/// <reference types="node" />
import * as jwt from 'jsonwebtoken';
import { JWTAlgorithm } from '../constants/jwt-algorithms';
/**
 * JWT Decoder Service for other microservices
 *
 * This service provides utilities for decoding and verifying JWT tokens
 * in other services that don't need the full FC-Auth component.
 */
export interface JWTDecodeOptions {
    /**
     * The public key or secret for verification
     * For ES256/ES384/ES512: Must be an ECDSA public key in PEM format
     * For RS256/RS384/RS512: Must be an RSA public key in PEM format
     * For HS256/HS384/HS512: Must be a secret string
     */
    secret: string | Buffer;
    /**
     * The algorithm used to sign the token
     */
    algorithm: JWTAlgorithm;
    /**
     * Whether to verify the token signature (default: true)
     */
    verify?: boolean;
    /**
     * Additional verification options
     */
    options?: jwt.VerifyOptions;
}
export interface DecodedJWTPayload {
    /**
     * User ID from the token
     */
    id: string;
    /**
     * Encrypted user profile data
     */
    encryptedUserProfile?: string;
    /**
     * Token issued at timestamp
     */
    iat?: number;
    /**
     * Token expiration timestamp
     */
    exp?: number;
    /**
     * Additional custom claims
     */
    [key: string]: any;
}
export declare class JWTDecoderService {
    /**
     * Validate and format the key based on the algorithm
     */
    private static validateKeyForAlgorithm;
    /**
     * Decode and verify a JWT token
     */
    static verifyToken(token: string, options: JWTDecodeOptions): Promise<DecodedJWTPayload>;
    /**
     * Decode a JWT token without verification (unsafe - use only for debugging)
     */
    static decodeTokenUnsafe(token: string): DecodedJWTPayload;
    /**
     * Extract user ID from token without full verification
     */
    static extractUserId(token: string): string;
    /**
     * Check if token is expired without verification
     */
    static isTokenExpired(token: string): boolean;
    /**
     * Get token expiration time
     */
    static getTokenExpiration(token: string): Date | null;
}
/**
 * Quick verification helper for different algorithms
 */
export declare const JWT_VERIFIERS: {
    /**
     * Verify token with ES256 algorithm (ECDSA with SHA-256)
     * @param token - JWT token to verify
     * @param publicKey - ECDSA public key in PEM format
     */
    verifyES256: (token: string, publicKey: string) => Promise<DecodedJWTPayload>;
    /**
     * Verify token with RS256 algorithm (RSA with SHA-256)
     * @param token - JWT token to verify
     * @param publicKey - RSA public key in PEM format
     */
    verifyRS256: (token: string, publicKey: string) => Promise<DecodedJWTPayload>;
    /**
     * Verify token with HS256 algorithm (HMAC with SHA-256)
     * @param token - JWT token to verify
     * @param secret - Secret string for HMAC
     */
    verifyHS256: (token: string, secret: string) => Promise<DecodedJWTPayload>;
};
/**
 * Express.js middleware for JWT verification
 */
export declare function createJWTMiddleware(options: JWTDecodeOptions): (req: any, res: any, next: any) => Promise<any>;
/**
 * Utility functions for key management
 */
export declare const KeyUtils: {
    /**
     * Generate example ECDSA key pair for ES256 (for development/testing only)
     * Note: In production, use proper key management tools
     */
    generateECDSAKeyPairExample: () => {
        privateKey: string;
        publicKey: string;
    };
    /**
     * Validate if a string looks like a PEM formatted key
     */
    isPEMFormatted: (key: string) => boolean;
    /**
     * Get algorithm recommendation based on key type
     */
    getRecommendedAlgorithm: (key: string) => JWTAlgorithm;
};