/**
 * Security Audit Logger
 *
 * Comprehensive security audit logging service for SOC 2 compliance.
 * Wraps the existing audit service with specialized methods for security events.
 * Provides automatic context enrichment, severity classification, and immutable
 * log format with hash chain continuation.
 *
 * @packageDocumentation
 */
import type { ID } from '../common/types.js';
import { AuditService } from './service.js';
import { type SecuritySeverity, type SecurityActor, type SecurityResource, type SecurityEvent, type CreateSecurityEventInput } from './security-events.js';
/**
 * Request context for automatic enrichment
 */
export interface SecurityRequestContext {
    /** Client IP address */
    ip?: string;
    /** User agent string */
    userAgent?: string;
    /** Session ID */
    sessionId?: string;
    /** Tenant ID */
    tenantId: ID;
    /** Request ID */
    requestId?: ID;
    /** Trace ID */
    traceId?: string;
    /** Span ID */
    spanId?: string;
}
/**
 * Security logger configuration
 */
export interface SecurityLoggerConfig {
    /** Enable hash chain for immutability (default: true) */
    enableHashChain?: boolean;
    /** Enable console logging of security events (default: false) */
    consoleLogging?: boolean;
    /** Minimum severity to log (default: 'info') */
    minSeverity?: SecuritySeverity;
    /** Additional metadata to include in all events */
    defaultMetadata?: Record<string, unknown>;
}
/**
 * Security logger dependencies
 */
export interface SecurityLoggerDependencies {
    /** Audit service for persistence */
    auditService?: AuditService;
}
/**
 * Security Audit Logger
 *
 * Provides comprehensive security event logging with automatic context enrichment,
 * severity classification, and immutable hash chain for SOC 2 compliance.
 */
export declare class SecurityAuditLogger {
    private auditService;
    private config;
    private lastHash;
    private sequenceNumber;
    private requestContext;
    constructor(config?: SecurityLoggerConfig, deps?: SecurityLoggerDependencies);
    /**
     * Set request context for automatic enrichment
     * Call this at the start of each request to enrich all security events
     */
    setRequestContext(context: SecurityRequestContext): void;
    /**
     * Clear request context
     * Call this at the end of each request
     */
    clearRequestContext(): void;
    /**
     * Create a scoped logger with preset context
     */
    withContext(context: SecurityRequestContext): ScopedSecurityLogger;
    /**
     * Log a security event
     */
    log(input: CreateSecurityEventInput): Promise<SecurityEvent>;
    /**
     * Log authentication attempt
     */
    logAuthAttempt(actor: SecurityActor, success: boolean, resource: SecurityResource, metadata?: Record<string, unknown>, reason?: string): Promise<SecurityEvent>;
    /**
     * Log session creation
     */
    logSessionCreated(actor: SecurityActor, sessionId: string, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log session validation
     */
    logSessionValidation(actor: SecurityActor, sessionId: string, valid: boolean, reason?: string): Promise<SecurityEvent>;
    /**
     * Log session revocation
     */
    logSessionRevoked(actor: SecurityActor, sessionId: string, reason: string, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log bulk session revocation
     */
    logSessionsBulkRevoked(actor: SecurityActor, userId: string, count: number, reason: string): Promise<SecurityEvent>;
    /**
     * Log API key creation
     */
    logApiKeyCreated(actor: SecurityActor, keyId: string, keyName: string, scopes: string[], metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log API key validation
     */
    logApiKeyValidation(actor: SecurityActor, keyId: string, keyName: string, valid: boolean, reason?: string, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log API key revocation
     */
    logApiKeyRevoked(actor: SecurityActor, keyId: string, keyName: string, reason: string): Promise<SecurityEvent>;
    /**
     * Log API key rotation
     */
    logApiKeyRotated(actor: SecurityActor, oldKeyId: string, newKeyId: string, keyName: string, gracePeriodMinutes?: number): Promise<SecurityEvent>;
    /**
     * Log API key rate limit exceeded
     */
    logApiKeyRateLimited(actor: SecurityActor, keyId: string, keyName: string, retryAfter: number): Promise<SecurityEvent>;
    /**
     * Log MFA enrollment started
     */
    logMfaEnrollmentStarted(actor: SecurityActor, userId: string): Promise<SecurityEvent>;
    /**
     * Log MFA enrollment verification
     */
    logMfaEnrollmentVerified(actor: SecurityActor, userId: string, success: boolean): Promise<SecurityEvent>;
    /**
     * Log MFA enrollment completed
     */
    logMfaEnrolled(actor: SecurityActor, userId: string, backupCodeCount: number): Promise<SecurityEvent>;
    /**
     * Log MFA disabled
     */
    logMfaDisabled(actor: SecurityActor, userId: string, reason?: string): Promise<SecurityEvent>;
    /**
     * Log MFA challenge created
     */
    logMfaChallengeCreated(actor: SecurityActor, userId: string, challengeId: string): Promise<SecurityEvent>;
    /**
     * Log MFA verification
     */
    logMfaVerification(actor: SecurityActor, userId: string, success: boolean, method: string, attemptsRemaining?: number): Promise<SecurityEvent>;
    /**
     * Log MFA backup code used
     */
    logMfaBackupCodeUsed(actor: SecurityActor, userId: string, codesRemaining: number): Promise<SecurityEvent>;
    /**
     * Log MFA backup codes regenerated
     */
    logMfaBackupCodesRegenerated(actor: SecurityActor, userId: string, count: number): Promise<SecurityEvent>;
    /**
     * Log MFA too many attempts
     */
    logMfaTooManyAttempts(actor: SecurityActor, userId: string, attemptCount: number): Promise<SecurityEvent>;
    /**
     * Log access denied
     */
    logAccessDenied(actor: SecurityActor, resource: SecurityResource, reason: string, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log access granted
     */
    logAccessGranted(actor: SecurityActor, resource: SecurityResource, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log privilege escalation
     */
    logPrivilegeEscalated(actor: SecurityActor, userId: string, fromLevel: number, toLevel: number, reason: string): Promise<SecurityEvent>;
    /**
     * Log DPoP verification
     */
    logDpopVerification(actor: SecurityActor, success: boolean, keyThumbprint?: string, error?: string): Promise<SecurityEvent>;
    /**
     * Log agent revocation
     */
    logAgentRevoked(actor: SecurityActor, agentDid: string, reason: string): Promise<SecurityEvent>;
    /**
     * Log key rotation
     */
    logKeyRotation(actor: SecurityActor, keyId: string, keyType: string, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log secret rotation
     */
    logSecretRotation(actor: SecurityActor, secretId: string, secretType: string): Promise<SecurityEvent>;
    /**
     * Log configuration change
     */
    logConfigChange(actor: SecurityActor, configKey: string, resource: SecurityResource, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log security setting change
     */
    logSecuritySettingChange(actor: SecurityActor, settingName: string, oldValue: unknown, newValue: unknown): Promise<SecurityEvent>;
    /**
     * Log brute force detection
     */
    logBruteForceDetected(actor: SecurityActor, targetResource: SecurityResource, attemptCount: number, metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log injection attempt
     */
    logInjectionAttempt(actor: SecurityActor, resource: SecurityResource, injectionType: string, payload: string): Promise<SecurityEvent>;
    /**
     * Log anomaly detection
     */
    logAnomalyDetected(actor: SecurityActor, anomalyType: string, resource: SecurityResource, details: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log rate limit exceeded
     */
    logRateLimitExceeded(actor: SecurityActor, resource: SecurityResource, limitType: string, retryAfter: number): Promise<SecurityEvent>;
    /**
     * Log IP blocked
     */
    logIpBlocked(actor: SecurityActor, ip: string, reason: string, duration?: number): Promise<SecurityEvent>;
    /**
     * Log security incident created
     */
    logIncidentCreated(actor: SecurityActor, incidentId: string, incidentType: string, severity: string, description: string): Promise<SecurityEvent>;
    /**
     * Log data access
     */
    logDataAccess(actor: SecurityActor, resource: SecurityResource, operation: 'read' | 'create' | 'update' | 'delete' | 'export', metadata?: Record<string, unknown>): Promise<SecurityEvent>;
    /**
     * Log sensitive data access
     */
    logSensitiveDataAccess(actor: SecurityActor, resource: SecurityResource, dataClassification: string, reason?: string): Promise<SecurityEvent>;
    /**
     * Generate a unique request ID
     */
    private generateRequestId;
    /**
     * Compute hash for an event
     */
    private computeHash;
    /**
     * Hash a potentially sensitive payload
     */
    private hashPayload;
    /**
     * Log event to console
     */
    private logToConsole;
}
/**
 * Scoped security logger with preset context
 */
export declare class ScopedSecurityLogger {
    private parent;
    private context;
    constructor(parent: SecurityAuditLogger, context: SecurityRequestContext);
    /**
     * Log a security event with scoped context
     */
    log(input: CreateSecurityEventInput): Promise<SecurityEvent>;
    logAuthAttempt: (...args: Parameters<SecurityAuditLogger["logAuthAttempt"]>) => Promise<SecurityEvent>;
    logSessionCreated: (...args: Parameters<SecurityAuditLogger["logSessionCreated"]>) => Promise<SecurityEvent>;
    logSessionValidation: (...args: Parameters<SecurityAuditLogger["logSessionValidation"]>) => Promise<SecurityEvent>;
    logSessionRevoked: (...args: Parameters<SecurityAuditLogger["logSessionRevoked"]>) => Promise<SecurityEvent>;
    logApiKeyCreated: (...args: Parameters<SecurityAuditLogger["logApiKeyCreated"]>) => Promise<SecurityEvent>;
    logApiKeyValidation: (...args: Parameters<SecurityAuditLogger["logApiKeyValidation"]>) => Promise<SecurityEvent>;
    logApiKeyRevoked: (...args: Parameters<SecurityAuditLogger["logApiKeyRevoked"]>) => Promise<SecurityEvent>;
    logApiKeyRotated: (...args: Parameters<SecurityAuditLogger["logApiKeyRotated"]>) => Promise<SecurityEvent>;
    logMfaEnrollmentStarted: (...args: Parameters<SecurityAuditLogger["logMfaEnrollmentStarted"]>) => Promise<SecurityEvent>;
    logMfaEnrolled: (...args: Parameters<SecurityAuditLogger["logMfaEnrolled"]>) => Promise<SecurityEvent>;
    logMfaVerification: (...args: Parameters<SecurityAuditLogger["logMfaVerification"]>) => Promise<SecurityEvent>;
    logAccessDenied: (...args: Parameters<SecurityAuditLogger["logAccessDenied"]>) => Promise<SecurityEvent>;
    logAccessGranted: (...args: Parameters<SecurityAuditLogger["logAccessGranted"]>) => Promise<SecurityEvent>;
    logKeyRotation: (...args: Parameters<SecurityAuditLogger["logKeyRotation"]>) => Promise<SecurityEvent>;
    logBruteForceDetected: (...args: Parameters<SecurityAuditLogger["logBruteForceDetected"]>) => Promise<SecurityEvent>;
    logInjectionAttempt: (...args: Parameters<SecurityAuditLogger["logInjectionAttempt"]>) => Promise<SecurityEvent>;
    logAnomalyDetected: (...args: Parameters<SecurityAuditLogger["logAnomalyDetected"]>) => Promise<SecurityEvent>;
    logDataAccess: (...args: Parameters<SecurityAuditLogger["logDataAccess"]>) => Promise<SecurityEvent>;
    private withScope;
}
/**
 * Get the singleton security audit logger
 */
export declare function getSecurityAuditLogger(config?: SecurityLoggerConfig): SecurityAuditLogger;
/**
 * Create a new security audit logger instance
 */
export declare function createSecurityAuditLogger(config?: SecurityLoggerConfig, deps?: SecurityLoggerDependencies): SecurityAuditLogger;
/**
 * Reset the singleton (for testing)
 */
export declare function resetSecurityAuditLogger(): void;
//# sourceMappingURL=security-logger.d.ts.map