/**
 * Break-Glass Emergency Access System
 *
 * Provides emergency privileged access for critical situations when normal
 * authorization cannot be obtained in time. Implements strict controls including:
 * - Multi-factor authentication verification
 * - Real-time notifications to all security admins
 * - SMS/phone alerts to CISO
 * - Comprehensive audit trail
 * - Automatic expiration and post-incident review requirements
 * - Usage limits to prevent abuse
 *
 * @packageDocumentation
 */
import { z } from 'zod';
import type { FastifyRequest, preHandlerHookHandler } from 'fastify';
/**
 * Scope of break-glass access
 */
export declare const BreakGlassScope: {
    readonly FULL: "full";
    readonly LIMITED: "limited";
};
export type BreakGlassScope = (typeof BreakGlassScope)[keyof typeof BreakGlassScope];
export declare const breakGlassScopeSchema: z.ZodNativeEnum<{
    readonly FULL: "full";
    readonly LIMITED: "limited";
}>;
/**
 * Status of a break-glass session
 */
export declare const BreakGlassStatus: {
    readonly PENDING_VERIFICATION: "pending_verification";
    readonly ACTIVE: "active";
    readonly EXPIRED: "expired";
    readonly REVOKED: "revoked";
    readonly REVIEW_PENDING: "review_pending";
    readonly REVIEWED: "reviewed";
};
export type BreakGlassStatus = (typeof BreakGlassStatus)[keyof typeof BreakGlassStatus];
export declare const breakGlassStatusSchema: z.ZodNativeEnum<{
    readonly PENDING_VERIFICATION: "pending_verification";
    readonly ACTIVE: "active";
    readonly EXPIRED: "expired";
    readonly REVOKED: "revoked";
    readonly REVIEW_PENDING: "review_pending";
    readonly REVIEWED: "reviewed";
}>;
/**
 * Verification method used for break-glass
 */
export declare const VerificationMethod: {
    readonly MFA_TOTP: "mfa_totp";
    readonly MFA_BACKUP_CODE: "mfa_backup_code";
    readonly PHONE_CALLBACK: "phone_callback";
    readonly HARDWARE_TOKEN: "hardware_token";
};
export type VerificationMethod = (typeof VerificationMethod)[keyof typeof VerificationMethod];
export declare const verificationMethodSchema: z.ZodNativeEnum<{
    readonly MFA_TOTP: "mfa_totp";
    readonly MFA_BACKUP_CODE: "mfa_backup_code";
    readonly PHONE_CALLBACK: "phone_callback";
    readonly HARDWARE_TOKEN: "hardware_token";
}>;
/**
 * Break-glass request input
 */
export interface BreakGlassRequest {
    /** User ID of the requester */
    userId: string;
    /** Mandatory justification for the emergency access */
    reason: string;
    /** Optional linked incident ID */
    incidentId?: string;
    /** Scope of access requested */
    scope: BreakGlassScope;
    /** Specific resources if scope is 'limited' */
    resources?: string[];
    /** IP address of the requester */
    ipAddress?: string;
    /** Device fingerprint for verification */
    deviceFingerprint?: string;
    /** User agent string */
    userAgent?: string;
}
export declare const breakGlassRequestSchema: z.ZodEffects<z.ZodObject<{
    userId: z.ZodString;
    reason: z.ZodString;
    incidentId: z.ZodOptional<z.ZodString>;
    scope: z.ZodNativeEnum<{
        readonly FULL: "full";
        readonly LIMITED: "limited";
    }>;
    resources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    ipAddress: z.ZodOptional<z.ZodString>;
    deviceFingerprint: z.ZodOptional<z.ZodString>;
    userAgent: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    userAgent?: string;
    userId?: string;
    ipAddress?: string;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    incidentId?: string;
}, {
    reason?: string;
    userAgent?: string;
    userId?: string;
    ipAddress?: string;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    incidentId?: string;
}>, {
    reason?: string;
    userAgent?: string;
    userId?: string;
    ipAddress?: string;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    incidentId?: string;
}, {
    reason?: string;
    userAgent?: string;
    userId?: string;
    ipAddress?: string;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    incidentId?: string;
}>;
/**
 * Action performed during a break-glass session
 */
export interface BreakGlassAction {
    /** Unique action ID */
    id: string;
    /** Timestamp of the action */
    timestamp: Date;
    /** Type of action */
    type: string;
    /** HTTP method if applicable */
    method?: string;
    /** Resource path */
    path?: string;
    /** Resource ID */
    resourceId?: string;
    /** IP address */
    ipAddress?: string;
    /** User agent */
    userAgent?: string;
    /** Request body hash (for audit, not actual content) */
    requestBodyHash?: string;
    /** Response status code */
    responseStatus?: number;
    /** Duration of the action in milliseconds */
    durationMs?: number;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
export declare const breakGlassActionSchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodDate;
    type: z.ZodString;
    method: z.ZodOptional<z.ZodString>;
    path: z.ZodOptional<z.ZodString>;
    resourceId: z.ZodOptional<z.ZodString>;
    ipAddress: z.ZodOptional<z.ZodString>;
    userAgent: z.ZodOptional<z.ZodString>;
    requestBodyHash: z.ZodOptional<z.ZodString>;
    responseStatus: z.ZodOptional<z.ZodNumber>;
    durationMs: z.ZodOptional<z.ZodNumber>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    path?: string;
    durationMs?: number;
    id?: string;
    type?: string;
    metadata?: Record<string, unknown>;
    userAgent?: string;
    method?: string;
    ipAddress?: string;
    resourceId?: string;
    timestamp?: Date;
    responseStatus?: number;
    requestBodyHash?: string;
}, {
    path?: string;
    durationMs?: number;
    id?: string;
    type?: string;
    metadata?: Record<string, unknown>;
    userAgent?: string;
    method?: string;
    ipAddress?: string;
    resourceId?: string;
    timestamp?: Date;
    responseStatus?: number;
    requestBodyHash?: string;
}>;
/**
 * Break-glass session
 */
export interface BreakGlassSession {
    /** Unique session ID */
    id: string;
    /** User ID of the requester */
    userId: string;
    /** Justification reason */
    reason: string;
    /** Linked incident ID */
    incidentId?: string;
    /** Access scope */
    scope: BreakGlassScope;
    /** Specific resources if limited scope */
    resources?: string[];
    /** Session status */
    status: BreakGlassStatus;
    /** When the session started */
    startedAt: Date;
    /** When the session expires */
    expiresAt: Date;
    /** When the session ended (revoked or expired) */
    endedAt?: Date;
    /** Who revoked the session */
    revokedBy?: string;
    /** Reason for revocation */
    revocationReason?: string;
    /** Whether the session has been renewed */
    renewed: boolean;
    /** Actions performed during the session */
    actions: BreakGlassAction[];
    /** Always requires post-incident review */
    requiresPostReview: true;
    /** Verification methods used */
    verificationMethods: VerificationMethod[];
    /** IP address at activation */
    activationIp?: string;
    /** Device fingerprint at activation */
    deviceFingerprint?: string;
    /** Notifications sent */
    notificationsSent: BreakGlassNotification[];
    /** Post-incident review details */
    review?: BreakGlassReview;
}
export declare const breakGlassSessionSchema: z.ZodObject<{
    id: z.ZodString;
    userId: z.ZodString;
    reason: z.ZodString;
    incidentId: z.ZodOptional<z.ZodString>;
    scope: z.ZodNativeEnum<{
        readonly FULL: "full";
        readonly LIMITED: "limited";
    }>;
    resources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    status: z.ZodNativeEnum<{
        readonly PENDING_VERIFICATION: "pending_verification";
        readonly ACTIVE: "active";
        readonly EXPIRED: "expired";
        readonly REVOKED: "revoked";
        readonly REVIEW_PENDING: "review_pending";
        readonly REVIEWED: "reviewed";
    }>;
    startedAt: z.ZodDate;
    expiresAt: z.ZodDate;
    endedAt: z.ZodOptional<z.ZodDate>;
    revokedBy: z.ZodOptional<z.ZodString>;
    revocationReason: z.ZodOptional<z.ZodString>;
    renewed: z.ZodBoolean;
    actions: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        timestamp: z.ZodDate;
        type: z.ZodString;
        method: z.ZodOptional<z.ZodString>;
        path: z.ZodOptional<z.ZodString>;
        resourceId: z.ZodOptional<z.ZodString>;
        ipAddress: z.ZodOptional<z.ZodString>;
        userAgent: z.ZodOptional<z.ZodString>;
        requestBodyHash: z.ZodOptional<z.ZodString>;
        responseStatus: z.ZodOptional<z.ZodNumber>;
        durationMs: z.ZodOptional<z.ZodNumber>;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        path?: string;
        durationMs?: number;
        id?: string;
        type?: string;
        metadata?: Record<string, unknown>;
        userAgent?: string;
        method?: string;
        ipAddress?: string;
        resourceId?: string;
        timestamp?: Date;
        responseStatus?: number;
        requestBodyHash?: string;
    }, {
        path?: string;
        durationMs?: number;
        id?: string;
        type?: string;
        metadata?: Record<string, unknown>;
        userAgent?: string;
        method?: string;
        ipAddress?: string;
        resourceId?: string;
        timestamp?: Date;
        responseStatus?: number;
        requestBodyHash?: string;
    }>, "many">;
    requiresPostReview: z.ZodLiteral<true>;
    verificationMethods: z.ZodArray<z.ZodNativeEnum<{
        readonly MFA_TOTP: "mfa_totp";
        readonly MFA_BACKUP_CODE: "mfa_backup_code";
        readonly PHONE_CALLBACK: "phone_callback";
        readonly HARDWARE_TOKEN: "hardware_token";
    }>, "many">;
    activationIp: z.ZodOptional<z.ZodString>;
    deviceFingerprint: z.ZodOptional<z.ZodString>;
    notificationsSent: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        channel: z.ZodString;
        target: z.ZodString;
        sentAt: z.ZodDate;
        success: z.ZodBoolean;
        error: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        error?: string;
        target?: string;
        id?: string;
        success?: boolean;
        channel?: string;
        sentAt?: Date;
    }, {
        error?: string;
        target?: string;
        id?: string;
        success?: boolean;
        channel?: string;
        sentAt?: Date;
    }>, "many">;
    review: z.ZodOptional<z.ZodObject<{
        reviewedAt: z.ZodDate;
        reviewedBy: z.ZodString;
        approved: z.ZodBoolean;
        findings: z.ZodString;
        recommendedActions: z.ZodArray<z.ZodString, "many">;
    }, "strip", z.ZodTypeAny, {
        approved?: boolean;
        findings?: string;
        reviewedAt?: Date;
        reviewedBy?: string;
        recommendedActions?: string[];
    }, {
        approved?: boolean;
        findings?: string;
        reviewedAt?: Date;
        reviewedBy?: string;
        recommendedActions?: string[];
    }>>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    id?: string;
    status?: "active" | "expired" | "revoked" | "pending_verification" | "review_pending" | "reviewed";
    userId?: string;
    expiresAt?: Date;
    actions?: {
        path?: string;
        durationMs?: number;
        id?: string;
        type?: string;
        metadata?: Record<string, unknown>;
        userAgent?: string;
        method?: string;
        ipAddress?: string;
        resourceId?: string;
        timestamp?: Date;
        responseStatus?: number;
        requestBodyHash?: string;
    }[];
    startedAt?: Date;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    revokedBy?: string;
    revocationReason?: string;
    incidentId?: string;
    endedAt?: Date;
    renewed?: boolean;
    requiresPostReview?: true;
    verificationMethods?: ("mfa_totp" | "mfa_backup_code" | "phone_callback" | "hardware_token")[];
    activationIp?: string;
    notificationsSent?: {
        error?: string;
        target?: string;
        id?: string;
        success?: boolean;
        channel?: string;
        sentAt?: Date;
    }[];
    review?: {
        approved?: boolean;
        findings?: string;
        reviewedAt?: Date;
        reviewedBy?: string;
        recommendedActions?: string[];
    };
}, {
    reason?: string;
    id?: string;
    status?: "active" | "expired" | "revoked" | "pending_verification" | "review_pending" | "reviewed";
    userId?: string;
    expiresAt?: Date;
    actions?: {
        path?: string;
        durationMs?: number;
        id?: string;
        type?: string;
        metadata?: Record<string, unknown>;
        userAgent?: string;
        method?: string;
        ipAddress?: string;
        resourceId?: string;
        timestamp?: Date;
        responseStatus?: number;
        requestBodyHash?: string;
    }[];
    startedAt?: Date;
    resources?: string[];
    scope?: "full" | "limited";
    deviceFingerprint?: string;
    revokedBy?: string;
    revocationReason?: string;
    incidentId?: string;
    endedAt?: Date;
    renewed?: boolean;
    requiresPostReview?: true;
    verificationMethods?: ("mfa_totp" | "mfa_backup_code" | "phone_callback" | "hardware_token")[];
    activationIp?: string;
    notificationsSent?: {
        error?: string;
        target?: string;
        id?: string;
        success?: boolean;
        channel?: string;
        sentAt?: Date;
    }[];
    review?: {
        approved?: boolean;
        findings?: string;
        reviewedAt?: Date;
        reviewedBy?: string;
        recommendedActions?: string[];
    };
}>;
/**
 * Notification record
 */
export interface BreakGlassNotification {
    id: string;
    channel: 'email' | 'slack' | 'sms' | 'phone' | 'pagerduty';
    target: string;
    sentAt: Date;
    success: boolean;
    error?: string;
}
/**
 * Post-incident review
 */
export interface BreakGlassReview {
    reviewedAt: Date;
    reviewedBy: string;
    approved: boolean;
    findings: string;
    recommendedActions: string[];
}
/**
 * Full audit trail for a break-glass session
 */
export interface BreakGlassAudit {
    /** The session details */
    session: BreakGlassSession;
    /** User's break-glass usage this month */
    monthlyUsageCount: number;
    /** Timeline of all events */
    timeline: BreakGlassAuditEvent[];
    /** Compliance export data */
    complianceExport: BreakGlassComplianceExport;
}
/**
 * Audit event
 */
export interface BreakGlassAuditEvent {
    timestamp: Date;
    eventType: string;
    actor: string;
    details: Record<string, unknown>;
}
/**
 * Compliance export format
 */
export interface BreakGlassComplianceExport {
    exportedAt: Date;
    sessionId: string;
    userId: string;
    reason: string;
    scope: BreakGlassScope;
    startTime: string;
    endTime: string;
    duration: number;
    actionsCount: number;
    resourcesAccessed: string[];
    incidentId?: string;
    reviewStatus: string;
    reviewFindings?: string;
    hashChain: string;
}
/**
 * MFA verification input
 */
export interface MfaVerificationInput {
    method: VerificationMethod;
    code?: string;
    challengeId?: string;
}
/**
 * Phone callback verification
 */
export interface PhoneCallbackInput {
    phoneNumber: string;
    callbackCode: string;
}
/**
 * Service dependencies
 */
export interface BreakGlassServiceDependencies {
    /** Notification service for alerts */
    notificationService?: NotificationServiceInterface;
    /** MFA service for verification */
    mfaService?: MfaServiceInterface;
    /** Incident management service */
    incidentService?: IncidentServiceInterface;
    /** Audit logger */
    auditLogger?: AuditLoggerInterface;
    /** Compliance export service */
    complianceExporter?: ComplianceExporterInterface;
}
/**
 * Service configuration
 */
export interface BreakGlassServiceConfig {
    /** Maximum session duration in milliseconds */
    maxSessionDurationMs?: number;
    /** Maximum uses per user per month */
    maxUsesPerMonth?: number;
    /** Review deadline in milliseconds */
    reviewDeadlineMs?: number;
    /** Require phone callback for full scope */
    requirePhoneCallbackForFullScope?: boolean;
    /** Security admin user IDs for notifications */
    securityAdminIds?: string[];
    /** CISO contact for SMS/phone alerts */
    cisoContact?: {
        userId: string;
        phone: string;
        email: string;
    };
    /** Slack webhook for alerts */
    slackWebhookUrl?: string;
    /** PagerDuty routing key */
    pagerDutyRoutingKey?: string;
}
interface NotificationServiceInterface {
    sendSlack(webhookUrl: string, message: Record<string, unknown>): Promise<{
        success: boolean;
        error?: string;
    }>;
    sendEmail(to: string, subject: string, body: string): Promise<{
        success: boolean;
        error?: string;
    }>;
    sendSms(phone: string, message: string): Promise<{
        success: boolean;
        error?: string;
    }>;
    sendPagerDuty(routingKey: string, payload: Record<string, unknown>): Promise<{
        success: boolean;
        error?: string;
    }>;
    initiatePhoneCallback(phone: string, code: string): Promise<{
        success: boolean;
        error?: string;
    }>;
}
interface MfaServiceInterface {
    verifyTotp(userId: string, code: string): Promise<boolean>;
    verifyBackupCode(userId: string, code: string): Promise<boolean>;
    verifyHardwareToken(userId: string, assertion: string): Promise<boolean>;
}
interface IncidentServiceInterface {
    createIncident(input: {
        title: string;
        description: string;
        severity: string;
        type: string;
        metadata?: Record<string, unknown>;
    }): Promise<{
        id: string;
    }>;
    linkToIncident(incidentId: string, sessionId: string): Promise<void>;
}
interface AuditLoggerInterface {
    log(event: {
        eventType: string;
        actor: {
            type: string;
            id: string;
            ip?: string;
        };
        action: string;
        resource: {
            type: string;
            id: string;
        };
        outcome: 'success' | 'failure' | 'blocked';
        reason?: string;
        metadata?: Record<string, unknown>;
    }): Promise<void>;
}
interface ComplianceExporterInterface {
    export(data: BreakGlassComplianceExport): Promise<void>;
}
/**
 * Break-Glass Emergency Access Service
 *
 * Provides controlled emergency access for critical situations with
 * comprehensive auditing and safety controls.
 */
export declare class BreakGlassService {
    private sessions;
    private userMonthlyUsage;
    private pendingVerifications;
    private expirationTimers;
    private readonly config;
    private readonly notificationService?;
    private readonly mfaService?;
    private readonly incidentService?;
    private readonly auditLogger?;
    private readonly complianceExporter?;
    constructor(config?: BreakGlassServiceConfig, deps?: BreakGlassServiceDependencies);
    /**
     * Initiate a break-glass emergency access request
     *
     * This creates a pending session that requires verification before activation.
     * All security admins are immediately notified.
     */
    initiateBreakGlass(request: BreakGlassRequest): Promise<BreakGlassSession>;
    /**
     * Verify MFA for break-glass activation
     */
    verifyMfa(sessionId: string, verification: MfaVerificationInput): Promise<boolean>;
    /**
     * Activate a break-glass session after verification
     */
    activateSession(sessionId: string): Promise<BreakGlassSession>;
    /**
     * Validate if a break-glass session is currently valid
     */
    validateBreakGlass(sessionId: string): Promise<boolean>;
    /**
     * Revoke a break-glass session
     */
    revokeBreakGlass(sessionId: string, revokedBy: string, reason?: string): Promise<void>;
    /**
     * Get all currently active break-glass sessions
     */
    getActiveBreakGlass(): Promise<BreakGlassSession[]>;
    /**
     * Get full audit trail for a break-glass session
     */
    auditBreakGlass(sessionId: string): Promise<BreakGlassAudit>;
    /**
     * Record an action performed during a break-glass session
     */
    recordAction(sessionId: string, action: Omit<BreakGlassAction, 'id' | 'timestamp'>): Promise<void>;
    /**
     * Renew a break-glass session (can only be done once)
     */
    renewSession(sessionId: string, reason: string): Promise<BreakGlassSession>;
    /**
     * Submit post-incident review for a break-glass session
     */
    submitReview(sessionId: string, reviewedBy: string, review: Omit<BreakGlassReview, 'reviewedAt' | 'reviewedBy'>): Promise<BreakGlassSession>;
    /**
     * Get session by ID
     */
    getSession(sessionId: string): BreakGlassSession | undefined;
    /**
     * Get sessions pending review
     */
    getPendingReviews(): BreakGlassSession[];
    /**
     * Check if a resource is accessible under a break-glass session
     */
    isResourceAccessible(sessionId: string, resourceId: string): boolean;
    private expireSession;
    private setExpirationTimer;
    private clearExpirationTimer;
    private getMonthlyUsage;
    private incrementMonthlyUsage;
    private generateCallbackCode;
    private notifyAllSecurityAdmins;
    private alertCiso;
    private auditLog;
    private buildComplianceExport;
    private computeHashChain;
    private exportToCompliance;
    /**
     * Clean up resources
     */
    destroy(): void;
}
/**
 * Break-glass specific error
 */
export declare class BreakGlassError extends Error {
    readonly code: string;
    constructor(code: string, message: string);
}
/**
 * Middleware options for break-glass route protection
 */
export interface AllowBreakGlassOptions {
    /** Break-glass service instance */
    service: BreakGlassService;
    /** Header name for session ID (default: 'x-break-glass-session') */
    sessionHeader?: string;
    /** Require specific scope for this route */
    requiredScope?: BreakGlassScope;
    /** Specific resource ID for limited scope validation */
    resourceId?: string | ((request: FastifyRequest) => string);
}
/**
 * Create middleware that allows break-glass sessions to override normal authorization
 *
 * This middleware should be added to protected routes that need to support
 * emergency access. It checks for a valid break-glass session and records
 * all actions performed during the session.
 *
 * @example
 * ```typescript
 * fastify.route({
 *   method: 'POST',
 *   url: '/admin/critical-action',
 *   preHandler: [
 *     normalAuthMiddleware,
 *     allowBreakGlass({ service: breakGlassService }),
 *   ],
 *   handler: handleCriticalAction,
 * });
 * ```
 */
export declare function allowBreakGlass(options: AllowBreakGlassOptions): preHandlerHookHandler;
/**
 * Create a new break-glass service instance
 */
export declare function createBreakGlassService(config?: BreakGlassServiceConfig, deps?: BreakGlassServiceDependencies): BreakGlassService;
declare module 'fastify' {
    interface FastifyRequest {
        breakGlassSession?: BreakGlassSession;
    }
}
export {};
//# sourceMappingURL=break-glass.d.ts.map