import { Type } from '@nestjs/common';
import { MFAOptions } from './mfa-options.interface';
import { IRateLimitOptions } from './rate-limit.interface';
import { HibpOptions } from '../../utils/password-policy.util';
import { CookieOptions, SessionOptions } from './session-options.interface';
import { BaseAuthProvider } from '../providers/base-auth.provider';
import { DebugLogOptions } from '../services/debug-logger.service';
import { NestAuthUser } from '../../user/entities/user.entity';
import { SessionPayload, JWTTokenPayload } from './token-payload.interface';
import { NestAuthSignupRequestDto } from '../../auth/dto/requests/signup.request.dto';
import { NestAuthLoginRequestDto } from '../../auth/dto/requests/login.request.dto';
import { INestAuthTenantOptions } from '@ackplus/nest-auth-contracts';
import { Request } from 'express';
import { EntityManager } from 'typeorm';
import { NestAuthPlatformAccess, NestAuthUserAccess } from '../entities';
export interface IDefaultTenantOptions {
    name: string;
    slug: string;
    description?: string;
    metadata?: Record<string, any>;
}
export interface IRegistrationCollectProfileField {
    id: string;
    label: string;
    required: boolean;
    type: 'text' | 'email' | 'phone' | 'select' | 'checkbox' | 'password';
    placeholder?: string;
    options?: Array<{
        label: string;
        value: string;
    }>;
}
export interface IUserHooks {
    beforeCreate?: (userData: Partial<NestAuthUser>, input: any) => Promise<Partial<NestAuthUser>> | Partial<NestAuthUser>;
    afterCreate?: (user: NestAuthUser, input: any, manager?: EntityManager) => Promise<void> | void;
    beforeUpdate?: (user: NestAuthUser, changes: Partial<NestAuthUser>, manager?: EntityManager) => Promise<Partial<NestAuthUser> | void> | Partial<NestAuthUser> | void;
    afterUpdate?: (user: NestAuthUser, changes: Partial<NestAuthUser>, manager?: EntityManager) => Promise<void> | void;
    beforeDelete?: (user: NestAuthUser, manager?: EntityManager) => Promise<void> | void;
    afterDelete?: (user: NestAuthUser, manager?: EntityManager) => Promise<void> | void;
    getSessionUserData?: (user: NestAuthUser) => Promise<any> | any;
    sensitiveFields?: string[];
}
export interface IAuthHooks {
    transformResponse?: (response: any, user: NestAuthUser, session: SessionPayload) => Promise<any> | any;
}
export interface IBeforeSignupContext {
    request: Request;
}
export interface IOnSignupContext {
    request?: Request;
    manager?: EntityManager;
}
export interface IOnLoginContext {
    userAccess?: NestAuthUserAccess;
    platformAccess?: NestAuthPlatformAccess;
    request?: Request;
    provider?: BaseAuthProvider;
    manager?: EntityManager;
}
export interface IRegistrationHooks {
    beforeSignup?: (input: NestAuthSignupRequestDto, context: IBeforeSignupContext) => Promise<NestAuthSignupRequestDto> | NestAuthSignupRequestDto;
    onSignup?: (user: NestAuthUser, input: NestAuthSignupRequestDto, context?: IOnSignupContext) => Promise<void> | void;
}
export interface ILoginHooks {
    onLogin?: (user: NestAuthUser, input: NestAuthLoginRequestDto, context?: IOnLoginContext) => Promise<void> | void;
}
export interface IPasswordlessOptions {
    enabled?: boolean;
    allowSignUp?: boolean;
}
export interface IOtpOptions {
    secret?: string;
    generate?: (length?: number, format?: 'numeric' | 'alphanumeric') => string | Promise<string>;
    length?: number;
    format?: 'numeric' | 'alphanumeric';
    codeExpiresIn?: number | string;
    maxAttempts?: number;
}
export interface IGuardHooks {
    beforeAuth?: (request: any, payload: JWTTokenPayload) => Promise<void | {
        reject: boolean;
        reason?: string;
    }>;
    afterAuth?: (request: any, user: NestAuthUser, session: SessionPayload) => Promise<void> | void;
}
export interface IAuthorizationHooks {
    resolveRoles?: (user: NestAuthUser) => Promise<string[]>;
    resolvePermissions?: (user: NestAuthUser, roles: string[]) => Promise<string[]>;
}
export interface IAuthAuditEvent {
    type: 'login' | 'login_failed' | 'logout' | 'signup' | 'password_change' | 'mfa_enable' | 'mfa_disable' | 'session_revoke';
    userId?: string;
    ip?: string;
    userAgent?: string;
    success: boolean;
    metadata?: Record<string, any>;
    timestamp: Date;
}
export interface IAuditOptions {
    enabled?: boolean;
    onEvent?: (event: IAuthAuditEvent) => Promise<void> | void;
}
export interface IAuthModuleOptions {
    isGlobal?: boolean;
    appName: string;
    routePrefix?: string;
    enableAutoRefresh?: boolean;
    security?: {
        csrf?: {
            enabled?: boolean;
            allowedOrigins?: string[];
            cookieName?: string;
            headerName?: string;
        };
        rateLimit?: IRateLimitOptions;
        lockout?: {
            enabled?: boolean;
            maxFailedAttempts?: number;
            window?: number | string;
            lockDuration?: number | string;
        };
        captcha?: {
            enabled?: boolean;
            verify?: (token: string, ctx: {
                ip?: string;
                route?: string;
            }) => boolean | Promise<boolean>;
            headerName?: string;
            bodyField?: string;
        };
    };
    social?: {
        requireVerifiedEmailForLinking?: boolean;
    };
    google?: {
        clientId: string;
        clientSecret: string;
        redirectUri: string;
        requireVerifiedEmail?: boolean;
        audiences?: string[];
    };
    facebook?: {
        appId: string;
        appSecret: string;
        redirectUri: string;
    };
    apple?: {
        clientId: string;
        teamId: string;
        keyId: string;
        privateKey: string;
        privateKeyMethod?: string;
        redirectUri: string;
        audiences?: string[];
        jwksUrl?: string;
    };
    github?: {
        clientId: string;
        clientSecret: string;
        redirectUri: string;
        userApiUrl?: string;
        emailsApiUrl?: string;
    };
    phoneAuth?: {
        enabled: boolean;
    };
    emailAuth?: {
        enabled: boolean;
        disposable?: {
            enabled?: boolean;
            mode?: 'block' | 'flag';
            allowlist?: string[];
        };
    };
    passwordless?: IPasswordlessOptions;
    registration?: {
        enabled?: boolean;
        requireInvitation?: boolean;
        requireVerifiedEmail?: boolean;
        autoLoginAfterSignup?: boolean;
        collectProfileFields?: Array<IRegistrationCollectProfileField>;
    };
    clientConfig?: {
        factory?: (defaultConfig: import('@ackplus/nest-auth-contracts').IClientConfig, context: {
            configService: any;
            tenantService: any;
        }) => Promise<any> | any;
    };
    mfa?: MFAOptions;
    session?: SessionOptions;
    mustChangePassword?: {
        enforce?: boolean;
    };
    customAuthProviders?: BaseAuthProvider[];
    tenant?: INestAuthTenantOptions;
    roleGuards?: string[];
    adminConsole?: IAdminConsoleOptions;
    debug?: DebugLogOptions;
    user?: IUserHooks;
    auth?: IAuthHooks;
    registrationHooks?: IRegistrationHooks;
    loginHooks?: ILoginHooks;
    guards?: IGuardHooks;
    password?: {
        passwordResetTokenExpiresIn?: number | string;
        hash?: (password: string) => Promise<string>;
        verify?: (password: string, hash: string) => Promise<boolean>;
        argon2?: {
            memoryCost?: number;
            timeCost?: number;
            parallelism?: number;
        };
        policy?: IPasswordPolicyOptions;
    };
    platformAccess?: {
        enabled?: boolean;
        validate?: (request: Request) => Promise<boolean> | boolean;
    };
    otp?: IOtpOptions;
    authorization?: IAuthorizationHooks;
    audit?: IAuditOptions;
    errorHandler?: (error: Error, context: 'login' | 'signup' | 'refresh' | 'mfa' | 'password_reset' | 'password_change') => any;
    resolveConfig?: (context: any) => Promise<Partial<IAuthModuleOptions>> | Partial<IAuthModuleOptions>;
}
export interface IPasswordPolicyOptions {
    enabled?: boolean;
    minLength?: number;
    maxLength?: number;
    blockCommonPasswords?: boolean;
    blocklist?: string[];
    blockContainsIdentifier?: boolean;
    checkBreached?: boolean;
    hibp?: HibpOptions;
}
export interface IAdminConsoleOptions {
    enabled?: boolean;
    path?: string;
    basePath?: string;
    secretKey?: string;
    sessionSecret?: string;
    sessionCookieName?: string;
    sessionDuration?: string | number;
    cookie?: CookieOptions;
    allowAdminManagement?: boolean;
    bruteForce?: {
        enabled?: boolean;
    };
    allowPublicSignupAfterFirstAdmin?: boolean;
}
export interface IAuthModuleAsyncOptions {
    isGlobal?: boolean;
    enableAutoRefresh?: boolean;
    imports?: any[];
    useFactory?: (...args: any[]) => Promise<IAuthModuleOptions> | IAuthModuleOptions;
    inject?: any[];
    useClass?: Type<IAuthModuleOptionsFactory>;
    useExisting?: Type<IAuthModuleOptionsFactory>;
}
export interface IAuthModuleOptionsFactory {
    createAuthModuleOptions(): Promise<IAuthModuleOptions> | IAuthModuleOptions;
}
//# sourceMappingURL=auth-module-options.interface.d.ts.map