import { Repository } from 'typeorm';
import { BaseMFADevice, BaseUser, NAuthConfig, NAuthLogger, MFAMethod, ClientInfoService } from '@nauth-toolkit/core';
import { BaseMFAProviderService, ChallengeService, AuthAuditService } from '@nauth-toolkit/core/internal';
import { TOTPService } from './totp.service';
import { SetupTOTPResponseDTO } from './dto/mfa.dto';
/**
 * TOTP MFA Provider Service
 *
 * Implements TOTP (Time-based One-Time Password) MFA method.
 * Extends BaseMFAProviderService to provide TOTP-specific functionality.
 *
 * This service handles:
 * - TOTP secret generation and QR code creation
 * - TOTP code verification during setup and authentication
 * - MFA device creation for TOTP
 *
 * @example
 * ```typescript
 * @Module({
 *   imports: [TOTPMFAModule],
 * })
 * export class AppModule {}
 * ```
 */
export declare class TOTPMFAProviderService extends BaseMFAProviderService {
    private readonly totpService;
    readonly methodName = MFAMethod.TOTP;
    constructor(mfaDeviceRepository: Repository<BaseMFADevice>, userRepository: Repository<BaseUser>, config: NAuthConfig, logger: NAuthLogger, passwordService: unknown, totpService: TOTPService, challengeService?: ChallengeService, auditService?: AuthAuditService, clientInfoService?: ClientInfoService);
    /**
     * Setup TOTP for user
     *
     * Generates TOTP secret and QR code for authenticator app setup.
     * User must scan QR code and verify with a code to complete setup.
     *
     * @param user - User setting up TOTP
     * @param _setupData - Not used for TOTP
     * @returns TOTP setup information (secret, QR code, manual entry key)
     * @throws {NAuthException} If TOTP is not enabled
     *
     * @example
     * ```typescript
     * const setup = await provider.setup(user);
     * // Client displays setup.qrCode and setup.manualEntryKey
     * ```
     */
    setup(_setupData?: unknown): Promise<SetupTOTPResponseDTO>;
    /**
     * Verify and complete TOTP setup
     *
     * Validates the TOTP code and stores the device if valid.
     * Enables MFA for user if this is their first device.
     *
     * **Race Condition Safety:**
     * Device creation uses a transaction with pessimistic locking.
     *
     * Note: NAuth supports multiple TOTP devices per user for redundancy (e.g., phone + password manager).
     *
     * @param user - User completing TOTP setup
     * @param verificationData - Verification data (must be VerifyTOTPSetupDTO)
     * @param deviceName - Optional device name override
     * @returns MFA device ID (created or existing)
     * @throws {NAuthException} If code is invalid
     *
     * @example
     * ```typescript
     * const deviceId = await provider.verifySetup(user, {
     *   secret: 'base32secret',
     *   code: '123456',
     *   deviceName: 'Google Authenticator'
     * });
     * ```
     */
    verifySetup(verificationData: unknown, deviceName?: string): Promise<number>;
    /**
     * Verify TOTP code during authentication
     *
     * Validates the TOTP code for an existing device.
     *
     * @param user - User being authenticated
     * @param code - TOTP code (string)
     * @param deviceId - Optional device ID to verify against
     * @returns True if verification succeeds
     * @throws {NAuthException} If device not found or verification fails
     *
     * @example
     * ```typescript
     * const isValid = await provider.verify(user, '123456');
     * ```
     */
    verify(code: unknown, deviceId?: number): Promise<boolean>;
}
//# sourceMappingURL=totp-mfa-provider.service.d.ts.map