import { IdentityProviderUser, IdentityProviderRole, IdentityProviderUserPermission, IdentityProviderLoginAttempt, IdentityProviderUserWithRoles } from "@kottster/common";
import { KottsterApp } from "./app";
import { Knex } from "knex";
import { Request } from "express";
/**
 * Supported hashing algorithms
 */
export declare enum HashAlgorithm {
    bcrypt = "bcrypt",
    sha256 = "sha256"
}
/**
 * JWT payload interface
 */
export interface JwtPayload {
    id: IdentityProviderUser['id'];
    check: string;
    iat?: number;
    exp?: number;
}
export declare enum IdentityProviderStrategyType {
    sqlite = "sqlite"
}
export interface IdentityProviderOptions {
    /**
     * The SQLite database file name.
     */
    fileName: string;
    /**
     * The password hashing algorithm to use.
     * @default 'bcrypt'
     */
    passwordHashAlgorithm: keyof typeof HashAlgorithm;
    /**
     * The root admin username
     */
    rootUsername?: string;
    /**
     * The root admin password
     */
    rootPassword?: string;
    /**
     * The root admin custom permissions
     */
    rootCustomPermissions?: string[];
    /**
     * The salt used to sign JWT tokens
     */
    jwtSecretSalt?: string;
}
/**
 * Post-authentication middleware for additional processing after user authorization
 */
export type PostAuthMiddleware = (user: IdentityProviderUserWithRoles, request: Request) => void | Promise<void>;
/**
 * The identity provider
 */
export declare class IdentityProvider {
    private app;
    private jwtSecretSalt?;
    private passwordHashAlgorithm;
    private rootUserUsername?;
    private rootUserPassword?;
    private rootUserSalt?;
    private rootCustomPermissions;
    private db;
    constructor({ fileName, jwtSecretSalt, passwordHashAlgorithm, rootUsername, rootPassword, rootCustomPermissions, }: IdentityProviderOptions);
    get jwtSecret(): string | undefined;
    setApp(app: KottsterApp): void;
    recordLoginAttempt(attempt: Omit<IdentityProviderLoginAttempt, "id" | "attemptedAt">): Promise<void>;
    getRootUserSalt(): string;
    updateRole(roleId: IdentityProviderRole['id'], role: Partial<IdentityProviderRole>): Promise<IdentityProviderRole>;
    deleteRole(roleId: IdentityProviderRole['id']): Promise<void>;
    createUser(user: Omit<IdentityProviderUser, 'id' | 'passwordHash'>, password: string): Promise<IdentityProviderUser>;
    updateUser(userId: IdentityProviderUser['id'], data: Partial<IdentityProviderUser>): Promise<IdentityProviderUser>;
    /**
     * Update user with only non-sensitive fields
     */
    updateUserNonSensitiveFields(userId: IdentityProviderUser['id'], data: Partial<IdentityProviderUser>): Promise<IdentityProviderUser>;
    updateUserPassword(userId: IdentityProviderUser['id'], newPassword: string, temporaryPassword?: boolean): Promise<void>;
    deleteUser(userId: IdentityProviderUser['id']): Promise<void>;
    getUserPermissions(userId: number | string): Promise<string[]>;
    /**
     * Hash a password using the configured algorithm
     */
    hashPassword(password: string): Promise<string>;
    /**
     * Verify a password against a hash
     */
    verifyPassword(password: string, hash: string): Promise<boolean>;
    getRootUserByUsername(username: string): IdentityProviderUser | undefined;
    getRootUserById(userId: number | string): IdentityProviderUser | undefined;
    isUserRoot(userId: number | string): boolean;
    authenticateRootUser(username: string, password: string): Promise<IdentityProviderUser>;
    /**
     * Authenticate a user by username/email and password
     * @param usernameOrEmail - Username or email to identify the user
     * @param password - Plain text password to check
     * @returns Authenticated user
     */
    authenticateUser(usernameOrEmail: string, password: string): Promise<IdentityProviderUser>;
    /**
     * Generate a JWT token for the root user
     * @param expiresIn - Token expiration in seconds (default: 24h = 86400s)
     * @returns JWT token string
     */
    generateTokenForRootUser(expiresIn?: number, providedJwtSecret?: string): Promise<string>;
    /**
     * Generate a JWT token for a user
     * @param usernameOrEmail - Username or email to identify the user
     * @param expiresIn - Token expiration in seconds (default: 24h = 86400s)
     * @returns JWT token string
     */
    generateToken(userId: number | string, expiresIn?: number): Promise<string>;
    /**
     * Verify and decode a JWT token
     * @param token - JWT token to verify
     * @returns Decoded JWT payload or null if invalid
     */
    verifyToken(token: string): Promise<JwtPayload | null>;
    verifyTokenAndGetUser(token: string): Promise<IdentityProviderUser>;
    /**
     * Check if a user has a specific role by role ID
     */
    userHasRole(userId: number | string, roleId: number | string): Promise<boolean>;
    userHasPermissions(userId: number | string, permissions: (keyof typeof IdentityProviderUserPermission | string)[]): Promise<boolean>;
    /**
     * Check if a user has a specific role by role name
     */
    userHasRoleByName(userId: number | string, roleName: string): Promise<boolean>;
    /**
     * Get all roles for a specific user
     */
    getUserRoles(userId: number | string): Promise<IdentityProviderRole[]>;
    initialize(): Promise<void>;
    private ensureTablesExist;
    private createUsersTable;
    private createRolesTable;
    private createUserRolesTable;
    private createLoginAttemptsTable;
    private createSchemaVersionsTable;
    getUserBy(field: 'id' | 'email' | 'username', value: string | number): Promise<IdentityProviderUser | null>;
    getUserWhere(where: Record<string, any> | ((qb: Knex.QueryBuilder) => void)): Promise<IdentityProviderUser | null>;
    getUsers(): Promise<IdentityProviderUser[]>;
    private mapUserFromDb;
    createRole(role: Omit<IdentityProviderRole, 'id'>): Promise<IdentityProviderRole>;
    getRoleBy(field: 'id' | 'name', value: string | number): Promise<IdentityProviderRole | null>;
    getRolesByIds(roleIds: IdentityProviderRole['id'][]): Promise<IdentityProviderRole[]>;
    getRoles(): Promise<IdentityProviderRole[]>;
    private mapRoleFromDb;
    createdLoginAttempt(attempt: Omit<IdentityProviderLoginAttempt, 'id' | 'attemptedAt'>): Promise<void>;
    getRecentFailedAttempts(identifier: string, ipAddress: string, minutes?: number): Promise<number>;
    isIpBlocked(ipAddress: string, maxAttempts?: number, minutes?: number): Promise<boolean>;
    cleanOldLoginAttempts(daysToKeep?: number): Promise<number>;
    updateLastLoginAt(userId: IdentityProviderUser['id']): Promise<void>;
    invalidateAllSessions(userId: IdentityProviderUser['id']): Promise<void>;
    close(): Promise<void>;
    getDb(): Knex;
}