import { Repository } from 'typeorm';
import { IAccessRepository } from '../interfaces/access.repository';
import { SSHKeyInput, SSHKey } from '../interfaces/ssh-key.interface';
import { KeyStorageService } from './key-storage.service';
import { SSHKeyGeneratorService } from './ssh-key-generator.service';
import { BearerTokenDto } from '../dto/bearer-token.dto';
import { CreateBearerTokenDto } from '../dto/create-bearer-token.dto';
import { CloudProvider } from '../../providers/enums/cloud-provider.enum';
import { CredentialType } from '../../management/entities/credentials.entity';
import { CredentialPurpose } from '../enums/credential-purpose.enum';
import { BearerTokenService } from './bearerToken.service';
import { ProviderRefreshTokenDto } from '../dto/refresh-token.dto';
import { ProviderCredentialsRepository } from '../repositories/provider-credentials.repository';
import { JwtService } from '@nestjs/jwt';
import { CreateApiTokenDto } from '../dto/create-api-token.dto';
import { ApiTokenDto } from '../dto/api-token.dto';
import { ApiTokenRepository } from '../repositories/api-token.repository';
import { SSHKeyDto } from '../dto/ssh-key.dto';
import { UpdateSSHKeyDto } from '../dto/update-ssh-key.dto';
import { SSHProviderFactory } from '../providers/ssh-provider.factory';
import { ProviderFactory } from '../../providers/services/provider.factory';
import { LabelService } from '../../common/services/label.service';
import { SshKeyInfo } from '../../providers/interfaces/cloud-provider.interface';
import { ClusterEntity } from '../../infrastructure/clusters/entities/cluster.entity';
export declare class AccessService {
    private readonly repository;
    private readonly keyStorage;
    private readonly keyGenerator;
    private readonly bearerTokenService;
    private readonly providerCredentialsRepository;
    private readonly apiTokenRepository;
    private readonly jwtService;
    private readonly sshProviderFactory;
    private readonly providerFactory;
    private readonly labelService;
    private readonly clusterRepository;
    private readonly logger;
    constructor(repository: IAccessRepository, keyStorage: KeyStorageService, keyGenerator: SSHKeyGeneratorService, bearerTokenService: BearerTokenService, providerCredentialsRepository: ProviderCredentialsRepository, apiTokenRepository: ApiTokenRepository, jwtService: JwtService, sshProviderFactory: SSHProviderFactory, providerFactory: ProviderFactory, labelService: LabelService, clusterRepository: Repository<ClusterEntity>);
    addSSHKey(input: SSHKeyInput & {
        tags?: Record<string, string | string[]>;
        providers?: CloudProvider[];
    }): Promise<SSHKeyDto>;
    /**
     * Create an SSH key from pre-generated key pair
     * Used for temporary bootstrap keys during cluster creation
     */
    createSSHKey(input: {
        name: string;
        public_key: string;
        private_key: string;
        fingerprint: string;
        type: 'ed25519' | 'rsa';
        temporary?: boolean;
        autoGenerated?: boolean;
        metadata?: Record<string, any>;
        tags?: Record<string, string | string[]>;
    }): Promise<any>;
    removeSSHKey(userId: string, keyId: string, removeFromProviders?: boolean, provider?: CloudProvider): Promise<void>;
    getPrivateKey(userId: string, keyId: string): Promise<string>;
    generateBearerToken(provider: CloudProvider, dto: CreateBearerTokenDto): Promise<BearerTokenDto>;
    getActiveBearerToken(provider: CloudProvider): Promise<BearerTokenDto>;
    refreshBearerToken(provider: CloudProvider, dto: ProviderRefreshTokenDto): Promise<BearerTokenDto>;
    listBearerTokens(): Promise<import("../entities/credentials.entity").ProviderCredentialsEntity[]>;
    removeBearerToken(id: string): Promise<void>;
    /**
     * Retrieves all active API tokens
     * @returns List of API tokens as DTOs
     */
    listApiTokens(): Promise<ApiTokenDto[]>;
    /**
     * Creates a new API token
     * @param createApiTokenDto Data for token creation
     * @returns The created token as DTO
     */
    createApiToken(createApiTokenDto: CreateApiTokenDto): Promise<ApiTokenDto>;
    createAccessKeyPair(dto: {
        provider: CloudProvider;
        accessKey: string;
        secretKey: string;
        label: string;
        notes?: string;
        expiresAt?: Date;
    }): Promise<ApiTokenDto>;
    getActiveAccessKeyPair(provider: CloudProvider, purpose?: CredentialPurpose): Promise<{
        accessKey: string;
        secretKey: string;
    }>;
    getActiveCredentialMetadata(provider: CloudProvider, purpose?: CredentialPurpose): Promise<{
        id: string;
        credentialType: CredentialType;
        expiresAt: Date | null;
    } | null>;
    updateActiveCredentialExpiry(provider: CloudProvider, expiresAt: Date | null, purpose?: CredentialPurpose): Promise<void>;
    deleteActiveProviderCredentials(provider: CloudProvider, purpose?: CredentialPurpose): Promise<void>;
    /**
     * Retrieves and decrypts an API token
     * @param id ID of the token to retrieve
     * @returns The decrypted token value
     */
    getDecryptApiToken(id: string): Promise<string>;
    /**
     * Retrieves information about an API token
     * @param id ID of the token to retrieve
     * @returns Token information as DTO
     */
    getApiToken(id: string): Promise<ApiTokenDto>;
    getActiveApiToken(provider: CloudProvider, purpose?: CredentialPurpose): Promise<string>;
    /**
     * Deletes an API token
     * @param id ID of the token to delete
     * @returns Confirmation message
     */
    removeApiToken(id: string): Promise<{
        success: boolean;
        message: string;
    }>;
    /**
     * Retrieves all API tokens for a specific provider
     * @param provider Provider of tokens to retrieve
     * @returns List of API tokens as DTOs
     */
    getApiTokensByProvider(provider: CloudProvider): Promise<ApiTokenDto[]>;
    /**
     * Updates the last used timestamp of a token
     * @param id ID of the token to update
     */
    updateApiTokenLastUsed(id: string): Promise<void>;
    listSSHKeys(provider?: CloudProvider, tagFilters?: Record<string, string | string[]>): Promise<SSHKeyDto[]>;
    private getSSHKeysFromProvider;
    private combineSSHKeys;
    updateSSHKey(keyId: string, updateDto: UpdateSSHKeyDto): Promise<SSHKeyDto>;
    /**
     * Sync SSH key to all configured providers (or a specific subset).
     * Returns a map of provider → error message for any providers that failed.
     * Providers that succeed are persisted in providerKeyMappings before returning.
     */
    private syncSSHKeyToAllProviders;
    /**
     * Sync SSH key with a specific provider
     */
    syncSSHKeyWithProvider(sshKey: SSHKey, provider: CloudProvider): Promise<string | null>;
    /**
     * Sync SSH key with a specific provider using custom labels
     * Used for bootstrap keys that need cluster-specific labels
     */
    syncSSHKeyWithProviderAndLabels(sshKeyId: string, provider: CloudProvider, customLabels: Record<string, string>): Promise<string>;
    /**
     * Remove SSH key from specific providers without deleting it locally.
     * Returns a map of provider → error message for any that failed.
     */
    private unsyncSSHKeyFromProviders;
    /**
     * Remove SSH key from all providers
     */
    private removeSSHKeyFromAllProviders;
    /**
     * Remove SSH key from a specific provider
     */
    private removeSSHKeyFromProvider;
    /**
     * Load SSH keys from the local DB and return them as SshKeyInfo[],
     * including any already-cached provider key ID.
     * After the provider resolves them, call saveSSHKeyProviderMappings() to persist.
     */
    getSSHKeysAsProviderInfo(sshKeyIds: string[], provider: CloudProvider): Promise<{
        infos: SshKeyInfo[];
        entities: SSHKey[];
    }>;
    /**
     * Persist resolved provider key IDs back to the local DB.
     */
    saveSSHKeyProviderMappings(entities: SSHKey[], providerIds: string[], provider: CloudProvider): Promise<void>;
    /**
     * Retrieve and decrypt the bootstrap private key for a cluster.
     * First checks cluster.bootstrapKeyId, then falls back to searching
     * by cluster-id/purpose/node-type tags (master node bootstrap key).
     * Used as a fallback SSH auth method when the CA is not yet configured on the server.
     */
    getBootstrapPrivateKeyForCluster(clusterId: string): Promise<string>;
}
