import { BaseController, NotFound, Ok } from '@spinajs/http';
import { SessionProvider, User } from '@spinajs/rbac';
import type { ISession } from '@spinajs/rbac';
import { Log } from '@spinajs/log';
import { RoleGuard } from '../../interfaces.js';
import '../../services/RoleGuard.js';
export declare class ChangePasswordDto {
    password: string;
    confirmPassword: string;
    constructor(data: any);
}
export declare class BanUserDto {
    reason?: string;
    duration?: number;
    constructor(data: Partial<BanUserDto>);
}
/** One live session of a user, as reported to an administrator. */
export interface IAdminSessionEntry {
    /**
     * Opaque handle for the session, NOT the session id — the id is a working
     * credential and an admin listing must not hand out the means to
     * impersonate the accounts it lists.
     */
    Handle: string;
    /** ISO instant the session was opened */
    Created: string;
    /** ISO instant the session expires, or null when it never does */
    Expires: string | null;
}
/**
 * User account security management (admin).
 * Administrative controls for user account security: passwords, 2FA, account
 * activation, bans, login lockouts and live sessions.
 *
 * Every route that takes an account out of service goes through the configured
 * {@link RoleGuard} first — an administrator must not be able to lock themselves,
 * or the installation, out through this API.
 * @tags Admin Users
 */
export declare class Security extends BaseController {
    protected Log: Log;
    protected SessionProvider: SessionProvider;
    protected RoleGuard: RoleGuard;
    /**
     * Change user password (admin)
     * Sets a new password for the specified user. Both password and confirmPassword must match.
     * Minimum length is 8 characters. Every session of that user is destroyed — the credential
     * they were opened with no longer exists.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Password changed successfully
     * @response 400 Passwords do not match or fail validation
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    changeUserPassword(user: User, dto: ChangePasswordDto): Promise<Ok<any>>;
    /**
     * Send a password reset link (admin)
     * Issues a single-use reset token into the user's metadata and emits
     * `UserPasswordChangeRequest` so the application can deliver it. The token itself is never
     * returned. This is how a freshly created account is handed over to its owner — the
     * temporary password generated at creation is deliberately discarded.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Reset token issued
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    requestPasswordReset(user: User): Promise<Ok<any>>;
    /**
     * Expire a user password (admin)
     * Marks the password as expired, which deactivates the account until a new one is set.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Password expired
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
     * @response 404 User not found
     */
    expireUserPassword(actor: User, user: User): Promise<Ok<any>>;
    /**
     * Reset user two-factor authentication (admin)
     * Clears the TOTP secret and disables 2FA for the specified user.
     * Use this to help a user regain access when they lose their authenticator device.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 2FA reset successfully
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    reset2faToken(user: User): Promise<Ok<any>>;
    /**
     * Enable two-factor authentication for a user (admin)
     * Initializes a TOTP secret for the account. Returns whatever the configured
     * two-factor provider produces for enrolment (an otpauth url for the default provider) —
     * deliver it to the user over a channel you trust.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 2FA enabled
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    enable2Fa(user: User): Promise<Ok<any>>;
    /**
     * Disable two-factor authentication for a user (admin)
     * Removes the TOTP secret and turns the second factor off for the account.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 2FA disabled
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    disable2Fa(user: User): Promise<Ok<any>>;
    /**
     * Deactivate user account (admin)
     * Marks the user account as inactive and destroys its sessions, preventing login without
     * deleting the record.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Account deactivated successfully
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
     * @response 404 User not found
     */
    deactivateUser(actor: User, user: User): Promise<Ok<any>>;
    /**
     * Activate user account (admin)
     * Marks a previously deactivated user account as active, restoring login access.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Account activated successfully
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    activateUser(user: User): Promise<Ok<any>>;
    /**
     * Ban a user (admin)
     * Bans the account for `duration` seconds (24h when omitted), records the reason, and
     * destroys every session it holds.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Account banned
     * @response 400 Account is already banned
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — deleteAny permission required, or refused by the role guard
     * @response 404 User not found
     */
    banUser(actor: User, user: User, dto: BanUserDto): Promise<Ok<any>>;
    /**
     * Unban a user (admin)
     * Clears the ban metadata from the account.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Account unbanned
     * @response 400 Account is not banned
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    unbanUser(user: User): Promise<Ok<any>>;
    /**
     * Clear a login lockout (admin)
     * Removes the failed-attempt counter and the lockout window opened by the login throttle,
     * letting the user try again immediately. Without this the only remedy is waiting out
     * `rbac.password.lockoutTime`.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 Lockout cleared
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    unlockUser(user: User): Promise<Ok<any>>;
    /**
     * List sessions of a user (admin)
     * Returns every live session of the account, newest first, identified by an opaque handle.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @returns {IAdminSessionEntry[]} Live sessions of the user
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — readAny permission required on users resource
     * @response 404 User not found
     */
    listSessions(user: User): Promise<Ok<IAdminSessionEntry[]>>;
    /**
     * Revoke one session of a user (admin)
     * Ends a single session, addressed by the handle returned from the listing.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @param handle Session handle as returned by `GET /users/security/sessions/:user`
     * @response 200 Session revoked
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 No such session for this user
     */
    revokeSession(user: User, handle: string): Promise<Ok | NotFound>;
    /**
     * Force logout user (admin)
     * Invalidates all active sessions for the specified user, immediately ending any current logins.
     * @security cookieAuth
     * @param user User UUID path parameter
     * @response 200 All sessions invalidated successfully
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required on users resource
     * @response 404 User not found
     */
    logoutUser(user: User): Promise<Ok<null>>;
    protected toEntry(session: ISession): IAdminSessionEntry;
}
//# sourceMappingURL=Security.d.ts.map