import { Repository } from 'typeorm';
import { BaseUser } from '../entities';
import { IUser } from '../interfaces/entities.interface';
import { AuthService } from './auth.service';
import { SocialAuthService } from './social-auth.service';
import { TrustedDeviceService } from './trusted-device.service';
import { JwtService } from './jwt.service';
import { SessionService } from './session.service';
import { AuthChallengeHelperService } from './auth-challenge-helper.service';
import { ClientInfoService } from './client-info.service';
import { PhoneVerificationService } from './phone-verification.service';
import { InternalAuthAuditService as AuthAuditService } from './auth-audit.service';
import { NAuthConfig, SocialProviderConfig } from '../interfaces/config.interface';
import { ISocialAuthStateStore } from '../interfaces/social-auth-state-store.interface';
import { NAuthLogger } from '../utils/nauth-logger';
import { AuthResponseDTO, HandleCallbackDTO, VerifyTokenDTO } from '../dto';
import { OAuthUserProfile } from '../interfaces/oauth.interface';
import { ISocialAuthProviderService } from '../interfaces/social-auth-provider.interface';
/**
 * Base Social Auth Provider Service
 *
 * Abstract base class that provides common functionality for all social auth providers.
 * Provider-specific services (Google, Apple, Facebook, GitHub, etc.) should extend this class
 * and implement provider-specific OAuth client logic.
 *
 * This base class handles:
 * - User creation/lookup
 * - Social account linking
 * - JWT token generation
 * - Session management
 * - Challenge system integration
 *
 * **Key Design:**
 * - No hardcoded provider names - works with any provider
 * - Provider config accessed dynamically via `providerName`
 * - Future developers can add new providers without modifying this class
 *
 * @example
 * ```typescript
 * @Injectable()
 * export class GitHubSocialAuthService extends BaseSocialAuthProviderService {
 *   readonly providerName = 'github';
 *
 *   constructor(
 *     // ... dependencies
 *     private readonly githubOAuthClient: GitHubOAuthClient,
 *   ) {
 *     super(/* ... base dependencies *\/);
 *   }
 *
 *   protected async getOAuthProfile(code: string, state: string): Promise<OAuthUserProfile> {
 *     // Provider-specific implementation
 *   }
 * }
 * ```
 */
export declare abstract class BaseSocialAuthProviderService implements ISocialAuthProviderService {
    protected readonly config: NAuthConfig;
    protected readonly logger: NAuthLogger;
    protected readonly authService: AuthService;
    protected readonly socialAuthService: SocialAuthService;
    protected readonly jwtService: JwtService;
    protected readonly sessionService: SessionService;
    protected readonly challengeHelper: AuthChallengeHelperService;
    protected readonly clientInfoService: ClientInfoService;
    protected readonly stateStore: ISocialAuthStateStore;
    protected readonly userRepository: Repository<BaseUser>;
    protected readonly phoneVerificationService?: PhoneVerificationService | undefined;
    protected readonly auditService?: AuthAuditService | undefined;
    protected readonly trustedDeviceService?: TrustedDeviceService | undefined;
    protected readonly hookRegistry?: import("./hook-registry.service").HookRegistryService | undefined;
    abstract readonly providerName: string;
    constructor(config: NAuthConfig, logger: NAuthLogger, authService: AuthService, socialAuthService: SocialAuthService, jwtService: JwtService, sessionService: SessionService, challengeHelper: AuthChallengeHelperService, clientInfoService: ClientInfoService, stateStore: ISocialAuthStateStore, userRepository: Repository<BaseUser>, phoneVerificationService?: PhoneVerificationService | undefined, auditService?: AuthAuditService | undefined, // Optional - audit trail service (enabled via config.auditLogs.enabled)
    trustedDeviceService?: TrustedDeviceService | undefined, // Optional - only available when rememberDevices is not 'never'
    hookRegistry?: import("./hook-registry.service").HookRegistryService | undefined);
    /**
     * Get provider configuration dynamically
     *
     * Accesses config.social[providerName] without hardcoding provider names.
     * This allows any provider to work without modifying core code.
     *
     * @returns Provider configuration from NAuthConfig
     * @protected
     */
    protected getProviderConfig(): SocialProviderConfig | null;
    /**
     * Generate OAuth authorization URL for this provider
     *
     * Must be implemented by provider-specific services to generate the OAuth URL.
     *
     * @param state - Optional state parameter for CSRF protection
     * @returns Authorization URL to redirect user to
     * @throws {BadRequestException} When provider is not properly configured
     */
    abstract getAuthUrl(state?: string): Promise<string>;
    /**
     * Get user profile from OAuth callback
     *
     * Must be implemented by provider-specific services to exchange code for tokens
     * and fetch user profile.
     *
     * @param code - Authorization code from OAuth callback
     * @param state - State parameter from OAuth callback
     * @param profileData - Optional profile data from OAuth callback (e.g., Apple user field)
     * @returns OAuth user profile
     * @protected
     */
    protected abstract getOAuthProfile(code: string, state: string, profileData?: Record<string, unknown>): Promise<OAuthUserProfile>;
    /**
     * Verify social authentication token from native mobile apps
     *
     * Must be implemented by provider-specific services to verify ID tokens.
     *
     * @param idToken - ID token from native SDK
     * @param accessToken - Optional access token from native SDK
     * @param profileData - Optional profile data from native SDK
     * @returns OAuth user profile
     * @protected
     */
    protected abstract verifyNativeToken(idToken: string, accessToken?: string, profileData?: Record<string, unknown>): Promise<OAuthUserProfile>;
    /**
     * Handle OAuth callback and authenticate user
     *
     * Uses the provider-specific getOAuthProfile method and then handles
     * user creation, session management, and token generation.
     *
     * @param dto - HandleCallbackDTO containing code and state
     * @returns AuthResponseDTO with tokens and user data
     * @throws {NAuthException} SOCIAL_CONFIG_MISSING if provider not configured
     * @throws {NAuthException} SOCIAL_TOKEN_INVALID if OAuth flow fails
     *
     * @example
     * ```typescript
     * const response = await googleService.handleCallback({
     *   code: 'auth_code_from_google',
     *   state: 'csrf_state_token'
     * });
     * ```
     */
    handleCallback(dto: HandleCallbackDTO): Promise<AuthResponseDTO>;
    /**
     * Verify social authentication token from native mobile apps
     *
     * Used when mobile apps use native SDKs (Google Sign-In, Sign in with Apple, etc.)
     * to obtain ID tokens that need backend verification.
     *
     * @param dto - VerifyTokenDTO containing idToken, optional accessToken, and profileData
     * @returns AuthResponseDTO with tokens and user data
     * @throws {NAuthException} SOCIAL_CONFIG_MISSING if provider not configured
     * @throws {NAuthException} SOCIAL_TOKEN_INVALID if token verification fails
     * @throws {NAuthException} PRESIGNUP_FAILED if pre-signup hook rejects user
     *
     * @example
     * ```typescript
     * // Google Sign-In from iOS/Android
     * const response = await googleService.verifyToken({
     *   idToken: 'eyJhbGciOiJSUzI1NiIs...',
     *   accessToken: 'ya29.a0AfH6SM...'
     * });
     *
     * // Sign in with Apple from iOS
     * const response = await appleService.verifyToken({
     *   idToken: 'eyJraWQiOiJlWGF1bm...',
     *   profileData: {
     *     name: { firstName: 'John', lastName: 'Doe' },
     *     email: 'user@privaterelay.appleid.com'
     *   }
     * });
     * ```
     */
    verifyToken(dto: VerifyTokenDTO): Promise<AuthResponseDTO>;
    /**
     * Link social account to existing user
     */
    linkAccount(userId: string, code: string, state: string): Promise<{
        message: string;
    }>;
    /**
     * Get OAuth user profile from callback
     *
     * Alias for getOAuthProfile for interface compliance.
     * Delegates to the protected getOAuthProfile method.
     *
     * @param dto - HandleCallbackDTO containing code and state
     * @returns OAuth user profile
     * @protected
     */
    getUserProfileFromCallback(dto: HandleCallbackDTO): Promise<OAuthUserProfile>;
    /**
     * Validate state parameter for CSRF protection
     */
    protected validateState(state: string): Promise<void>;
    /**
     * Generate random state for CSRF protection
     */
    protected generateState(): Promise<string>;
    /**
     * Find existing user or create new one
     */
    protected findOrCreateUser(profile: OAuthUserProfile, providerConfig: SocialProviderConfig): Promise<IUser>;
    /**
     * Create a social-only user (no password)
     *
     * @param email - User email
     * @param firstName - Optional first name
     * @param lastName - Optional last name
     * @param isEmailVerified - Whether email is verified (default: true)
     * @param socialProvider - Initial social provider name
     * @param profile - Optional OAuth profile for passing to post-signup hook
     * @returns Created user
     * @protected
     */
    protected createSocialUser(email: string, firstName?: string | null, lastName?: string | null, isEmailVerified?: boolean, socialProvider?: string, profile?: OAuthUserProfile): Promise<IUser>;
    /**
     * Create or update social account linkage
     *
     * @param user - User entity
     * @param profile - OAuth profile from provider
     * @protected
     */
    protected createOrUpdateSocialAccount(user: IUser, profile: OAuthUserProfile): Promise<void>;
    /**
     * Create authentication response with tokens and user info
     */
    protected createAuthResponse(user: IUser, _deviceType: 'web' | 'mobile'): Promise<AuthResponseDTO>;
}
//# sourceMappingURL=social-auth-base.service.d.ts.map