import { Repository } from 'typeorm';
import { BaseMFADevice } from '../entities';
import { AuthResponseDTO } from '../dto/auth-response.dto';
import { AuthChallenge } from '../dto/auth-challenge.dto';
import { IUser } from '../interfaces/entities.interface';
import { ChallengeService } from './challenge.service';
import { JwtService } from './jwt.service';
import { SessionService } from './session.service';
import { EmailVerificationService } from './email-verification.service';
import { PhoneVerificationService } from './phone-verification.service';
import { TrustedDeviceService } from './trusted-device.service';
import { ClientInfoService } from './client-info.service';
import { NAuthConfig } from '../interfaces/config.interface';
import { NAuthLogger } from '../utils/nauth-logger';
import { AuthFlowStateMachineService } from './auth-flow-state-machine.service';
import { AuthFlowContextBuilder } from './auth-flow-context-builder.service';
/**
 * Helper service for challenge-response authentication flows
 *
 * This service determines if a user needs to complete challenges
 * before full authentication can be granted, and generates appropriate
 * responses including MFA challenges.
 *
 * @example
 * ```typescript
 * const response = await challengeHelper.determineAuthResponse(
 *   user,
 *   'login',
 *   { ipAddress: '1.2.3.4' }
 * );
 * ```
 */
export declare class AuthChallengeHelperService {
    private readonly challengeService;
    private readonly jwtService;
    private readonly sessionService;
    private readonly mfaDeviceRepository;
    private readonly logger;
    private readonly stateMachine;
    private readonly contextBuilder;
    private readonly clientInfoService;
    private readonly emailVerificationService?;
    private readonly phoneVerificationService?;
    private readonly trustedDeviceService?;
    constructor(challengeService: ChallengeService, jwtService: JwtService, sessionService: SessionService, mfaDeviceRepository: Repository<BaseMFADevice>, logger: NAuthLogger, stateMachine: AuthFlowStateMachineService, contextBuilder: AuthFlowContextBuilder, clientInfoService: ClientInfoService, emailVerificationService?: EmailVerificationService | undefined, phoneVerificationService?: PhoneVerificationService | undefined, trustedDeviceService?: TrustedDeviceService | undefined);
    /**
     * Create challenge response for authentication
     *
     * Generates a challenge session and returns challenge details to client.
     * Sends verification codes when challenges are created to ensure sequential flow.
     *
     * @param user - User who needs to complete challenges
     * @param challengeName - Type of challenge
     * @param config - Auth configuration
     * @param authMethod - Authentication method ('password' or 'social')
     * @param authProvider - Provider name for social auth (e.g., 'google', 'facebook')
     * @returns Challenge response DTO
     *
     * @example
     * ```typescript
     * const response = await challengeHelper.createChallengeResponse(
     *   user,
     *   AuthChallenge.VERIFY_EMAIL,
     *   config,
     *   'social',
     *   'google'
     * );
     * ```
     */
    createChallengeResponse(user: IUser, challengeName: AuthChallenge, config: NAuthConfig, authMethod?: 'password' | 'social', authProvider?: string, skipAutoSend?: boolean): Promise<AuthResponseDTO>;
    /**
     * Create MFA setup challenge response
     *
     * Generates challenge session for MFA setup requirement.
     * User must set up MFA before being allowed to login.
     *
     * @param user - User requiring MFA setup
     * @param config - Auth configuration
     * @param authMethod - Authentication method ('password' or 'social')
     * @param authProvider - Provider name for social auth (e.g., 'google', 'facebook')
     * @returns MFA setup challenge response
     *
     * @example
     * ```typescript
     * const response = await challengeHelper.createMFASetupChallengeResponse(
     *   user,
     *   config,
     *   'social',
     *   'google'
     * );
     * // Returns: { challengeName: 'MFA_SETUP_REQUIRED', session: '...', challengeParameters: {...} }
     * ```
     */
    createMFASetupChallengeResponse(user: IUser, config: NAuthConfig, authMethod?: 'password' | 'social', authProvider?: string): Promise<AuthResponseDTO>;
    /**
     * Create MFA challenge response
     *
     * Generates challenge session for MFA verification.
     * Returns available MFA methods and challenge parameters.
     *
     * @param user - User requiring MFA
     * @returns MFA challenge response
     * @remarks Client info (ipAddress, userAgent) is automatically extracted from ClientInfoService context
     *
     * @example
     * ```typescript
     * const response = await challengeHelper.createMFAChallengeResponse(
     *   user,
     *   '1.2.3.4',
     *   'Mozilla/5.0...'
     * );
     * // Returns: { challengeName: 'MFA_REQUIRED', session: '...', challengeParameters: {...} }
     * ```
     */
    createMFAChallengeResponse(user: IUser): Promise<AuthResponseDTO>;
    /**
     * Create successful authentication response with tokens
     *
     * Generates tokens and session for fully authenticated user.
     *
     * @param user - Authenticated user
     * @param deviceToken - Device token (optional)
     * @param isTrusted - Whether device is trusted (optional)
     * @param isSocialLogin - Whether this is a social login (optional)
     * @param metadata - Response metadata (optional)
     * @returns Auth response with tokens
     *
     * @example
     * ```typescript
     * const response = await challengeHelper.createSuccessResponse(
     *   user,
     *   'abc123',
     *   true,
     *   false
     * );
     * ```
     */
    createSuccessResponse(user: IUser, deviceToken?: string, isTrusted?: boolean, _isSocialLogin?: boolean, // Reserved for future use
    _metadata?: {
        gracePeriodEndsAt?: Date;
        riskScore?: number;
        riskLevel?: 'low' | 'medium' | 'high';
        blockedUntil?: Date;
        reason?: string;
    }, sessionAuthMethod?: string): Promise<AuthResponseDTO>;
    /**
     * Determine and create appropriate auth response
     *
     * Main entry point that decides whether to return challenges or tokens.
     * Uses state machine to evaluate authentication flow state.
     *
     * @param params - Authentication parameters
     * @param params.user - User attempting authentication
     * @param params.config - Auth configuration
     * @param params.deviceToken - Device token (optional)
     * @param params.isSocialLogin - Whether this is a social login (OAuth) authentication (optional)
     * @param params.skipMFAVerification - Skip MFA verification flag (optional)
     * @param params.authProvider - Social auth provider name (optional)
     * @returns Auth response (either challenge or success)
     *
     * @example
     * ```typescript
     * const response = await challengeHelper.determineAuthResponse({
     *   user,
     *   config,
     *   deviceToken: 'abc123',
     *   isSocialLogin: false
     * });
     * ```
     */
    determineAuthResponse(params: {
        user: IUser;
        config: NAuthConfig;
        deviceToken?: string;
        isSocialLogin?: boolean;
        skipMFAVerification?: boolean;
        authProvider?: string;
    }): Promise<AuthResponseDTO>;
    /**
     * Convert state to authentication response
     *
     * Maps state to appropriate response (challenge or success).
     * Merges state metadata into response.
     *
     * @param state - Authentication flow state
     * @param stateDefinition - State definition
     * @param context - Authentication flow context
     * @param metadata - Response metadata (optional)
     * @returns Authentication response
     */
    private stateToResponse;
}
//# sourceMappingURL=auth-challenge-helper.service.d.ts.map