/**
 * DTO for linking social account
 *
 * Security:
 * - User ID validated as UUID v4
 * - Provider name validated
 * - Code and state validated for length
 */
export declare class LinkSocialAccountDTO {
    /**
     * Social provider name (e.g., 'google', 'apple', 'facebook')
     *
     * Validation:
     * - Must be non-empty string
     * - Max 50 characters
     *
     * Sanitization:
     * - Trimmed and lowercased
     */
    provider: string;
    /**
     * Authorization code from OAuth callback
     *
     * Validation:
     * - Must be non-empty string
     * - Max 1000 characters
     *
     * Sanitization:
     * - Trimmed
     */
    code: string;
    /**
     * State parameter from OAuth callback (for CSRF validation)
     *
     * Validation:
     * - Must be non-empty string
     * - Max 500 characters
     *
     * Sanitization:
     * - Trimmed
     */
    state: string;
}
/**
 * Response DTO for linkSocialAccount
 */
export declare class LinkSocialAccountResponseDTO {
    /**
     * Success message
     */
    message: string;
    /**
     * Provider name
     */
    provider: string;
}
/**
 * DTO for getting linked social accounts
 *
 * Security:
 * - User ID validated as UUID v4
 */
export declare class GetLinkedAccountsDTO {
}
/**
 * Response DTO for getLinkedAccounts
 */
export declare class GetLinkedAccountsResponseDTO {
    /**
     * Array of linked social accounts
     */
    accounts: Array<{
        provider: string;
        providerEmail?: string;
        linkedAt: Date;
        lastUsedAt?: Date;
    }>;
}
/**
 * DTO for unlinking social account
 *
 * Security:
 * - User ID validated as UUID v4
 * - Provider name validated
 */
export declare class UnlinkSocialAccountDTO {
    /**
     * Social provider name (e.g., 'google', 'apple', 'facebook')
     *
     * Validation:
     * - Must be non-empty string
     * - Max 50 characters
     *
     * Sanitization:
     * - Trimmed and lowercased
     */
    provider: string;
}
/**
 * Response DTO for unlinkSocialAccount
 */
export declare class UnlinkSocialAccountResponseDTO {
    /**
     * Success message
     */
    message: string;
}
/**
 * DTO for checking if user can set password
 *
 * Security:
 * - User sub validated as UUID v4
 */
export declare class CanSetPasswordDTO {
    /**
     * User identifier (UUID v4)
     *
     * Validation:
     * - Must be valid UUID v4 format
     *
     * Sanitization:
     * - Trimmed and lowercased
     */
    sub: string;
}
/**
 * Response DTO for canSetPassword
 */
export declare class CanSetPasswordResponseDTO {
    /**
     * Whether user can set password
     */
    canSetPassword: boolean;
}
/**
 * DTO for setting password for social-only user
 *
 * Security:
 * - User sub validated as UUID v4
 * - Password validated for strength (delegated to AuthService)
 */
export declare class SetPasswordForSocialUserDTO {
    /**
     * User identifier (UUID v4)
     *
     * Validation:
     * - Must be valid UUID v4 format
     *
     * Sanitization:
     * - Trimmed and lowercased
     */
    sub: string;
    /**
     * New password
     *
     * Validation:
     * - Must be non-empty string
     * - Min 1 character (actual validation in AuthService)
     * - Max 128 characters (matches DB constraint)
     *
     * Sanitization:
     * - Not trimmed (passwords may have leading/trailing spaces intentionally)
     */
    password: string;
}
/**
 * Response DTO for setPasswordForSocialUser
 */
export declare class SetPasswordForSocialUserResponseDTO {
    /**
     * Success message
     */
    message: string;
}
/**
 * DTO for handling OAuth callback
 *
 * Used when processing OAuth callback from social providers after user authorization.
 *
 * Security:
 * - Code validated for length
 * - State validated for CSRF protection
 *
 * @example
 * ```typescript
 * const dto: HandleCallbackDTO = {
 *   code: 'authorization_code_from_provider',
 *   state: 'csrf_state_token'
 * };
 * ```
 */
export declare class HandleCallbackDTO {
    /**
     * Authorization code from OAuth callback
     *
     * Validation:
     * - Must be non-empty string
     * - Max 2000 characters
     *
     * Sanitization:
     * - Trimmed
     */
    code: string;
    /**
     * State parameter from OAuth callback (for CSRF validation)
     *
     * Validation:
     * - Must be non-empty string
     * - Max 500 characters
     *
     * Sanitization:
     * - Trimmed
     */
    state: string;
    /**
     * Optional profile data from OAuth callback
     *
     * Used by providers (e.g., Apple) that send user profile data directly in the callback.
     * Apple only sends this on the first sign-in with name fields.
     *
     * Validation:
     * - Optional field
     *
     * @example
     * ```typescript
     * // Apple callback with user data
     * {
     *   code: 'abc123',
     *   state: 'xyz789',
     *   profileData: {
     *     name: { firstName: 'John', lastName: 'Doe' },
     *     email: 'user@privaterelay.appleid.com'
     *   }
     * }
     * ```
     */
    profileData?: Record<string, unknown>;
}
/**
 * DTO for verifying social authentication token from native mobile apps
 *
 * Used when mobile apps (iOS, Android) use native SDKs (e.g., Google Sign-In SDK,
 * Sign in with Apple, Facebook SDK) and need to verify tokens on the backend.
 *
 * Supports provider-aware validation:
 * - **google**: requires `idToken`, `accessToken` optional
 * - **apple**: requires `idToken`, `accessToken` optional, `profileData` optional
 * - **facebook**:
 *   - Classic login: requires `accessToken` (when `idToken` not provided)
 *   - Limited Login (OIDC): requires `idToken` (JWT, when `accessToken` not provided)
 *
 * Security:
 * - Provider allow-list enforced
 * - Per-provider required fields validated
 * - Token signature verification performed
 * - Token must be fresh (not expired)
 *
 * @example
 * ```typescript
 * // Google Sign-In from iOS/Android
 * const dto: VerifyTokenDTO = {
 *   provider: 'google',
 *   idToken: 'eyJhbGciOiJSUzI1NiIs...',
 *   accessToken: 'ya29.a0AfH6SM...'
 * };
 *
 * // Sign in with Apple from iOS
 * const dto: VerifyTokenDTO = {
 *   provider: 'apple',
 *   idToken: 'eyJraWQiOiJlWGF1bm...',
 *   profileData: {
 *     name: { firstName: 'John', lastName: 'Doe' },
 *     email: 'user@privaterelay.appleid.com'
 *   }
 * };
 *
 * // Facebook classic login
 * const dto: VerifyTokenDTO = {
 *   provider: 'facebook',
 *   accessToken: 'EAABwzLixnjYBO...'
 * };
 *
 * // Facebook Limited Login (iOS)
 * const dto: VerifyTokenDTO = {
 *   provider: 'facebook',
 *   idToken: 'eyJhbGciOiJSUzI1NiIs...'
 * };
 * ```
 */
export declare class VerifyTokenDTO {
    /**
     * Social provider name
     *
     * Validation:
     * - Must be one of: 'google', 'apple', 'facebook'
     * - Max 50 characters
     *
     * Sanitization:
     * - Trimmed and lowercased
     *
     * @example
     * ```typescript
     * { provider: 'google' }
     * ```
     */
    provider: string;
    /**
     * ID token (JWT) from native SDK
     *
     * Required for:
     * - google (always)
     * - apple (always)
     * - facebook Limited Login (when accessToken is not provided)
     *
     * Validation:
     * - Required for google/apple
     * - Required for facebook only when accessToken is NOT provided
     * - Must be non-empty string
     * - Max 10000 characters (JWT tokens can be large)
     *
     * Sanitization:
     * - Trimmed
     */
    idToken?: string;
    /**
     * Access token (opaque) from native SDK
     *
     * Required for:
     * - facebook classic login (when idToken is not provided)
     *
     * Optional for:
     * - google (provided alongside idToken)
     *
     * Validation:
     * - Required for facebook only when idToken is NOT provided
     * - Must be non-empty string if provided
     * - Max 2000 characters
     *
     * Sanitization:
     * - Trimmed
     */
    accessToken?: string;
    /**
     * Optional profile data from native SDK
     *
     * Some providers (e.g., Apple) only provide user profile data on first sign-in.
     * Clients should capture and send this data for proper user creation.
     *
     * Validation:
     * - Optional
     * - Must be a valid object if provided
     *
     * @example
     * ```typescript
     * {
     *   name: { firstName: 'John', lastName: 'Doe' },
     *   email: 'user@privaterelay.appleid.com'
     * }
     * ```
     */
    profileData?: Record<string, unknown>;
}
/**
 * DTO for exchanging a social redirect exchange token
 *
 * Used in redirect-first social login flow. The backend redirects back to the frontend
 * with an `exchangeToken` in the URL, and the frontend exchanges it for an AuthResponse.
 *
 * Security:
 * - Exchange token validated for length
 * - One-time use (consumed immediately)
 * - Short TTL (default: 60 seconds)
 */
export declare class SocialExchangeDTO {
    /**
     * One-time exchange token from callback redirect URL
     *
     * Validation:
     * - Must be non-empty string
     * - Max 500 characters
     *
     * Sanitization:
     * - Trimmed
     */
    exchangeToken: string;
}
//# sourceMappingURL=social-auth.dto.d.ts.map