/**
 * Admin Reset Password Request DTO
 *
 * Request DTO for admin-initiated password reset workflow.
 * Allows resetting a user's password by sub (UUID).
 *
 * Security:
 * - Admin-only operation (should be protected by admin guard)
 * - User sub validated
 * - Code + optional link delivery (like email verification)
 * - Configurable expiry (default: 1 hour)
 * - Optional immediate session revocation
 * - No rate limiting (admin bypass)
 *
 * @example
 * ```typescript
 * // With link for consumer app custom UI
 * await authService.adminResetPassword({
 *   sub: 'a21b654c-2746-4168-acee-c175083a65cd',
 *   baseUrl: 'https://myapp.com/reset-password',
 *   deliveryMethod: 'email',
 *   revokeSessions: true
 * });
 *
 * // Code only (no link)
 * await authService.adminResetPassword({
 *   sub: 'a21b654c-2746-4168-acee-c175083a65cd',
 *   deliveryMethod: 'email'
 * });
 * ```
 */
/**
 * Request DTO for admin password reset
 */
export declare class AdminResetPasswordDTO {
    /**
     * User sub (UUID)
     *
     * Validation:
     * - Must be a valid UUID v4
     *
     * Sanitization:
     * - Trimmed
     * - Lowercased for consistency
     *
     * @example "a21b654c-2746-4168-acee-c175083a65cd"
     */
    sub: string;
    /**
     * Delivery method for reset code
     *
     * Validation:
     * - Must be 'email' or 'sms'
     * - Optional (defaults to 'email')
     *
     * @default 'email'
     * @example 'email' | 'sms'
     */
    deliveryMethod?: 'email' | 'sms';
    /**
     * Base URL for building reset link
     *
     * Validation:
     * - Must be valid URL with http:// or https://
     * - Supports localhost URLs (e.g., http://localhost:4200)
     * - Max 2048 characters
     * - Optional
     *
     * Sanitization:
     * - Trimmed
     *
     * WHY: Allows consumer apps to build custom reset UI (e.g., myapp.com/reset-password?token=xxx)
     * Like email verification, supports both code AND link delivery
     *
     * @example "https://myapp.com/reset-password"
     * @example "http://localhost:4200"
     */
    baseUrl?: string;
    /**
     * Code expiry in seconds
     *
     * Validation:
     * - Must be number
     * - Min 300 seconds (5 minutes)
     * - Max 86400 seconds (24 hours)
     * - Optional
     *
     * @default 3600 (1 hour - longer than user-initiated 15min)
     * @example 3600
     */
    codeExpiresIn?: number;
    /**
     * Revoke all active sessions immediately (before sending email)
     *
     * Validation:
     * - Must be boolean
     * - Optional
     *
     * WHY: Admin can lock user out immediately while sending reset email
     * Different from confirmAdminResetPassword which always revokes on completion
     *
     * @default false
     * @example true
     */
    revokeSessions?: boolean;
    /**
     * Reason for admin-initiated reset (for audit trail)
     *
     * Validation:
     * - Must be string
     * - Max 500 characters
     * - Optional
     *
     * Sanitization:
     * - Trimmed
     *
     * @example "User reported account compromise"
     */
    reason?: string;
}
/**
 * Admin Reset Password Response DTO
 *
 * Response DTO for admin-initiated password reset request.
 *
 * @example
 * ```typescript
 * {
 *   success: true,
 *   destination: 'u***r@example.com',
 *   deliveryMedium: 'email',
 *   expiresIn: 3600,
 *   sessionsRevoked: 3
 * }
 * ```
 */
export declare class AdminResetPasswordResponseDTO {
    /**
     * Success indicator
     * Always true on successful request
     */
    success: boolean;
    /**
     * Masked destination where code was sent
     * @example "u***r@example.com" | "***-***-5678"
     */
    destination?: string;
    /**
     * Delivery medium used
     * @example "email" | "sms"
     */
    deliveryMedium?: 'email' | 'sms';
    /**
     * Code expiry in seconds
     * @example 3600
     */
    expiresIn?: number;
    /**
     * Number of sessions revoked (if revokeSessions was true)
     * @example 3
     */
    sessionsRevoked?: number;
}
/**
 * Confirm Admin Reset Password DTO
 *
 * User completes admin-initiated password reset with a verification code.
 *
 * NOTE:
 * - Link support is optional, but links carry the same verification `code` as a query parameter
 *   (e.g., `...?code=123456`) to keep consumer apps consistent (code-only).
 *
 * Security:
 * - Code is required
 * - Attempt tracking enforced (max attempts configured in password reset service)
 * - Always revokes all sessions on completion
 * - Always sets mustChangePassword flag
 * - Public endpoint (user doesn't need to be authenticated)
 *
 * @example
 * ```typescript
 * await authService.confirmAdminResetPassword({
 *   identifier: 'user@example.com',
 *   code: '123456',
 *   newPassword: 'NewSecurePass123!'
 * });
 * ```
 */
export declare class ConfirmAdminResetPasswordDTO {
    /**
     * User identifier used to locate the account
     *
     * Accepts email, username, or phone depending on application login policy
     *
     * Validation:
     * - Must be a string
     * - Max 255 characters
     *
     * Sanitization:
     * - Trimmed
     * - Lowercased when email format detected (contains '@')
     *
     * @example "user@example.com"
     */
    identifier: string;
    /**
     * Verification code from email/SMS (6-10 digits)
     *
     * Validation:
     * - Must be string
     * - Length 6-10 characters
     * - Required
     *
     * Sanitization:
     * - Trimmed
     *
     * WHY: Short code for manual entry, subject to attempt tracking
     *
     * @example "123456"
     */
    code: string;
    /**
     * New password
     *
     * Validation:
     * - Must be string
     * - Min 8 characters (security requirement)
     * - Max 128 characters (prevents DoS)
     *
     * Note: NOT trimmed (passwords can have leading/trailing spaces)
     * Additional checks in service layer:
     * - Password strength (if configured)
     * - Password history (prevent reuse)
     *
     * @example "NewSecurePassword123!"
     */
    newPassword: string;
}
/**
 * Confirm Admin Reset Password Response DTO
 *
 * Response DTO for successful admin password reset completion.
 *
 * @example
 * ```typescript
 * {
 *   success: true
 * }
 * ```
 */
export declare class ConfirmAdminResetPasswordResponseDTO {
    /**
     * Success indicator
     * Always true on successful reset
     */
    success: boolean;
}
//# sourceMappingURL=admin-reset-password.dto.d.ts.map