import type { ApiContext, PaginatedResult } from './_shared';
export interface ExternalApplicationDto {
    id: string;
    name: string;
    description: string | null;
    clientId: string;
    secretPrefix: string;
    primarySecretCreatedAt: string | null;
    secondarySecretPrefix: string | null;
    secondarySecretCreatedAt: string | null;
    isActive: boolean;
    allowedIpAddresses: string | null;
    tokenExpirationMinutes: number;
    lastAuthenticatedAt: string | null;
    createdAt: string;
    createdBy: string | null;
    updatedAt: string | null;
    updatedBy: string | null;
    authenticationCount: number;
    /** Owning tenant id. null = Global application (visible everywhere). */
    tenantId: string | null;
    /** Owning tenant display name, resolved server-side. null when Global. */
    tenantName: string | null;
    /** Convenience flag: true when tenantId is null (platform-wide). */
    isGlobal: boolean;
}
export interface SecurityMigrationAuditDto {
    migratedAt: string;
    reason: string;
    nonCompliantPermissions: string;
    resolvedDataApiPermissions: string;
    wasActiveBeforeMigration: boolean;
}
export interface ExternalApplicationDetailDto extends ExternalApplicationDto {
    securityMigrationAudit?: SecurityMigrationAuditDto | null;
}
export interface ExternalApplicationCreatedDto extends ExternalApplicationDetailDto {
    clientSecret: string;
}
export interface RotateSecretResponse {
    clientSecret: string;
    secretPrefix: string;
    keySlot: string;
}
export interface CreateExternalApplicationRequest {
    name: string;
    description?: string;
    allowedIpAddresses?: string;
    tokenExpirationMinutes?: number;
}
export interface UpdateExternalApplicationRequest {
    name: string;
    description?: string;
    allowedIpAddresses?: string;
    tokenExpirationMinutes?: number;
}
/** Body of the one-way "attach a Global application to a tenant" admin action. */
export interface AssignToTenantRequest {
    tenantId: string;
}
export interface GeneratedSecretDto {
    clientSecret: string;
}
export interface ExternalAppAuditLogDto {
    id: string;
    clientId: string;
    ipAddress: string;
    action: string;
    success: boolean;
    errorCode: string | null;
    errorMessage: string | null;
    userAgent: string | null;
    keyUsed: string | null;
    endpointCode: string | null;
    durationMs: number | null;
    createdAt: string;
}
export interface ExternalAppUsageStatsDto {
    totalRequests: number;
    successfulRequests: number;
    failedRequests: number;
    avgDurationMs: number | null;
    p95DurationMs: number | null;
    topIpAddresses: IpUsageDto[];
    dailyUsage: DailyUsageDto[];
    errorBreakdown: ErrorBreakdownDto[];
    endpointBreakdown: EndpointUsageDto[];
    keyUsageBreakdown: KeyUsageBreakdownDto;
}
export interface IpUsageDto {
    ipAddress: string;
    requestCount: number;
    lastSeenAt: string;
}
export interface DailyUsageDto {
    date: string;
    success: number;
    failed: number;
}
export interface ErrorBreakdownDto {
    errorCode: string;
    count: number;
    sharePct: number;
}
export interface EndpointUsageDto {
    endpointCode: string;
    requestCount: number;
    successCount: number;
    failedCount: number;
    avgDurationMs: number | null;
}
export interface KeyUsageBreakdownDto {
    primaryUses: number;
    secondaryUses: number;
    unknownKeyUses: number;
}
/** Optional server-side filters for getAuditLogs. Each field maps to a query string param. */
export interface AuditLogFilters {
    success?: boolean;
    errorCode?: string;
    endpointCode?: string;
    /** "Authentication" or "DataExport" — matches ExternalAppAuditAction. */
    action?: string;
    /** "Primary" or "Secondary". */
    keyUsed?: string;
    ipAddress?: string;
    /** ISO 8601 UTC timestamp. */
    fromUtc?: string;
    /** ISO 8601 UTC timestamp. */
    toUtc?: string;
}
export interface KeyUsageStatsDto {
    primary: KeySlotStatsDto;
    secondary: KeySlotStatsDto | null;
}
export interface KeySlotStatsDto {
    keySlot: string;
    secretPrefix: string | null;
    createdAt: string | null;
    totalUses: number;
    successfulUses: number;
    failedUses: number;
    lastUsedAt: string | null;
    lastIpAddress: string | null;
    topCallers: CallerStatsDto[];
}
export interface CallerStatsDto {
    userAgent: string;
    requestCount: number;
    lastSeenAt: string;
}
export interface DataApiEndpointDto {
    id: string;
    code: string;
    name: string;
    description: string | null;
    routeTemplate: string;
    requiredPermission: string;
    entityType: string;
    accessType: string;
    isActive: boolean;
    defaultRateLimitPerMinute: number;
    defaultMaxPageSize: number;
    navigationApplicationId: string;
    applicationCode: string;
    applicationLabel: string;
    navigationModuleId: string;
    moduleCode: string;
    moduleLabel: string;
}
/** Lightweight tenant reference (id + display name), used for per-grant tenant scoping. */
export interface TenantRefDto {
    id: string;
    name: string;
}
export interface ApiAccessDto {
    id: string;
    externalApplicationId: string;
    dataApiEndpointId: string;
    endpointCode: string;
    endpointName: string;
    isEnabled: boolean;
    rateLimitPerMinute: number | null;
    maxPageSize: number | null;
    lastAccessedAt: string | null;
    totalRequestCount: number;
    /** Data-plane tenant scope: empty = all tenants, non-empty = strict whitelist. */
    allowedTenants: TenantRefDto[];
}
export interface UpdateApiAccessRequest {
    isEnabled: boolean;
    rateLimitPerMinute?: number;
    maxPageSize?: number;
    /** null/undefined = leave tenant scope unchanged; [] = all tenants; [ids] = strict whitelist. */
    allowedTenantIds?: string[] | null;
}
/** Instance-level delegation level on a single API application. */
export type ExternalAppAccessLevel = 'ReadOnly' | 'Operate';
/** A SmartStack user delegated to manage a specific API application instance. */
export interface ExternalAppUserAccessDto {
    id: string;
    userId: string;
    userName: string;
    userEmail: string;
    level: ExternalAppAccessLevel;
    grantedAt: string;
    grantedBy: string;
    updatedAt: string | null;
}
/** One admin-plane configuration-change entry (who + how). */
export interface ExternalAppChangeLogDto {
    id: string;
    action: string;
    performedByUserId: string | null;
    performedBy: string;
    ipAddress: string | null;
    /** JSON payload describing the values involved. */
    details: string | null;
    performedAt: string;
}
export interface MyExternalAppDelegationDto {
    appId: string;
    level: ExternalAppAccessLevel;
}
/** Current user's effective access to API applications: global permissions + delegations. */
export interface MyExternalAppAccessDto {
    /** Global row-level visibility (api.accounts.read.all / api.* / *). NOT granted by plain api.accounts.read. */
    canSeeAll: boolean;
    hasGlobalUpdate: boolean;
    canAssign: boolean;
    delegations: MyExternalAppDelegationDto[];
}
export interface ModuleLookupDto {
    id: string;
    code: string;
    label: string;
}
export interface ApplicationLookupDto {
    id: string;
    code: string;
    label: string;
    modules: ModuleLookupDto[];
}
declare const _createExternalAppsApi: (apiContext: ApiContext) => {
    getAll: (params?: {
        search?: string;
        isActive?: boolean;
    }) => Promise<ExternalApplicationDto[]>;
    getById: (id: string) => Promise<ExternalApplicationDetailDto>;
    create: (data: CreateExternalApplicationRequest) => Promise<ExternalApplicationCreatedDto>;
    update: (id: string, data: UpdateExternalApplicationRequest) => Promise<ExternalApplicationDetailDto>;
    /** Attach a Global app to a tenant (one-way). Requires global api.accounts.assign. */
    assignToTenant: (id: string, data: AssignToTenantRequest) => Promise<ExternalApplicationDetailDto>;
    delete: (id: string) => Promise<unknown>;
    activate: (id: string) => Promise<unknown>;
    deactivate: (id: string) => Promise<unknown>;
    rotateSecret: (id: string, keySlot?: "Primary" | "Secondary") => Promise<RotateSecretResponse>;
    revokeSecondarySecret: (id: string) => Promise<unknown>;
    generateSecret: () => Promise<GeneratedSecretDto>;
    getAuditLogs: (id: string, page?: number, pageSize?: number, filters?: AuditLogFilters) => Promise<PaginatedResult<ExternalAppAuditLogDto>>;
    getUsageStats: (id: string, days?: number) => Promise<ExternalAppUsageStatsDto>;
    getKeyUsage: (id: string) => Promise<KeyUsageStatsDto>;
    getApiEndpoints: () => Promise<DataApiEndpointDto[]>;
    getAppApiAccess: (appId: string) => Promise<ApiAccessDto[]>;
    updateApiAccess: (appId: string, endpointId: string, data: UpdateApiAccessRequest) => Promise<ApiAccessDto>;
    removeApiAccess: (appId: string, endpointId: string) => Promise<unknown>;
    getUserAccess: (appId: string) => Promise<ExternalAppUserAccessDto[]>;
    setUserAccess: (appId: string, userId: string, level: ExternalAppAccessLevel) => Promise<ExternalAppUserAccessDto>;
    removeUserAccess: (appId: string, userId: string) => Promise<unknown>;
    getChangeLogs: (appId: string, page?: number, pageSize?: number) => Promise<PaginatedResult<ExternalAppChangeLogDto>>;
    getMyAccess: () => Promise<MyExternalAppAccessDto>;
};
export type ExternalAppsApi = ReturnType<typeof _createExternalAppsApi>;
export declare const createExternalAppsApi: (apiContext: ApiContext) => ExternalAppsApi;
declare const _createApiCatalogApi: (apiContext: ApiContext) => {
    getNavigationLookup: () => Promise<ApplicationLookupDto[]>;
};
export type ApiCatalogApi = ReturnType<typeof _createApiCatalogApi>;
export declare const createApiCatalogApi: (apiContext: ApiContext) => ApiCatalogApi;
export {};
//# sourceMappingURL=externalApps.d.ts.map