import { Repository } from 'typeorm';
import { NAuthConfig } from '../interfaces/config.interface';
import { NAuthLogger } from '../utils/nauth-logger';
import { BaseTrustedDevice } from '../entities/trusted-device.entity';
/**
 * Trusted Device Service
 *
 * Manages device trust for "remember device" feature.
 * Devices can be trusted after successful MFA verification, allowing
 * users to skip MFA for a configured period (rememberDeviceDays).
 *
 * Security:
 * - Device tokens are server-generated UUIDs
 * - Only hash stored in database (SHA-256)
 * - Tokens persist across logouts and session expiry
 * - Independent of refresh token lifecycle
 *
 * @example
 * ```typescript
 * // Mark device as trusted after MFA
 * const deviceToken = await trustedDeviceService.createTrustedDevice(
 *   userId,
 *   deviceName,
 *   deviceType,
 *   ipAddress,
 *   userAgent,
 *   platform,
 *   browser
 * );
 *
 * // Check if device is trusted
 * const isTrusted = await trustedDeviceService.isDeviceTrusted(
 *   deviceToken,
 *   userId
 * );
 * ```
 */
export declare class TrustedDeviceService {
    private readonly config;
    private readonly logger;
    private readonly trustedDeviceRepository?;
    constructor(config: NAuthConfig, logger: NAuthLogger, trustedDeviceRepository?: Repository<BaseTrustedDevice> | undefined);
    /**
     * Create trusted device record
     *
     * Generates a secure device token, stores its hash in database,
     * and returns the plain token for client storage.
     *
     * @param userId - Internal user ID
     * @param deviceName - Optional device name
     * @param deviceType - Optional device type (mobile/desktop/tablet)
     * @param ipAddress - IP address when device was trusted
     * @param userAgent - User agent string
     * @param platform - Platform from user agent
     * @param browser - Browser from user agent
     * @returns Device token (UUID) to be stored by client
     *
     * @throws {Error} If rememberDevice is not enabled or repository not available
     */
    createTrustedDevice(userId: number, deviceName?: string | null, deviceType?: string | null, ipAddress?: string | null, userAgent?: string | null, platform?: string | null, browser?: string | null): Promise<string>;
    /**
     * Check if device is trusted
     *
     * Validates device token against trusted devices table.
     * Updates lastUsedAt if device is found and valid.
     *
     * Security:
     * - Returns false for invalid/tampered tokens (silent - MFA required)
     * - Detection of tampered tokens should be handled by caller for audit logging
     *
     * @param deviceToken - Device token from client (plain UUID)
     * @param userId - Internal user ID
     * @returns True if device is trusted and not expired
     */
    isDeviceTrusted(deviceToken: string | null | undefined, userId: number): Promise<boolean>;
    /**
     * Validate device token and detect tampering attempts
     *
     * Checks if device token is valid and returns validation result.
     * Used to detect suspicious tampered/fake token attempts for audit logging.
     *
     * @param deviceToken - Device token from client (can be null/undefined)
     * @param userId - Internal user ID
     * @returns Validation result with suspicious flag
     */
    validateDeviceToken(deviceToken: string | null | undefined, userId: number): Promise<{
        isValid: boolean;
        isSuspicious: boolean;
    }>;
    /**
     * Revoke trusted device
     *
     * Removes device from trusted devices table.
     * Used when user explicitly untrusts a device.
     *
     * @param deviceToken - Device token to revoke
     * @param userId - Internal user ID
     */
    revokeTrustedDevice(deviceToken: string, userId: number): Promise<void>;
    /**
     * Get user's trusted devices
     *
     * Returns list of trusted devices for management UI.
     *
     * @param userId - Internal user ID
     * @returns Array of trusted device records (without tokens)
     */
    getUserTrustedDevices(userId: number): Promise<Omit<BaseTrustedDevice, 'deviceTokenHash'>[]>;
    /**
     * Revoke all trusted devices for a user
     *
     * Removes all trusted devices for the user.
     * Used when user performs global logout with forgetDevices flag.
     *
     * @param userId - Internal user ID
     * @returns Object containing count and device information before deletion
     */
    revokeAllTrustedDevices(userId: number): Promise<{
        revokedCount: number;
        devices: Array<{
            id: number | string;
            deviceName: string | null;
            lastUsedAt: Date | null;
            trustedUntil: Date | null;
        }>;
    }>;
    /**
     * Hash device token (SHA-256)
     *
     * @private
     */
    private hashDeviceToken;
}
//# sourceMappingURL=trusted-device.service.d.ts.map