import { Repository } from 'typeorm';
import { BaseUser, BaseLoginAttempt, BaseMFADevice, BaseChallengeSession, BaseVerificationToken, BaseSocialAccount, BaseAuthAudit, BaseTrustedDevice, BaseSession } from '../entities';
import { PasswordService } from './password.service';
import { SessionService } from './session.service';
import { EmailVerificationService } from './email-verification.service';
import { PhoneVerificationService } from './phone-verification.service';
import { ClientInfoService } from './client-info.service';
import { ChallengeService } from './challenge.service';
import { AuthChallengeHelperService } from './auth-challenge-helper.service';
import { AccountLockoutStorageService } from '../storage/account-lockout-storage.service';
import { InternalAuthAuditService as AuthAuditService } from './auth-audit.service';
import { TrustedDeviceService } from './trusted-device.service';
import { AdminSignupDTO, AdminSignupResponseDTO } from '../dto/admin-signup.dto';
import { AdminSignupSocialDTO, AdminSignupSocialResponseDTO } from '../dto/admin-signup-social.dto';
import { DeleteUserDTO, DeleteUserResponseDTO } from '../dto/delete-user.dto';
import { GetUsersDTO, GetUsersResponseDTO } from '../dto/get-users.dto';
import { DisableUserDTO, DisableUserResponseDTO } from '../dto/disable-user.dto';
import { EnableUserDTO, EnableUserResponseDTO } from '../dto/enable-user.dto';
import { GetUserByEmailDTO } from '../dto/get-user-by-email.dto';
import { GetUserByIdDTO } from '../dto/get-user-by-id.dto';
import { UserResponseDTO } from '../dto/user-response.dto';
import { GetUserSessionsDTO } from '../dto/get-user-sessions.dto';
import { GetUserSessionsResponseDTO } from '../dto/get-user-sessions-response.dto';
import { LogoutAllResponseDTO } from '../dto/logout-all-response.dto';
import { AdminLogoutAllDTO } from '../dto/admin-logout-all.dto';
import { AdminRevokeSessionDTO } from '../dto/admin-revoke-session.dto';
import { LogoutSessionResponseDTO } from '../dto/logout-session-response.dto';
import { SetMustChangePasswordDTO } from '../dto/set-must-change-password.dto';
import { SetMustChangePasswordResponseDTO } from '../dto/set-must-change-password-response.dto';
import { AdminSetPasswordDTO, AdminSetPasswordResponseDTO } from '../dto/admin-set-password.dto';
import { AdminResetPasswordDTO, AdminResetPasswordResponseDTO, ConfirmAdminResetPasswordDTO, ConfirmAdminResetPasswordResponseDTO } from '../dto/admin-reset-password.dto';
import { UpdateVerifiedStatusRequestDTO } from '../dto/update-verified-status-request.dto';
import { NAuthConfig } from '../interfaces/config.interface';
import { NAuthLogger } from '../utils/nauth-logger';
import { HookRegistryService } from './hook-registry.service';
import { PasswordResetService } from './password-reset.service';
import { SocialAuthService } from './social-auth.service';
import { AdminUpdateUserAttributesDTO } from '../dto/admin-update-user-attributes.dto';
/**
 * Administrative authentication service
 *
 * Provides admin-only operations for managing users, sessions, and password workflows.
 * This service is intentionally separate from AuthService to keep user self-service
 * APIs isolated from admin actions.
 *
 * @example
 * ```typescript
 * const result = await adminAuthService.disableUser({ sub: 'user-uuid' });
 * ```
 */
export declare class AdminAuthService {
    private readonly userRepository;
    private readonly loginAttemptRepository;
    private readonly passwordService;
    private readonly sessionService;
    private readonly challengeService;
    private readonly challengeHelper;
    private readonly emailVerificationService;
    private readonly clientInfoService;
    private readonly accountLockoutStorage;
    private readonly config;
    private readonly logger;
    private readonly hookRegistry;
    private readonly auditService?;
    private readonly phoneVerificationService?;
    private readonly mfaDeviceRepository?;
    private readonly trustedDeviceService?;
    private readonly passwordResetService?;
    private readonly socialAuthService?;
    private readonly sessionRepository?;
    private readonly verificationTokenRepository?;
    private readonly socialAccountRepository?;
    private readonly challengeSessionRepository?;
    private readonly authAuditRepository?;
    private readonly trustedDeviceRepository?;
    private readonly helpers;
    private readonly userService;
    constructor(userRepository: Repository<BaseUser>, loginAttemptRepository: Repository<BaseLoginAttempt>, passwordService: PasswordService, sessionService: SessionService, challengeService: ChallengeService, challengeHelper: AuthChallengeHelperService, emailVerificationService: EmailVerificationService, clientInfoService: ClientInfoService, accountLockoutStorage: AccountLockoutStorageService, config: NAuthConfig, logger: NAuthLogger, hookRegistry: HookRegistryService, auditService?: AuthAuditService | undefined, phoneVerificationService?: PhoneVerificationService | undefined, mfaDeviceRepository?: Repository<BaseMFADevice> | undefined, trustedDeviceService?: TrustedDeviceService | undefined, passwordResetService?: PasswordResetService | undefined, socialAuthService?: SocialAuthService | undefined, sessionRepository?: Repository<BaseSession> | undefined, verificationTokenRepository?: Repository<BaseVerificationToken> | undefined, socialAccountRepository?: Repository<BaseSocialAccount> | undefined, challengeSessionRepository?: Repository<BaseChallengeSession> | undefined, authAuditRepository?: Repository<BaseAuthAudit> | undefined, trustedDeviceRepository?: Repository<BaseTrustedDevice> | undefined);
    /**
     * Administrative user deletion with complete cascade cleanup
     *
     * @param dto - User sub to delete
     * @returns Deletion confirmation with cascade counts
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.deleteUser({ sub: 'user-uuid-123' });
     * ```
     */
    deleteUser(dto: DeleteUserDTO): Promise<DeleteUserResponseDTO>;
    /**
     * Get paginated list of users with advanced filtering
     *
     * @param dto - Filters, pagination, sorting
     * @returns Paginated user list with metadata
     * @throws {NAuthException} When validation fails
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.getUsers({ page: 1, limit: 20 });
     * ```
     */
    getUsers(dto: GetUsersDTO): Promise<GetUsersResponseDTO>;
    /**
     * Administrative permanent account locking
     *
     * @param dto - User sub and optional reason
     * @returns User object with updated lock status and revoked session count
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.disableUser({ sub: 'user-uuid-123' });
     * ```
     */
    disableUser(dto: DisableUserDTO): Promise<DisableUserResponseDTO>;
    /**
     * Enable (unlock) user account
     *
     * @param dto - User sub to enable
     * @returns User object with updated lock status
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.enableUser({ sub: 'user-uuid-123' });
     * ```
     */
    enableUser(dto: EnableUserDTO): Promise<EnableUserResponseDTO>;
    /**
     * Get user by ID (sub)
     *
     * @param dto - GetUserByIdDTO containing sub
     * @returns User response DTO or null if not found
     * @throws {NAuthException} When validation fails
     *
     * @example
     * ```typescript
     * const user = await adminAuthService.getUserById({ sub: 'user-uuid' });
     * ```
     */
    getUserById(dto: GetUserByIdDTO): Promise<UserResponseDTO | null>;
    /**
     * Get user by email address.
     *
     * @param dto - GetUserByEmailDTO containing email and optional requireEmailVerified
     * @returns User response DTO or null if not found
     * @throws {NAuthException} When validation fails
     *
     * @example
     * ```typescript
     * const user = await adminAuthService.getUserByEmail({ email: 'user@example.com' });
     * ```
     */
    getUserByEmail(dto: GetUserByEmailDTO): Promise<UserResponseDTO | null>;
    /**
     * Require user to change password at next login.
     *
     * @param dto - SetMustChangePasswordDTO containing sub
     * @returns Success response
     * @throws {NAuthException} If user is not found or cannot change password
     *
     * @example
     * ```typescript
     * await adminAuthService.setMustChangePassword({ sub: 'user-uuid-123' });
     * ```
     */
    setMustChangePassword(dto: SetMustChangePasswordDTO): Promise<SetMustChangePasswordResponseDTO>;
    /**
     * Update email and/or phone verification status.
     *
     * @param dto - Request DTO containing sub and verification status flags
     * @returns Updated user object
     * @throws {NAuthException} If user not found or trying to verify non-existent email/phone
     *
     * @example
     * ```typescript
     * await adminAuthService.updateVerifiedStatus({ sub: 'user-uuid', isEmailVerified: true });
     * ```
     */
    updateVerifiedStatus(dto: UpdateVerifiedStatusRequestDTO): Promise<UserResponseDTO>;
    /**
     * Administrative user creation with override capabilities
     *
     * @param dto - Admin signup DTO with override flags
     * @returns User object and optionally generated password
     * @throws {NAuthException} EMAIL_EXISTS | USERNAME_EXISTS | PHONE_EXISTS | WEAK_PASSWORD
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.signup({ email: 'user@example.com', generatePassword: true });
     * ```
     */
    signup(dto: AdminSignupDTO): Promise<AdminSignupResponseDTO>;
    /**
     * Administrative social user import with override capabilities
     *
     * @param dto - Admin social signup DTO with social account details
     * @returns User object and social account confirmation
     * @throws {NAuthException} EMAIL_EXISTS | USERNAME_EXISTS | PHONE_EXISTS | SOCIAL_ACCOUNT_EXISTS | WEAK_PASSWORD
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.signupSocial({
     *   email: 'user@example.com',
     *   provider: 'google',
     *   providerId: 'google_12345',
     * });
     * ```
     */
    signupSocial(dto: AdminSignupSocialDTO): Promise<AdminSignupSocialResponseDTO>;
    /**
     * Global signout (admin-initiated)
     *
     * @param dto - Target user sub and optional forgetDevices flag
     * @returns Number of sessions revoked
     * @throws {NAuthException} NOT_FOUND if user not found
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.logoutAll({ sub: 'user-uuid', forgetDevices: true });
     * ```
     */
    logoutAll(dto: AdminLogoutAllDTO): Promise<LogoutAllResponseDTO>;
    /**
     * Get all active sessions for a user (admin)
     *
     * @param dto - Contains target user sub
     * @returns Array of sessions with device info, auth method, and isCurrent flag
     * @throws {NAuthException} NOT_FOUND if user not found
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.getUserSessions({ sub: 'user-uuid' });
     * ```
     */
    getUserSessions(dto: GetUserSessionsDTO): Promise<GetUserSessionsResponseDTO>;
    /**
     * Revoke a specific user session by ID (admin)
     *
     * @param dto - Contains sessionId and user sub
     * @returns Success status and whether it was the current session
     * @throws {NAuthException} NOT_FOUND if user not found
     * @throws {NAuthException} SESSION_NOT_FOUND if session not found
     * @throws {NAuthException} FORBIDDEN if session doesn't belong to user
     *
     * @example
     * ```typescript
     * await adminAuthService.revokeUserSession({ sub: 'user-uuid', sessionId: '123' });
     * ```
     */
    revokeUserSession(dto: AdminRevokeSessionDTO): Promise<LogoutSessionResponseDTO>;
    /**
     * Update user profile attributes (admin)
     *
     * @param dto - AdminUpdateUserAttributesDTO containing sub and fields to update
     * @returns Updated user object
     * @throws {NAuthException} If user not found or unique constraint violated
     *
     * @example
     * ```typescript
     * const user = await adminAuthService.updateUserAttributes({ sub: 'user-uuid', email: 'new@example.com' });
     * ```
     */
    updateUserAttributes(dto: AdminUpdateUserAttributesDTO): Promise<UserResponseDTO>;
    /**
     * Admin-only: Initiate a code-based password reset workflow.
     *
     * @param dto - Admin reset password request
     * @returns Response with masked destination, expiry, and sessions revoked count
     * @throws {NAuthException} NOT_FOUND when user not found
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.resetPassword({ sub: 'user-uuid', deliveryMethod: 'email' });
     * ```
     */
    resetPassword(dto: AdminResetPasswordDTO): Promise<AdminResetPasswordResponseDTO>;
    /**
     * Complete admin-initiated password reset with a verification code.
     *
     * @param dto - Confirm admin reset password request
     * @returns Success response
     * @throws {NAuthException} NOT_FOUND | PASSWORD_RESET_CODE_INVALID | PASSWORD_RESET_CODE_EXPIRED | PASSWORD_RESET_MAX_ATTEMPTS | WEAK_PASSWORD | PASSWORD_REUSED | INVALID_CREDENTIALS
     *
     * @example
     * ```typescript
     * await adminAuthService.confirmResetPassword({ identifier: 'user@example.com', code: '123456', newPassword: 'NewPass123!' });
     * ```
     */
    confirmResetPassword(dto: ConfirmAdminResetPasswordDTO): Promise<ConfirmAdminResetPasswordResponseDTO>;
    /**
     * Admin-only: Reset a user's password by sub.
     *
     * @param dto - Admin reset password request
     * @returns Response with success status and session revocation count
     * @throws {NAuthException} If user not found, user has no password (social-only), or password validation fails
     *
     * @example
     * ```typescript
     * const result = await adminAuthService.setPassword({ sub: 'user-uuid', newPassword: 'NewPass123!' });
     * ```
     */
    setPassword(dto: AdminSetPasswordDTO): Promise<AdminSetPasswordResponseDTO>;
    /**
     * Calculate grace period status for a user.
     *
     * @param user - User to check
     * @returns Grace period status with isActive flag and endsAt date
     */
    private calculateGracePeriodForUser;
}
//# sourceMappingURL=admin-auth.service.d.ts.map