import { UserDocument, RoleDocument } from "../../config/Interfaces/Auth/auth.interface";
export interface AuthResult {
    success: boolean;
    message: string;
    user?: UserDocument;
}
export interface MutationResult {
    success: boolean;
    message: string;
    /** True when the failure means "this already exists" (HTTP 409) rather than a validation failure (HTTP 400). */
    conflict?: boolean;
}
export interface SafeUser {
    username: string;
    role: string;
    mustChangePassword: boolean;
    isActive: boolean;
    createdAt: string;
}
/**
 * Business logic for login, password management, and user/role administration.
 * Backed entirely by AxioDB's own Collection API against the `config` database
 * (see ConfigDatabase.service.ts) - no separate storage mechanism.
 */
export default class AuthService {
    login(username: string, password: string): Promise<AuthResult>;
    findUserByUsername(username: string): Promise<UserDocument | null>;
    listUsers(): Promise<SafeUser[]>;
    createUser(username: string, password: string, role: string): Promise<MutationResult>;
    changeOwnPassword(username: string, currentPassword: string, newPassword: string): Promise<{
        success: boolean;
        message: string;
    }>;
    resetUserPassword(username: string, newPassword: string): Promise<{
        success: boolean;
        message: string;
    }>;
    updateUserRole(username: string, newRole: string): Promise<{
        success: boolean;
        message: string;
    }>;
    deleteUser(username: string): Promise<{
        success: boolean;
        message: string;
    }>;
    createRole(roleName: string, permissions: string[]): Promise<MutationResult>;
    listRoles(): Promise<RoleDocument[]>;
    deleteRole(roleName: string): Promise<MutationResult>;
    /**
     * Rejects an operation that would leave zero active Super Admin users behind,
     * preventing a permanent RBAC lockout.
     */
    private assertNotLastSuperAdmin;
}