import { NodePgDatabase } from "drizzle-orm/node-postgres";
import type { RebasePgTable } from "../types";
import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
export type { Role };
export interface AuthSchemaTables {
    users: RebasePgTable;
    refreshTokens: RebasePgTable;
    passwordResetTokens: RebasePgTable;
    appConfig: RebasePgTable;
    userIdentities: RebasePgTable;
}
/**
 * The single definition of what an email address looks like in storage.
 *
 * Reads have always folded case; writes did not, and normalising was left to
 * each caller. That asymmetry is only ever one forgotten `.toLowerCase()` away
 * from a row no lookup can find — the account exists, every sign-in path
 * reports no such user, and the byte-exact UNIQUE on the column does not stop a
 * duplicate differing only in case. Applied on both sides here so the guarantee
 * belongs to the repository rather than to its callers' discipline; the
 * `lower(email)` unique index added in `ensureAuthTablesExist` is the database
 * half of the same rule.
 *
 * Whitespace goes too: a trailing space survives the fold and reproduces the
 * problem exactly.
 *
 * Re-exported rather than defined here: `@rebasepro/server` and
 * `@rebasepro/server-mongo` write this column too, and a second copy of this
 * rule is the defect it exists to prevent.
 */
import { normalizeEmail } from "@rebasepro/common";
export { normalizeEmail };
/**
 * PostgreSQL implementation of UserRepository.
 * Handles all user-related database operations using Drizzle ORM.
 */
export declare class UserService implements UserRepository {
    private db;
    private usersTable;
    private userIdentitiesTable;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    private getQualifiedUsersTableName;
    /**
     * Run a privileged auth write with an explicitly cleared RLS context.
     *
     * The auth services run on the base/owner connection, which by design
     * carries a NULL `app.uid` so the `rebase.uid() IS NULL` server-escape
     * in the default policies applies. That NULL is normally guaranteed by
     * `set_config(..., is_local = true)` resetting at transaction end — but a
     * GUC that survives on a pooled connection (or a connection role that
     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
     * turns the trusted write into an RLS-scoped one and denies it with
     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
     * single chokepoint, makes the server context deterministic instead of
     * trusting whatever state the pool hands us. `rebase.uid()` reads '' as
     * NULL via NULLIF, so '' is the server context.
     */
    private withServerContext;
    private mapRowToUser;
    private mapPayload;
    /**
     * @see UserRepository.createUser — an email already in use is a 409.
     *
     * The route checks first and answers 409; this is the same answer for the
     * requests that get past the check, which two clicks on a signup button
     * are enough to produce. `PersistService` has mapped `23505` to a conflict
     * for collection writes since the layer that holds the SQLSTATE was made
     * responsible for saying whose fault a failure is; the auth writes never
     * got the same treatment and reached the client as "Internal Server Error".
     */
    createUser(data: CreateUserData): Promise<UserData>;
    getUserById(id: string): Promise<UserData | null>;
    getUserByEmail(email: string): Promise<UserData | null>;
    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
    getUserIdentities(uid: string): Promise<UserIdentityData[]>;
    linkUserIdentity(uid: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
    deleteUser(id: string): Promise<void>;
    listUsers(): Promise<UserData[]>;
    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
    /**
     * Update user's password hash
     */
    updatePassword(id: string, passwordHash: string): Promise<void>;
    /**
     * Set email verification status
     */
    setEmailVerified(id: string, verified: boolean): Promise<void>;
    /**
     * Set email verification token
     */
    setVerificationToken(id: string, token: string | null): Promise<void>;
    /**
     * Find user by email verification token
     */
    getUserByVerificationToken(token: string): Promise<UserData | null>;
    /**
     * Get roles for a user from database (inline TEXT[] column)
     */
    getUserRoles(uid: string): Promise<Role[]>;
    /**
     * Get role IDs for a user
     */
    getUserRoleIds(uid: string): Promise<string[]>;
    /**
     * Set roles for a user (replaces existing roles)
     */
    setUserRoles(uid: string, roleIds: string[]): Promise<void>;
    /**
     * Assign a specific role to new user (appends if not present)
     */
    assignDefaultRole(uid: string, roleId: string): Promise<void>;
    /**
     * Get user with their roles
     */
    getUserWithRoles(uid: string): Promise<{
        user: UserData;
        roles: Role[];
    } | null>;
}
export declare class RefreshTokenService {
    private db;
    private refreshTokensTable;
    private usersTable;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    /**
     * Whether the table actually carries a column, so a host application that
     * supplied its own `refresh_tokens` table — one that predates session
     * grouping — degrades instead of throwing on every sign-in.
     */
    private has;
    private col;
    /** The columns to read back, narrowed to the ones this table has. */
    private selection;
    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
    findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
    /**
     * Record that a token was rotated away, keeping the row.
     *
     * The row is what lets `/auth/refresh` distinguish "you already used this,
     * here is a fresh one" from "no idea what this is". Deleting it — which is
     * what this used to do — collapsed both into a 401 and signed the user out
     * for the crime of losing a response.
     */
    markRotated(tokenHash: string): Promise<void>;
    /** Final kill of one sign-in: logout, or revoking a device remotely. */
    revokeSession(sessionId: string): Promise<void>;
    /**
     * Housekeeping: rotation would otherwise leave a row per refresh forever.
     * Superseded rows are only needed for as long as a straggler might still
     * present them, and expired ones are dead weight everywhere.
     */
    prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
    getTokensValidAfter(uid: string): Promise<Date | null>;
    setTokensValidAfter(uid: string, at: Date): Promise<void>;
    deleteByHash(tokenHash: string): Promise<void>;
    deleteAllForUser(uid: string): Promise<void>;
    listForUser(uid: string): Promise<RefreshTokenInfo[]>;
    deleteById(id: string, uid: string): Promise<void>;
}
/**
 * Password reset token service
 */
export declare class PasswordResetTokenService {
    private db;
    private passwordResetTokensTable;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    private getQualifiedPasswordResetTokensTableName;
    /**
     * Create a password reset token
     */
    createToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    /**
     * Find a valid (not expired, not used) token by hash
     */
    findValidByHash(tokenHash: string): Promise<{
        uid: string;
        expiresAt: Date;
    } | null>;
    /**
     * Mark token as used
     */
    markAsUsed(tokenHash: string): Promise<void>;
    /**
     * Delete all tokens for a user
     */
    deleteAllForUser(uid: string): Promise<void>;
    /**
     * Clean up expired tokens
     */
    deleteExpired(): Promise<void>;
}
/**
 * Magic link token service.
 * Handles magic link token storage for passwordless email login.
 */
export declare class MagicLinkTokenService {
    private db;
    private magicLinkTokensTable;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    private getQualifiedTableName;
    createToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    findValidByHash(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
    markAsUsed(tokenHash: string): Promise<void>;
}
/**
 * PostgreSQL implementation of TokenRepository.
 * Combines refresh token and password reset token operations.
 */
export declare class PostgresTokenRepository implements TokenRepository {
    private db;
    private refreshTokenService;
    private passwordResetTokenService;
    private magicLinkTokenService;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
    markRefreshTokenRotated(tokenHash: string): Promise<void>;
    revokeRefreshTokenSession(sessionId: string): Promise<void>;
    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
    getTokensValidAfter(uid: string): Promise<Date | null>;
    setTokensValidAfter(uid: string, at: Date): Promise<void>;
    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
    deleteRefreshToken(tokenHash: string): Promise<void>;
    deleteAllRefreshTokensForUser(uid: string): Promise<void>;
    listRefreshTokensForUser(uid: string): Promise<RefreshTokenInfo[]>;
    deleteRefreshTokenById(id: string, uid: string): Promise<void>;
    createPasswordResetToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
    deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
    deleteExpiredTokens(): Promise<void>;
    createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
}
/**
 * PostgreSQL implementation of AuthRepository.
 * Combines user, role, and token repository operations.
 * This provides a convenient single-class interface for all auth operations.
 */
export declare class PostgresAuthRepository implements AuthRepository {
    private db;
    private userService;
    private tokenRepository;
    constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
    createUser(data: CreateUserData): Promise<UserData>;
    getUserById(id: string): Promise<UserData | null>;
    getUserByEmail(email: string): Promise<UserData | null>;
    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
    getUserIdentities(uid: string): Promise<UserIdentityData[]>;
    linkUserIdentity(uid: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
    deleteUser(id: string): Promise<void>;
    listUsers(): Promise<UserData[]>;
    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
    updatePassword(id: string, passwordHash: string): Promise<void>;
    setEmailVerified(id: string, verified: boolean): Promise<void>;
    setVerificationToken(id: string, token: string | null): Promise<void>;
    getUserByVerificationToken(token: string): Promise<UserData | null>;
    getUserRoles(uid: string): Promise<RoleData[]>;
    getUserRoleIds(uid: string): Promise<string[]>;
    setUserRoles(uid: string, roleIds: string[]): Promise<void>;
    assignDefaultRole(uid: string, roleId: string): Promise<void>;
    getUserWithRoles(uid: string): Promise<{
        user: UserData;
        roles: RoleData[];
    } | null>;
    getRoleById(id: string): Promise<RoleData | null>;
    listRoles(): Promise<RoleData[]>;
    createRole(_data: CreateRoleData): Promise<RoleData>;
    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
    deleteRole(_id: string): Promise<void>;
    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
    markRefreshTokenRotated(tokenHash: string): Promise<void>;
    revokeRefreshTokenSession(sessionId: string): Promise<void>;
    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
    getTokensValidAfter(uid: string): Promise<Date | null>;
    setTokensValidAfter(uid: string, at: Date): Promise<void>;
    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
    deleteRefreshToken(tokenHash: string): Promise<void>;
    deleteAllRefreshTokensForUser(uid: string): Promise<void>;
    listRefreshTokensForUser(uid: string): Promise<RefreshTokenInfo[]>;
    deleteRefreshTokenById(id: string, uid: string): Promise<void>;
    createPasswordResetToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
    deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
    deleteExpiredTokens(): Promise<void>;
    createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
    private _mfaService;
    private getMfaService;
    createMfaFactor(uid: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
    getMfaFactors(uid: string): Promise<MfaFactor[]>;
    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
        secretEncrypted: string;
    }) | null>;
    verifyMfaFactor(factorId: string): Promise<void>;
    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
    deleteMfaFactor(factorId: string, uid: string): Promise<void>;
    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
    verifyMfaChallenge(challengeId: string): Promise<void>;
    createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
    useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;
    getUnusedRecoveryCodeCount(uid: string): Promise<number>;
    deleteAllRecoveryCodes(uid: string): Promise<void>;
    hasVerifiedMfaFactors(uid: string): Promise<boolean>;
    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
}
/**
 * PostgreSQL implementation of MfaRepository.
 * Handles all MFA-related database operations.
 */
export declare class MfaService implements MfaRepository {
    private db;
    private schemaName;
    constructor(db: NodePgDatabase, schemaName?: string);
    private qualify;
    createMfaFactor(uid: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
    getMfaFactors(uid: string): Promise<MfaFactor[]>;
    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
        secretEncrypted: string;
    }) | null>;
    /**
     * Spend a TOTP time step, once and only once.
     *
     * One statement: the `WHERE` is the check, the `UPDATE` is the act, and
     * `RETURNING` reports which of two concurrent requests carrying the same
     * six digits won. Reading the counter and then writing it would let both
     * pass — the exact replay this closes.
     */
    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
    verifyMfaFactor(factorId: string): Promise<void>;
    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
    deleteMfaFactor(factorId: string, uid: string): Promise<void>;
    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
    /**
     * Count one failed guess against a challenge and report the new total.
     *
     * Incremented in the database rather than in the route so that guesses
     * arriving in parallel — the shape any real brute-force takes — cannot
     * share a single increment.
     */
    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
    verifyMfaChallenge(challengeId: string): Promise<void>;
    createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
    useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;
    getUnusedRecoveryCodeCount(uid: string): Promise<number>;
    deleteAllRecoveryCodes(uid: string): Promise<void>;
    hasVerifiedMfaFactors(uid: string): Promise<boolean>;
}
/** PostgreSQL user repository implementation */
export type PostgresUserRepository = UserService;