import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
import { PendingTwoFactor } from "../entities/pending-two-factor";
import { TwoFactorConfig } from "../entities/two-factor-config";
import { PendingTwoFactorRepository } from "../repositories/pending-two-factor.repository";
import { TwoFactorConfigRepository } from "../repositories/two-factor-config.repository";
import { BackupCodeService } from "./backup-code.service";
import { PasskeyService } from "./passkey.service";
import { TotpService } from "./totp.service";
export type TwoFactorMethod = "totp" | "passkey" | "backup";
export interface TwoFactorStatus {
    isEnabled: boolean;
    preferredMethod: TwoFactorMethod;
    methods: {
        totp: boolean;
        passkey: boolean;
        backup: boolean;
    };
    backupCodesCount: number;
}
export interface PendingSession {
    pendingId: string;
    expiration: Date;
}
export interface VerificationResult {
    success: boolean;
    userId?: string;
}
/**
 * Two-Factor Orchestration Service
 *
 * Coordinates all 2FA functionality including status management, method verification,
 * and pending session handling. This service is the main entry point for 2FA operations
 * and delegates to specialized services (TOTP, Passkey, BackupCode) for specific tasks.
 */
export declare class TwoFactorService {
    private readonly jsonApiService;
    private readonly twoFactorConfigRepository;
    private readonly pendingTwoFactorRepository;
    private readonly totpService;
    private readonly passkeyService;
    private readonly backupCodeService;
    private readonly pendingTtlSeconds;
    private readonly maxTotpAttempts;
    private readonly maxPasskeyAttempts;
    private readonly maxBackupAttempts;
    constructor(jsonApiService: JsonApiService, twoFactorConfigRepository: TwoFactorConfigRepository, pendingTwoFactorRepository: PendingTwoFactorRepository, totpService: TotpService, passkeyService: PasskeyService, backupCodeService: BackupCodeService);
    /**
     * Get the 2FA configuration for a user.
     *
     * @param userId - The user's ID
     * @returns The user's TwoFactorConfig, or null if not configured
     */
    getConfig(userId: string): Promise<TwoFactorConfig | null>;
    /**
     * Get the full 2FA status for a user including available methods.
     *
     * @param userId - The user's ID
     * @returns JSON:API response with 2FA status
     */
    getStatus(userId: string): Promise<any>;
    /**
     * Enable 2FA for a user.
     * Requires at least one 2FA method to be configured.
     *
     * @param userId - The user's ID
     * @param preferredMethod - The preferred 2FA method (default: 'totp')
     * @throws BadRequestException if no 2FA methods are configured
     * @returns JSON:API response with the 2FA config
     */
    enable(userId: string, preferredMethod?: TwoFactorMethod): Promise<any>;
    /**
     * Disable 2FA for a user.
     *
     * @param userId - The user's ID
     */
    disable(userId: string): Promise<TwoFactorConfig | null>;
    /**
     * Set the preferred 2FA method for a user.
     *
     * @param userId - The user's ID
     * @param method - The preferred method
     * @throws BadRequestException if the method is not available
     */
    setPreferredMethod(userId: string, method: TwoFactorMethod): Promise<TwoFactorConfig>;
    /**
     * Create a pending 2FA session after successful password validation.
     * This is called by the auth service when a user with 2FA enabled logs in.
     *
     * @param userId - The user's ID
     * @returns The pending session info
     */
    createPendingSession(userId: string): Promise<PendingSession>;
    /**
     * Get available 2FA methods for a user during login.
     *
     * @param userId - The user's ID
     * @returns Array of available method names
     */
    getAvailableMethods(userId: string): Promise<TwoFactorMethod[]>;
    /**
     * Verify a TOTP code for 2FA login.
     *
     * @param pendingId - The pending session ID from createPendingSession
     * @param code - The 6-digit TOTP code
     * @returns JSON:API response with verification result
     */
    verifyTotp(pendingId: string, code: string): Promise<any>;
    /**
     * Verify a passkey for 2FA login.
     *
     * @param pendingId - The pending session ID
     * @param response - The WebAuthn authentication response
     * @returns JSON:API response with verification result
     */
    verifyPasskey(pendingId: string, response: Parameters<typeof PasskeyService.prototype.verifyAuthentication>[0]["response"]): Promise<any>;
    /**
     * Verify a backup code for 2FA login.
     *
     * @param pendingId - The pending session ID
     * @param code - The backup code
     * @returns JSON:API response with verification result
     */
    verifyBackupCode(pendingId: string, code: string): Promise<any>;
    /**
     * Get pending session info by ID.
     *
     * @param pendingId - The pending session ID
     * @returns The pending session data if found
     */
    getPendingSession(pendingId: string): Promise<{
        pending: PendingTwoFactor;
        userId: string;
    } | null>;
    /**
     * Delete a pending session.
     *
     * @param pendingId - The pending session ID
     */
    deletePendingSession(pendingId: string): Promise<void>;
    /**
     * Update backup codes count in the config.
     * Called after generating or using backup codes.
     *
     * @param userId - The user's ID
     */
    updateBackupCodesCount(userId: string): Promise<void>;
    /**
     * Check if 2FA should be automatically disabled due to no methods remaining.
     * Called when removing the last TOTP authenticator or passkey.
     *
     * @param userId - The user's ID
     * @returns true if 2FA was disabled
     */
    checkAndDisableIfNoMethods(userId: string): Promise<boolean>;
    /**
     * Validate a pending session and return its data.
     *
     * @param pendingId - The pending session ID
     * @param expectedType - The expected challenge type
     * @throws NotFoundException if session not found
     * @throws BadRequestException if session expired or wrong type
     */
    private validateAndGetPending;
}
//# sourceMappingURL=two-factor.service.d.ts.map