import { type DrizzleExecutor } from "../drizzle.js";
import type { FastifyRequest } from "fastify";
import type { ServerConfig } from "../config/type.js";
import type { ActiveSession } from "./types.js";
import type { User } from "../user/types.js";
import { type AuthenticationRequest } from "./metadata.js";
import { type CloudflareAccessIdentity } from "./cloudflare-access.js";
import { TokenService } from "./tokens.js";
import { type CreatedDevToken } from "./developmentTokenCreate.js";
export interface AuthenticatedAccount {
    accountId: string;
    session?: ActiveSession;
    cloudflareAccess?: CloudflareAccessIdentity;
}
export type Authenticated = {
    local: true;
    user: User;
} | (AuthenticatedAccount & {
    local: false;
    user: User;
});
export interface AuthToken {
    token: string;
    expiresAt: string;
    profileRequired: boolean;
}
export declare class AuthService {
    private readonly config;
    private readonly executor;
    private readonly tokens;
    private readonly localToken;
    private readonly passwordPepper;
    private readonly shouldTouchAccess;
    constructor(config: ServerConfig, executor: DrizzleExecutor, tokens: TokenService, suppliedLocalToken?: string);
    /** Account authentication is reserved for account-management paths such as creating a profile. */
    authenticateAccount(request: AuthenticationRequest): Promise<AuthenticatedAccount | undefined>;
    /** Product routes use active Users, never bare authentication accounts. */
    authenticate(request: AuthenticationRequest): Promise<Authenticated | undefined>;
    registerPassword(body: unknown, request: FastifyRequest): Promise<AuthToken | "invalid" | "registration_closed" | "account_exists">;
    loginPassword(body: unknown, request: FastifyRequest): Promise<AuthToken | undefined>;
    resetPassword(targetUserId: string, body: unknown, request: FastifyRequest): Promise<{
        revokedSessionCount: number;
    } | "invalid" | "unauthorized">;
    createProfile(body: unknown, request: FastifyRequest): Promise<User | "invalid" | "unauthorized" | "registration_closed">;
    updateProfile(body: unknown, request: FastifyRequest): Promise<User | "invalid" | "unauthorized">;
    requestMagicLink(body: unknown): Promise<boolean>;
    verifyMagicLink(body: unknown, request: FastifyRequest): Promise<AuthToken | undefined>;
    startOidc(providerName: string): Promise<string | undefined>;
    completeOidc(providerName: string, query: {
        code?: string;
        state?: string;
        error?: string;
    }, request: FastifyRequest): Promise<AuthToken | "authorization_failed" | "invalid_state" | "registration_closed">;
    refresh(request: FastifyRequest): Promise<AuthToken | undefined>;
    createDevToken(request: FastifyRequest): Promise<CreatedDevToken | undefined>;
    logout(request: FastifyRequest): Promise<boolean | "managed_by_cloudflare_access">;
    private issue;
}
//# sourceMappingURL=service.d.ts.map