import { NAuthConfig, NAuthLogger } from '@nauth-toolkit/core';
import { SetupTOTPResponseDTO } from './dto/mfa.dto';
/**
 * TOTP (Time-based One-Time Password) Service
 *
 * Handles authenticator app functionality including:
 * - Secret generation for new TOTP devices
 * - QR code generation for easy setup
 * - TOTP code validation with time window
 * - Compatible with Google Authenticator, Authy, 1Password, etc.
 *
 * Uses industry-standard TOTP (RFC 6238) with configurable parameters.
 *
 * @example
 * ```typescript
 * // Generate TOTP setup
 * const setup = await totpService.generateSecret('user@example.com');
 * // Returns: { secret, qrCode, manualEntryKey, issuer, accountName }
 *
 * // Verify TOTP code
 * const isValid = totpService.verifyCode('base32secret', '123456');
 * // Returns: true if code is valid
 * ```
 */
export declare class TOTPService {
    private readonly config;
    private readonly logger;
    private readonly defaultConfig;
    constructor(config: NAuthConfig, logger: NAuthLogger);
    /**
     * Get TOTP configuration with defaults
     *
     * @returns Complete TOTP configuration
     * @private
     */
    private getTOTPConfig;
    /**
     * Get issuer name for TOTP URIs
     *
     * @returns Issuer name from config or default
     * @private
     */
    private getIssuer;
    /**
     * Generate TOTP secret and QR code for user setup
     *
     * Creates a new TOTP secret, generates QR code and manual entry key.
     * User must scan QR code with authenticator app to complete setup.
     *
     * @param accountName - User's email or username (displayed in authenticator app)
     * @returns Setup information including QR code and secret
     * @throws {BadRequestException} If QR code generation fails
     *
     * @example
     * ```typescript
     * const setup = await totpService.generateSecret('user@example.com');
     * // Client displays QR code and manual entry key
     * // User scans QR with Google Authenticator, Authy, etc.
     * ```
     */
    generateSecret(accountName: string): Promise<SetupTOTPResponseDTO>;
    /**
     * Format secret for manual entry
     *
     * Converts base32 secret into groups of 4 characters for easy manual input.
     *
     * @param secret - Base32-encoded secret
     * @returns Formatted secret (e.g., 'ABCD EFGH IJKL MNOP')
     * @private
     *
     * @example
     * ```typescript
     * formatSecretForManualEntry('ABCDEFGHIJKLMNOP')
     * // Returns: 'ABCD EFGH IJKL MNOP'
     * ```
     */
    private formatSecretForManualEntry;
    /**
     * Verify TOTP code against secret
     *
     * Validates a 6-digit TOTP code using time-based verification.
     * Checks current time step plus configured window (before/after).
     *
     * SECURITY: Uses time window to account for clock drift and user delay.
     * Default window of 1 checks 3 time steps (current, ±1).
     *
     * @param secret - Base32-encoded TOTP secret
     * @param code - 6-digit TOTP code from authenticator app
     * @returns True if code is valid within time window
     *
     * @example
     * ```typescript
     * // User enters code from Google Authenticator
     * const isValid = await totpService.verifyCode(user.totpSecret, '123456');
     * if (isValid) {
     *   // Grant access
     * }
     * ```
     */
    verifyCode(secret: string, code: string): Promise<boolean>;
    /**
     * Verify TOTP code with additional validation
     *
     * Extended verification that checks code format and provides detailed error messages.
     *
     * @param secret - Base32-encoded TOTP secret
     * @param code - TOTP code to verify
     * @returns Verification result with error message if invalid
     *
     * @example
     * ```typescript
     * const result = await totpService.verifyCodeWithDetails(secret, '123456');
     * if (!result.valid) {
     *   throw new BadRequestException(result.error);
     * }
     * ```
     */
    verifyCodeWithDetails(secret: string, code: string): Promise<{
        valid: boolean;
        error?: string;
    }>;
    /**
     * Generate current TOTP code for secret
     *
     * FOR TESTING ONLY - Do not use in production authentication flow.
     * This method generates the current valid code for a secret.
     *
     * @param secret - Base32-encoded TOTP secret
     * @returns Current 6-digit TOTP code
     *
     * @example
     * ```typescript
     * // Testing only
     * const code = await totpService.generateCode(secret);
     * // Returns: '123456'
     * ```
     */
    generateCode(secret: string): Promise<string>;
    /**
     * Validate secret format
     *
     * Checks if a secret is valid base32 and has sufficient length.
     *
     * @param secret - Secret to validate
     * @returns True if secret is valid
     *
     * @example
     * ```typescript
     * if (!totpService.isValidSecret(secret)) {
     *   throw new BadRequestException('Invalid TOTP secret');
     * }
     * ```
     */
    isValidSecret(secret: string): boolean;
    /**
     * Get time remaining until next code
     *
     * Returns seconds until the current TOTP code expires.
     * Useful for UI countdowns.
     *
     * @returns Seconds remaining (0-30 for default 30s step)
     *
     * @example
     * ```typescript
     * const remaining = totpService.getTimeRemaining();
     * // Returns: 15 (seconds until code changes)
     * ```
     */
    getTimeRemaining(): number;
}
//# sourceMappingURL=totp.service.d.ts.map