import { Repository } from 'typeorm';
import { IUser } from '../interfaces/entities.interface';
import { BaseUser, BaseMFADevice, BaseChallengeSession, BaseVerificationToken, BaseSocialAccount, BaseAuthAudit, BaseTrustedDevice, BaseSession, BaseLoginAttempt } from '../entities';
import { SessionService } from './session.service';
import { ClientInfoService } from './client-info.service';
import { InternalAuthAuditService as AuthAuditService } from './auth-audit.service';
import { HookRegistryService } from './hook-registry.service';
import { NAuthConfig } from '../interfaces/config.interface';
import { NAuthLogger } from '../utils/nauth-logger';
import { GetUsersDTO, GetUsersResponseDTO } from '../dto/get-users.dto';
import { GetUserByIdDTO } from '../dto/get-user-by-id.dto';
import { GetUserByEmailDTO } from '../dto/get-user-by-email.dto';
import { AdminUpdateUserAttributesDTO } from '../dto/admin-update-user-attributes.dto';
import { UpdateVerifiedStatusRequestDTO } from '../dto/update-verified-status-request.dto';
import { DeleteUserDTO, DeleteUserResponseDTO } from '../dto/delete-user.dto';
import { DisableUserDTO, DisableUserResponseDTO } from '../dto/disable-user.dto';
import { EnableUserDTO, EnableUserResponseDTO } from '../dto/enable-user.dto';
import { SetMustChangePasswordDTO } from '../dto/set-must-change-password.dto';
import { SetMustChangePasswordResponseDTO } from '../dto/set-must-change-password-response.dto';
import { UserResponseDTO } from '../dto/user-response.dto';
import { AuthServiceInternalHelpers } from './auth-service-internal-helpers';
/**
 * Internal user data management service
 *
 * Handles all user storage, query, and lifecycle operations.
 * This class is NOT exported from the package and should only be used
 * internally by AuthService.
 *
 * INTERNAL USE ONLY - DO NOT IMPORT DIRECTLY
 *
 * @internal
 */
export declare class UserService {
    private readonly userRepository;
    private readonly loginAttemptRepository;
    private readonly sessionService;
    private readonly config;
    private readonly logger;
    private readonly mfaDeviceRepository?;
    private readonly auditService?;
    private readonly hookRegistry?;
    private readonly clientInfoService;
    private readonly sessionRepository?;
    private readonly verificationTokenRepository?;
    private readonly socialAccountRepository?;
    private readonly challengeSessionRepository?;
    private readonly authAuditRepository?;
    private readonly trustedDeviceRepository?;
    private readonly helpers;
    constructor(userRepository: Repository<BaseUser>, loginAttemptRepository: Repository<BaseLoginAttempt>, sessionService: SessionService, config: NAuthConfig, logger: NAuthLogger, mfaDeviceRepository?: Repository<BaseMFADevice> | undefined, auditService?: AuthAuditService | undefined, hookRegistry?: HookRegistryService | undefined, clientInfoService?: ClientInfoService, sessionRepository?: Repository<BaseSession> | undefined, verificationTokenRepository?: Repository<BaseVerificationToken> | undefined, socialAccountRepository?: Repository<BaseSocialAccount> | undefined, challengeSessionRepository?: Repository<BaseChallengeSession> | undefined, authAuditRepository?: Repository<BaseAuthAudit> | undefined, trustedDeviceRepository?: Repository<BaseTrustedDevice> | undefined, helpers?: AuthServiceInternalHelpers);
    /**
     * Get paginated list of users with advanced filtering
     *
     * Supports pagination, boolean filters, exact match filters,
     * date filters with operators (gt, gte, lt, lte, eq), and flexible sorting.
     *
     * Security:
     * - NO built-in authentication - endpoint MUST be protected by admin guards
     * - Returns sanitized user data (no passwordHash, secrets)
     *
     * @param dto - Filters, pagination, sorting
     * @returns Paginated user list with metadata
     *
     * @example
     * ```typescript
     * const result = await userService.getUsers({
     *   page: 1,
     *   limit: 20,
     *   isEmailVerified: true,
     *   hasSocialAuth: true,
     *   createdAt: { operator: 'gte', value: new Date('2024-01-01') },
     *   sortBy: 'createdAt',
     *   sortOrder: 'DESC'
     * });
     * ```
     */
    getUsers(dto: GetUsersDTO): Promise<GetUsersResponseDTO>;
    /**
     * Get user by external identifier (sub/UUID).
     *
     * @param dto - GetUserByIdDTO containing sub
     * @returns User response DTO or null if not found
     *
     * @example
     * ```typescript
     * const user = await userService.getUserById({ sub: 'user-uuid' });
     * ```
     */
    getUserById(dto: GetUserByIdDTO): Promise<UserResponseDTO | null>;
    /**
     * Get user by email address.
     *
     * @param dto - GetUserByEmailDTO containing email and optional requireEmailVerified
     * @returns User response DTO or null if not found
     * @internal - For use by social auth providers
     *
     * @example
     * ```typescript
     * const user = await userService.getUserByEmail({ email: 'user@example.com', requireEmailVerified: true });
     * ```
     */
    getUserByEmail(dto: GetUserByEmailDTO): Promise<UserResponseDTO | null>;
    /**
     * Get user for authentication context
     *
     * Loads user by sub (external identifier) with all fields needed for auth context.
     * Computes hasPasswordHash from passwordHash, then removes passwordHash and other sensitive fields.
     *
     * This method is used by AuthHandler and AuthGuard to load authenticated users.
     * It ensures consistent user object shape across platforms (core + NestJS).
     *
     * @param sub - External user identifier (UUID)
     * @returns User object with hasPasswordHash flag, without sensitive fields
     * @throws {NAuthException} If user not found or account is inactive
     *
     * @example
     * ```typescript
     * const user = await userService.getUserForAuthContext('user-uuid-123');
     * // user.hasPasswordHash === true/false
     * // user.passwordHash === undefined (removed)
     * ```
     */
    getUserForAuthContext(sub: string): Promise<IUser>;
    /**
     * Update user profile attributes.
     *
     * Updates user fields (name, email, phone, username, metadata) and enforces unique constraints and verification rules.
     *
     * @param dto - AdminUpdateUserAttributesDTO containing sub and fields to update
     * @returns Updated user object
     * @throws {NAuthException} If user not found or unique constraint violated
     *
     * @example
     * ```typescript
     * await userService.updateUserAttributes({ sub: 'user-uuid', email: 'test@example.com' });
     * ```
     */
    updateUserAttributes(dto: AdminUpdateUserAttributesDTO): Promise<UserResponseDTO>;
    /**
     * Update email and/or phone verification status.
     *
     * Intended for admin use cases such as migration or offline validation.
     * Updates verification status without requiring actual verification codes.
     *
     * Validation:
     * - Cannot set verified=true if email/phone doesn't exist
     * - Can set verified=false even if email/phone doesn't exist (default state)
     * - Only updates provided fields (partial update)
     *
     * Audit:
     * - Records EMAIL_VERIFIED or PHONE_VERIFIED audit events
     * - Includes performedBy from authenticated admin context
     *
     * @param dto - Request DTO containing sub and verification status flags
     * @returns Updated user object
     * @throws {NAuthException} If user not found or trying to verify non-existent email/phone
     *
     * @example
     * ```typescript
     * // Update email verification only
     * await userService.updateVerifiedStatus({
     *   sub: 'user-uuid',
     *   isEmailVerified: true
     * });
     *
     * // Update both email and phone verification
     * await userService.updateVerifiedStatus({
     *   sub: 'user-uuid',
     *   isEmailVerified: true,
     *   isPhoneVerified: false
     * });
     * ```
     */
    updateVerifiedStatus(dto: UpdateVerifiedStatusRequestDTO): Promise<UserResponseDTO>;
    /**
     * Delete a user and all associated data (cascade deletion).
     *
     * Permanently removes a user account and all related records:
     * - Sessions
     * - Verification tokens
     * - MFA devices
     * - Trusted devices
     * - Social accounts
     * - Login attempts
     * - Challenge sessions
     * - Audit logs (user-specific)
     *
     * Security:
     * - NO built-in authentication - endpoint MUST be protected by admin guards
     * - Records ACCOUNT_DELETED audit event before deletion
     * - Returns counts of deleted records for confirmation
     *
     * @param dto - DeleteUserDTO containing sub
     * @returns Response with success status and deleted record counts
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await userService.deleteUser({ sub: 'user-uuid-123' });
     * console.log(`Deleted ${result.deletedRecords.sessions} sessions`);
     * ```
     */
    deleteUser(dto: DeleteUserDTO): Promise<DeleteUserResponseDTO>;
    /**
     * Administrative permanent account locking
     *
     * Sets permanent lock (lockedUntil=NULL) and immediately revokes all active sessions.
     * Reuses existing rate-limit lock fields (isLocked, lockReason, lockedAt, lockedUntil).
     *
     * Permanent vs Temporary locks:
     * - Rate limiting: lockedUntil = future date (temporary auto-unlock)
     * - Admin disableUser: lockedUntil = NULL (permanent manual lock)
     *
     * Security:
     * - NO built-in authentication - endpoint MUST be protected by admin guards
     * - Revokes all sessions immediately (forced logout)
     * - Records ACCOUNT_DISABLED audit event with admin identifier
     *
     * @param dto - User sub and optional reason
     * @returns User object with updated lock status and revoked session count
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await userService.disableUser({
     *   sub: 'user-uuid-123',
     *   reason: 'Suspicious activity detected'
     * });
     * console.log(`Revoked ${result.revokedSessions} sessions`);
     * ```
     */
    disableUser(dto: DisableUserDTO): Promise<DisableUserResponseDTO>;
    /**
     * Enable (unlock) user account
     *
     * Unlocks a previously locked user account by clearing all lock fields.
     * This reverses the effect of disableUser() or rate-limit lockouts.
     *
     * Security:
     * - NO built-in authentication - endpoint MUST be protected by admin guards
     * - Clears lock fields (isLocked, lockReason, lockedAt, lockedUntil)
     * - Resets failed login attempts counter
     * - Records ACCOUNT_ENABLED audit event with admin identifier
     *
     * @param dto - User sub to enable
     * @returns User object with updated lock status
     * @throws {NAuthException} USER_NOT_FOUND
     *
     * @example
     * ```typescript
     * const result = await userService.enableUser({
     *   sub: 'user-uuid-123'
     * });
     * console.log(`User unlocked: ${result.user.email}`);
     * ```
     */
    enableUser(dto: EnableUserDTO): Promise<EnableUserResponseDTO>;
    /**
     * Require user to change password at next login.
     *
     * Throws if user not found or has no password set (e.g. social login only).
     *
     * @param dto - SetMustChangePasswordDTO containing userId (sub)
     * @returns Success response
     * @throws {NAuthException} If user is not found or cannot change password
     *
     * @example
     * ```typescript
     * await userService.setMustChangePassword({ userId: 'user-uuid-123' });
     * ```
     */
    setMustChangePassword(dto: SetMustChangePasswordDTO): Promise<SetMustChangePasswordResponseDTO>;
}
//# sourceMappingURL=user.service.d.ts.map