import { APIController, Request, Response } from '@ten24group/fw24';
import { IAuthService } from '../interfaces';
export declare class AuthController extends APIController {
    private readonly authService;
    constructor(authService: IAuthService);
    initialize(): Promise<void>;
    /**
     * Sign up a new user with either username or email
     *
     * Example request with both:
     * ```json
     * {
     *   "username": "johndoe",
     *   "email": "user@example.com",
     *   "password": "MySecurePassword123!"
     * }
     * ```
     *
     * Example request with just email:
     * ```json
     * {
     *   "email": "user@example.com",
     *   "password": "MySecurePassword123!"
     * }
     * ```
     *
     * Example request with just username:
     * ```json
     * {
     *   "username": "johndoe",
     *   "password": "MySecurePassword123!"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "User Signed Up"
     * }
     * ```
     *
     * Error response when neither username nor email is provided:
     * ```json
     * {
     *   "message": "Either username or email must be provided"
     * }
     * ```
     *
     * Note: If email is provided, the user will receive a verification code via email
     */
    signup(req: Request, res: Response): Promise<Response>;
    /**
     * Get available login options for a user
     * Used to determine what authentication methods are available
     *
     * Example request:
     * ```json
     * {
     *   "username": "user@example.com"
     * }
     * ```
     *
     * Example response:
     * ```json
     * {
     *   "challenges": ["EMAIL_OTP", "PASSWORD"],
     *   "session": "session-token-string"
     * }
     * ```
     */
    getLoginOptions(req: Request, res: Response): Promise<Response>;
    /**
     * Initiate OTP authentication flow
     * This endpoint starts the OTP challenge by requesting a code to be sent
     *
     * Example request:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "session": "session-token-from-getLoginOptions"
     * }
     * ```
     *
     * Example response:
     * ```json
     * {
     *   "session": "new-session-token",
     *   "challengeName": "EMAIL_OTP",
     *   "challengeParameters": {
     *     "CODE_DELIVERY_DESTINATION": "m***@e***.com"
     *   }
     * }
     * ```
     */
    initiateOtpAuth(req: Request, res: Response): Promise<Response>;
    /**
     * Complete OTP authentication by submitting the received code
     *
     * Example request:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "session": "session-token-from-initiateOtpAuth",
     *   "code": "123456"
     * }
     * ```
     *
     * Success response (tokens issued):
     * ```json
     * {
     *   "AccessToken": "access-token",
     *   "IdToken": "id-token",
     *   "RefreshToken": "refresh-token",
     *   "TokenType": "Bearer",
     *   "ExpiresIn": 3600
     * }
     * ```
     *
     * Challenge response (if additional steps needed):
     * ```json
     * {
     *   "session": "new-session-token",
     *   "challengeName": "NEXT_CHALLENGE_NAME",
     *   "challengeParameters": {}
     * }
     * ```
     */
    respondToOtpChallenge(req: Request, res: Response): Promise<Response>;
    /**
     * Sign in with email and password
     *
     * Example request with username and password:
     * ```json
     * {
     *   "username": "johndoe",
     *   "password": "MySecurePassword123!"
     * }
     * ```
     *
     * Example request with just email:
     * ```json
     * {
     *   "email": "user@example.com",
     *   "password": "MySecurePassword123!"
     *
     * Success response (tokens issued):
     * ```json
     * {
     *   "AccessToken": "access-token",
     *   "IdToken": "id-token",
     *   "RefreshToken": "refresh-token",
     *   "TokenType": "Bearer",
     *   "ExpiresIn": 3600
     * }
     * ```
     *
     * Challenge response (if MFA or other challenge required):
     * ```json
     * {
     *   "challengeName": "SMS_MFA",
     *   "session": "session-token",
     *   "challengeParameters": {
     *     "CODE_DELIVERY_DESTINATION": "+1********99"
     *   }
     * }
     * ```
     */
    signin(req: Request, res: Response): Promise<Response>;
    /**
     * Sign out a user by invalidating their access token
     *
     * Example request:
     * ```json
     * {
     *   "accessToken": "user-access-token"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "User logged out"
     * }
     * ```
     */
    signout(req: Request, res: Response): Promise<Response>;
    /**
     * Refresh access and ID tokens using a refresh token
     *
     * Example request:
     * ```json
     * {
     *   "refreshToken": "your-refresh-token"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "AccessToken": "new-access-token",
     *   "IdToken": "new-id-token",
     *   "RefreshToken": "same-refresh-token",
     *   "TokenType": "Bearer",
     *   "ExpiresIn": 3600
     * }
     * ```
     *
     * Note: The refresh token remains the same as Cognito does not issue new refresh tokens during refresh.
     * Refresh tokens are valid for 30 days by default.
     */
    refreshToken(req: Request, res: Response): Promise<Response>;
    /**
     * Verify a user's email with the code they received
     *
     * Example request:
     * ```json
     * {
     *   "email": "user@example.com",
     *   "code": "123456"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "User verified"
     * }
     * ```
     */
    verify(req: Request, res: Response): Promise<Response>;
    /**
     * Resend verification code to a user's email
     *
     * Example request with email:
     * ```json
     * {
     *   "email": "user@example.com"
     * }
     * ```
     *
     * Example request with username:
     * ```json
     * {
     *   "username": "johndoe"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "Verification code resent"
     * }
     * ```
     */
    resendVerificationCode(req: Request, res: Response): Promise<Response>;
    /**
     * Change a user's password
     * Requires the user to be authenticated with a valid access token
     *
     * Example request:
     * ```json
     * {
     *   "accessToken": "user-access-token",
     *   "oldPassword": "OldPassword123!",
     *   "newPassword": "NewPassword456!"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "Password changed"
     * }
     * ```
     */
    changePassword(req: Request, res: Response): Promise<Response>;
    /**
     * Initiate the forgot password flow
     * This will send a reset code to the user's email
     *
     * Example request:
     * ```json
     * {
     *   "email": "user@example.com"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "Password reset email sent"
     * }
     * ```
     */
    forgotPassword(req: Request, res: Response): Promise<Response>;
    /**
     * Complete the forgot password flow by setting a new password with the reset code
     *
     * Example request:
     * ```json
     * {
     *   "email": "user@example.com",
     *   "code": "123456",
     *   "newPassword": "NewPassword456!"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "Password reset"
     * }
     * ```
     */
    confirmForgotPassword(req: Request, res: Response): Promise<Response>;
    /**
     * Admin endpoint to add a user to a group
     * Requires AWS IAM authorization and appropriate group permissions
     *
     * Example request:
     * ```json
     * {
     *   "email": "user@example.com",
     *   "groupName": "admin"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "message": "User added to group"
     * }
     * ```
     *
     * Note: This endpoint requires the route to be included in the admin group configuration
     * and proper AWS IAM authorization.
     */
    addUserToGroup(req: Request, res: Response): Promise<Response>;
    /**
     * Get AWS credentials using an ID token
     * Used for AWS IAM authentication
     *
     * Example request:
     * ```json
     * {
     *   "idToken": "cognito-id-token"
     * }
     * ```
     *
     * Success response:
     * ```json
     * {
     *   "Credentials": {
     *     "AccessKeyId": "ASIA...",
     *     "SecretKey": "...",
     *     "SessionToken": "...",
     *     "Expiration": "2024-03-21T00:00:00.000Z"
     *   },
     *   "IdentityId": "us-east-1:..."
     * }
     * ```
     */
    getCredentials(req: Request, res: Response): Promise<Response>;
    /**
     * Update MFA preferences for the authenticated user
     *
     * Example request:
     * ```json
     * {
     *   "accessToken": "user-access-token",
     *   "mfaPreference": {
     *     "enabledMethods": ["EMAIL", "SMS"],  // Available methods: "EMAIL", "SMS", "SOFTWARE_TOKEN"
     *     "preferredMethod": "EMAIL"
     *   }
     * }
     * ```
     *
     * Common use cases:
     * 1. Enable email MFA only:
     * ```json
     * {
     *   "accessToken": "user-access-token",
     *   "mfaPreference": {
     *     "enabledMethods": ["EMAIL"],
     *     "preferredMethod": "EMAIL"
     *   }
     * }
     * ```
     *
     * 2. Enable multiple methods with SMS preferred:
     * ```json
     * {
     *   "accessToken": "user-access-token",
     *   "mfaPreference": {
     *     "enabledMethods": ["EMAIL", "SMS", "SOFTWARE_TOKEN"],
     *     "preferredMethod": "SMS"
     *   }
     * }
     * ```
     *
     * 3. Disable all MFA:
     * ```json
     * {
     *   "accessToken": "user-access-token",
     *   "mfaPreference": {
     *     "enabledMethods": []
     *   }
     * }
     * ```
     */
    updateUserMfaPreference(req: Request, res: Response): Promise<Response>;
    /**
     * Admin endpoint to manage MFA settings for any user
     * Requires AWS IAM authorization and appropriate group permissions
     *
     * Example request:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "enabledMethods": ["EMAIL", "SMS"],  // Available methods: "EMAIL", "SMS", "SOFTWARE_TOKEN"
     *   "preferredMethod": "EMAIL"
     * }
     * ```
     *
     * Common use cases:
     * 1. Force enable email MFA for a user:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "enabledMethods": ["EMAIL"],
     *   "preferredMethod": "EMAIL"
     * }
     * ```
     *
     * 2. Enable multiple methods for a user:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "enabledMethods": ["EMAIL", "SMS"],
     *   "preferredMethod": "SMS"
     * }
     * ```
     *
     * 3. Disable all MFA for a user:
     * ```json
     * {
     *   "username": "user@example.com",
     *   "enabledMethods": []
     * }
     * ```
     *
     * Note: This endpoint requires the route to be included in the admin group configuration
     * and proper AWS IAM authorization.
     */
    setUserMfaSettings(req: Request, res: Response): Promise<Response>;
}