import { FastifyReply } from "fastify";
import { AuthenticatedRequest } from "../../../common/interfaces/authenticated.request.interface";
import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
import { AuthService } from "../../auth/services/auth.service";
import { PasskeyAuthenticationVerifyDTO } from "../dtos/passkey-verify.dto";
import { TotpVerifyDTO } from "../dtos/totp-verify.dto";
import { BackupCodeVerifyDTO, TwoFactorChallengeDTO, TwoFactorEnableDTO } from "../dtos/two-factor-verify.dto";
import { PendingAuthPayload } from "../guards/pending-auth.guard";
import { BackupCodeService } from "../services/backup-code.service";
import { PasskeyService } from "../services/passkey.service";
import { TwoFactorService } from "../services/two-factor.service";
/**
 * Request with pending auth payload attached.
 */
interface PendingAuthRequest {
    pendingAuth: PendingAuthPayload;
}
/**
 * Two-Factor Authentication Controller
 *
 * Handles 2FA status management and verification during login.
 *
 * Status/Enable/Disable endpoints require full JWT authentication.
 * Verification endpoints require pending 2FA token (issued after password validation).
 */
export declare class TwoFactorController {
    private readonly jsonApiService;
    private readonly twoFactorService;
    private readonly passkeyService;
    private readonly backupCodeService;
    private readonly authService;
    private readonly logger;
    constructor(jsonApiService: JsonApiService, twoFactorService: TwoFactorService, passkeyService: PasskeyService, backupCodeService: BackupCodeService, authService: AuthService);
    /**
     * GET /auth/two-factor/status
     *
     * Get the 2FA status for the authenticated user.
     * Returns enabled state, preferred method, available methods, and backup codes count.
     */
    getStatus(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
    /**
     * POST /auth/two-factor/enable
     *
     * Enable 2FA for the authenticated user.
     * Requires at least one 2FA method (TOTP or passkey) to be configured.
     */
    enable(req: AuthenticatedRequest, reply: FastifyReply, body: TwoFactorEnableDTO): Promise<void>;
    /**
     * POST /auth/two-factor/disable
     *
     * Disable 2FA for the authenticated user.
     */
    disable(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
    /**
     * POST /auth/two-factor/challenge
     *
     * Request a 2FA challenge for the specified method.
     * For passkeys, returns WebAuthn authentication options.
     * For TOTP and backup codes, returns a simple acknowledgment (no challenge needed).
     *
     * Requires pending 2FA token from login.
     */
    challenge(req: PendingAuthRequest, reply: FastifyReply, body: TwoFactorChallengeDTO): Promise<void>;
    /**
     * POST /auth/two-factor/verify/totp
     *
     * Verify a TOTP code to complete 2FA login.
     * On success, the full JWT tokens are issued by the auth service.
     *
     * Requires pending 2FA token from login.
     */
    verifyTotp(req: PendingAuthRequest, reply: FastifyReply, body: TotpVerifyDTO): Promise<void>;
    /**
     * POST /auth/two-factor/verify/passkey/options
     *
     * Get passkey authentication options for 2FA verification.
     * Returns WebAuthn options to be passed to navigator.credentials.get().
     *
     * Requires pending 2FA token from login.
     */
    getPasskeyOptions(req: PendingAuthRequest, reply: FastifyReply): Promise<void>;
    /**
     * POST /auth/two-factor/verify/passkey
     *
     * Verify a passkey to complete 2FA login.
     * On success, the full JWT tokens are issued by the auth service.
     *
     * Requires pending 2FA token from login.
     */
    verifyPasskey(req: PendingAuthRequest, reply: FastifyReply, body: PasskeyAuthenticationVerifyDTO): Promise<void>;
    /**
     * POST /auth/two-factor/verify/backup
     *
     * Verify a backup code to complete 2FA login.
     * Backup codes are single-use and will be marked as used after successful verification.
     *
     * Requires pending 2FA token from login.
     */
    verifyBackupCode(req: PendingAuthRequest, reply: FastifyReply, body: BackupCodeVerifyDTO): Promise<void>;
    /**
     * POST /auth/backup-codes/generate
     *
     * Generate new backup codes for the authenticated user.
     * If the user already has backup codes, use regenerate endpoint instead.
     * Returns the plain text codes ONCE - they should be shown to the user.
     */
    generateBackupCodes(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
    /**
     * POST /auth/backup-codes/regenerate
     *
     * Regenerate backup codes for the authenticated user.
     * This deletes all existing codes (used and unused) and generates a new batch.
     * Returns the new plain text codes ONCE - they should be shown to the user.
     */
    regenerateBackupCodes(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
    /**
     * GET /auth/backup-codes/count
     *
     * Get the count of unused backup codes for the authenticated user.
     */
    getBackupCodesCount(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
}
export {};
//# sourceMappingURL=two-factor.controller.d.ts.map