import { PasswordConfig } from '../interfaces/config.interface';
/**
 * Validation result for password policy checks
 */
export interface PasswordValidationResult {
    /** Whether the password passes all validation rules */
    valid: boolean;
    /** List of validation errors if any */
    errors: string[];
}
/**
 * Password Service
 *
 * Handles all password-related operations including:
 * - Hashing passwords with Argon2id
 * - Verifying passwords against hashes
 * - Validating password policy compliance
 * - Checking password history to prevent reuse
 *
 * Security Features:
 * - Argon2id hashing (winner of Password Hashing Competition)
 * - Configurable password policy
 * - Common password detection (10,000+ passwords loaded from file)
 * - Password history tracking
 * - Protection against timing attacks
 *
 * SECURITY FIX #8: Now loads 10K+ common passwords from bundled file
 *
 * @example
 * ```typescript
 * const passwordService = new PasswordService(config);
 *
 * // Hash a password
 * const hash = await passwordService.hashPassword('SecurePass123!');
 *
 * // Verify a password
 * const isValid = await passwordService.verifyPassword('SecurePass123!', hash);
 *
 * // Validate password policy
 * const validation = await passwordService.validatePassword('weak');
 * if (!validation.valid) {
 *   logger.error('Password validation failed', { errors: validation.errors });
 * }
 * ```
 */
export declare class PasswordService {
    /** Password policy configuration */
    private readonly config;
    /** Common passwords Set (10K+ passwords loaded at startup) */
    private readonly commonPasswords;
    constructor(passwordConfig?: PasswordConfig);
    /**
     * Hash a password using Argon2id algorithm
     *
     * Argon2id is the recommended password hashing algorithm as of 2025.
     * It combines Argon2i (resistant to side-channel attacks) and Argon2d
     * (resistant to GPU cracking attacks).
     *
     * @param password - Plain text password to hash
     * @returns Hashed password string (includes salt and algorithm parameters)
     *
     * @example
     * ```typescript
     * const hash = await passwordService.hashPassword('MySecurePassword123!');
     * // Returns: $argon2id$v=19$m=65536,t=3,p=4$...
     * ```
     */
    hashPassword(password: string): Promise<string>;
    /**
     * Verify a password against its hash
     *
     * This method is resistant to timing attacks by using constant-time
     * comparison internally via Argon2's verify function.
     *
     * @param password - Plain text password to verify
     * @param hash - Hashed password to compare against
     * @returns True if password matches hash, false otherwise
     *
     * @example
     * ```typescript
     * const isValid = await passwordService.verifyPassword(
     *   'MyPassword123!',
     *   '$argon2id$v=19$m=65536,t=3,p=4$...'
     * );
     * ```
     */
    verifyPassword(password: string, hash: string): Promise<boolean>;
    /**
     * Validate a password against configured policy rules
     *
     * Checks multiple security criteria:
     * - Length requirements (min/max)
     * - Character complexity (uppercase, lowercase, numbers, special chars)
     * - Common password detection
     * - User information leakage (username/email in password)
     *
     * @param password - Password to validate
     * @param userInfo - Optional user information to check against (email, username)
     * @returns Validation result with any errors
     *
     * @example
     * ```typescript
     * const result = await passwordService.validatePassword('weak', {
     *   email: 'user@example.com',
     *   username: 'john'
     * });
     *
     * if (!result.valid) {
     *   logger.error('Password validation failed', { errors: result.errors });
     *   // ['Password must be at least 8 characters', ...]
     * }
     * ```
     */
    validatePassword(password: string, userInfo?: {
        email?: string;
        username?: string;
    }): Promise<PasswordValidationResult>;
    /**
     * Check if a password has been used before (password history check)
     *
     * Prevents users from reusing recent passwords, which is a security
     * best practice to limit the impact of compromised passwords.
     *
     * @param password - Plain text password to check
     * @param passwordHistory - Array of previous password hashes
     * @returns True if password was used before, false otherwise
     *
     * @example
     * ```typescript
     * const isReused = await passwordService.isPasswordInHistory(
     *   'NewPassword123!',
     *   user.passwordHistory // Last 5 passwords
     * );
     *
     * if (isReused) {
     *   throw new Error('Cannot reuse recent passwords');
     * }
     * ```
     */
    isPasswordInHistory(password: string, passwordHistory: string[]): Promise<boolean>;
    /**
     * Add a password hash to history, maintaining the configured limit
     *
     * @param currentHistory - Current password history array
     * @param newHash - New password hash to add
     * @returns Updated history array with new hash
     *
     * @example
     * ```typescript
     * user.passwordHistory = passwordService.addToHistory(
     *   user.passwordHistory,
     *   newPasswordHash
     * );
     * ```
     */
    addToHistory(currentHistory: string[], newHash: string): string[];
}
//# sourceMappingURL=password.service.d.ts.map