import type { Request } from 'express';
import type Database from 'better-sqlite3';
import type { RequestContextAuthType } from '../middleware/auth';
import { type EnterpriseAuditRow } from './enterpriseAuditService';
import type { EnterpriseOidcUserInfo } from './enterpriseOidcClient';
interface WorkspaceMembership {
    workspaceId: string;
    name: string;
    role: string;
}
interface StoredSsoSession {
    id: string;
    tenantId: string;
    workspaceId?: string;
    userId: string;
    selectedWorkspaceId?: string;
    authContext: {
        authType: RequestContextAuthType;
        roles: string[];
        scopes: string[];
        email?: string;
        displayName?: string;
    };
    createdAt: number;
    expiresAt: number;
    revokedAt?: number;
}
export interface OidcStatePayload {
    state: string;
    nonce: string;
    returnTo?: string;
    createdAt: number;
}
export type OnboardingStatus = 'ready' | 'needs_workspace_selection' | 'needs_tenant_join' | 'no_workspace_membership';
export interface OnboardingResult {
    status: OnboardingStatus;
    accessToken?: string;
    sessionId?: string;
    tenantId?: string;
    userId?: string;
    workspaceId?: string;
    expiresAt?: number;
    workspaces?: WorkspaceMembership[];
    reason?: string;
}
export interface RequestSsoIdentity {
    userId: string;
    email: string;
    subscription: string;
    authType: RequestContextAuthType;
    tenantId: string;
    workspaceId: string;
    roles: string[];
    scopes: string[];
}
export declare class EnterpriseSsoService {
    private readonly db;
    private static instance;
    constructor(db?: Database.Database);
    static getInstance(): EnterpriseSsoService;
    static resetForTests(): void;
    static setInstanceForTests(service: EnterpriseSsoService): void;
    get sessionCookieName(): string;
    get stateCookieName(): string;
    createStatePayload(returnTo?: string): OidcStatePayload;
    signStatePayload(payload: OidcStatePayload): string;
    verifyStatePayload(signedValue: string | undefined): OidcStatePayload | null;
    createSessionCookieValue(accessToken: string): string;
    resolveRequestIdentityFromRequest(req: Request): RequestSsoIdentity | null;
    hasSessionCredential(req: Request): boolean;
    getOnboardingSessionFromRequest(req: Request): StoredSsoSession | null;
    completeOidcLogin(userInfo: EnterpriseOidcUserInfo): OnboardingResult;
    selectWorkspace(accessToken: string, workspaceIdInput: string): OnboardingResult;
    revokeSession(accessToken: string): boolean;
    listAuditEvents(): EnterpriseAuditRow[];
    private extractSessionToken;
    private createSsoSession;
    private getSessionFromToken;
    private sessionIdFromToken;
    private signSessionId;
    private signJson;
    private verifyJson;
    private cookieSecret;
    private sessionTtlMs;
    private resolveTenantId;
    private userIdFor;
    private subjectHash;
    private upsertTenantAndUser;
    private listMemberships;
    private resolveSelectedWorkspace;
    private auditWorkspaceReady;
    private recordAudit;
}
export declare const enterpriseSsoCookies: {
    session: string;
    state: string;
};
export {};
//# sourceMappingURL=enterpriseSsoService.d.ts.map