/**
 * Security Center types.
 *
 * The Security Center answers one question for an operator: "is this CMS safe
 * to run in production?" It is mostly a *computed posture* surface — it reads
 * real auth/session/secret/audit state — plus a small set of genuinely
 * enforced, persisted policy settings (MFA requirement, concurrent-session
 * cap). Anything that is not actually enforced is reported as honest status
 * with a source badge, never as a decorative toggle.
 */
export type SecurityStatusLevel = 'secure' | 'needs_attention' | 'at_risk' | 'unknown';
export type CheckStatus = 'pass' | 'warning' | 'fail' | 'unknown';
export interface SecurityCheck {
    key: string;
    label: string;
    status: CheckStatus;
    /** Short human value, e.g. "3 of 4 admins" or "Enabled". */
    value?: string;
    /** In-admin deep link the operator can follow to act on this check. */
    actionHref?: string;
}
export type SecurityWarningCategory = 'auth' | 'sessions' | 'api_keys' | 'uploads' | 'rate_limit' | 'audit' | 'secrets' | 'access';
export interface SecurityWarning {
    id: string;
    severity: 'critical' | 'warning' | 'info';
    category: SecurityWarningCategory;
    title: string;
    description: string;
    actionLabel?: string;
    actionHref?: string;
}
export interface SecurityStatus {
    status: SecurityStatusLevel;
    /** 0–100 posture score (advisory; the level is the source of truth). */
    score: number;
    label: string;
    description: string;
    checks: SecurityCheck[];
    warnings: SecurityWarning[];
    lastCheckedAt: string;
}
/** Persisted, enforced MFA policy. */
export interface MfaSettings {
    required: boolean;
    gracePeriodDays: number;
    /** ISO timestamp when `required` was last switched on (drives the grace window). */
    requiredAt?: string;
}
/** Persisted, enforced session policy. `maxConcurrentSessions = 0` ⇒ unlimited. */
export interface SessionSettings {
    maxConcurrentSessions: number;
}
export interface SecuritySettings {
    mfa: MfaSettings;
    session: SessionSettings;
    updatedAt?: string;
    updatedBy?: string;
}
export interface UsersSecuritySummary {
    totalUsers: number;
    totalAdmins: number;
    withMfa: number;
    withoutMfa: number;
    adminsWithoutMfa: number;
    inactive: number;
}
export interface ApiKeysSecuritySummary {
    active: number;
    withoutExpiration: number;
    broadScope: number;
    staleUnused90d: number;
}
/** Status of secrets/encryption — never the values themselves. */
export interface SecretsStatus {
    cmsSecret: CheckStatus;
    encryptionKey: CheckStatus;
    rateLimitBackend: 'distributed' | 'in_memory';
    apiKeysHashed: boolean;
    webhookSecretsEncrypted: boolean;
}
export interface IpAllowlistStatus {
    enabled: boolean;
    source: 'config' | 'none';
    ranges: string[];
    currentIp: string | null;
    currentIpAllowed: boolean | null;
}
export interface SecuritySourceMetadata {
    source: 'config' | 'environment' | 'database' | 'plugin' | 'computed';
    editable: boolean;
    reason?: string;
}
/** Everything the admin Security tab needs in one round-trip. */
export interface SecurityCenterData {
    settings: SecuritySettings;
    status: SecurityStatus;
    users: UsersSecuritySummary;
    apiKeys: ApiKeysSecuritySummary;
    secrets: SecretsStatus;
    ipAllowlist: IpAllowlistStatus;
    failedLogins24h: number;
    activeSessions: number;
    csrfEnabled: boolean;
    uploadValidation: boolean;
    auditEnabled: boolean;
    /** Effective max session age in hours (config/default; read-only today). */
    sessionMaxAgeHours: number;
    /** Whether the current admin (the viewer) has TOTP enabled — drives lockout-safe MFA enable. */
    viewerHasMfa: boolean;
    environment: string;
    sources: Record<string, SecuritySourceMetadata>;
}
/** Signals consumed by the pure {@link computeSecurityStatus}. */
export interface SecurityStatusInput {
    isProduction: boolean;
    settings: SecuritySettings;
    users: UsersSecuritySummary;
    apiKeys: ApiKeysSecuritySummary;
    secrets: SecretsStatus;
    ipAllowlist: IpAllowlistStatus;
    failedLogins24h: number;
    activeSessions: number;
    csrfEnabled: boolean;
    uploadValidation: boolean;
    auditEnabled: boolean;
}
//# sourceMappingURL=types.d.ts.map