maxConcurrentDiscoveries: number;
    /** Discovery cache TTL in seconds */
    discoveryCacheTtlSeconds: number;
    /** Callback for audit events */
    onAuditEvent?: (event: SSOAuditEvent) => void | Promise<void>;
    /** Callback for JIT user provisioning */
    onProvisionUser?: (user: JITProvisionedUser) => Promise<string>;
    /** Callback for looking up existing user by external ID */
    onLookupUser?: (providerId: string, externalSubjectId: string) => Promise<{
        userId: string;
        tenantId: string;
    } | null>;
}
/**
 * Default SSOManager configuration
 */
export declare const DEFAULT_SSO_MANAGER_CONFIG: SSOManagerConfig;
//# sourceMappingURL=types.d.ts.map