/**
 * Session Manager - High-level session management
 *
 * Provides secure session lifecycle management including:
 * - Session creation with device tracking
 * - Session validation with security checks
 * - Revocation on security events
 * - Re-authentication for sensitive operations
 *
 * @packageDocumentation
 */
import { type Session, type CreateSessionInput, type SessionStoreConfig } from './session-store.js';
import { type RequestHeaders, type FingerprintValidationResult } from './fingerprint-service.js';
/**
 * Session manager configuration
 */
export interface SessionManagerConfig extends Partial<SessionStoreConfig> {
    /** Require re-authentication for sensitive operations */
    requireReauthForSensitive: boolean;
    /** Time window for sensitive operations after auth (seconds) */
    sensitiveOperationWindow: number;
    /** Inactivity timeout before requiring re-auth (seconds) */
    inactivityTimeout: number;
    /** Whether to revoke sessions on password change */
    revokeOnPasswordChange: boolean;
    /** Whether to revoke sessions on email change */
    revokeOnEmailChange: boolean;
    /** Whether to detect concurrent sessions from different locations */
    detectConcurrentSessions: boolean;
    /** Whether to validate fingerprints on session validation */
    fingerprintEnabled: boolean;
    /** Fingerprint strictness: 'warn' logs mismatches, 'block' rejects */
    fingerprintStrictness: 'warn' | 'block';
}
/**
 * Options for session regeneration
 */
export interface RegenerateSessionOptions {
    /** New IP address for the session (defaults to old session's IP) */
    ipAddress?: string;
    /** New user agent for the session (defaults to old session's userAgent) */
    userAgent?: string;
    /** New device fingerprint */
    deviceFingerprint?: string;
    /** Additional metadata to merge */
    metadata?: Record<string, unknown>;
    /** Reason for regeneration (for audit/logging) */
    reason?: string;
}
/**
 * Session validation result
 */
export interface SessionValidationResult {
    valid: boolean;
    session?: Session;
    reason?: string;
    requiresReauth?: boolean;
    securityWarnings?: string[];
    /** Fingerprint validation result if fingerprinting is enabled */
    fingerprintValidation?: FingerprintValidationResult;
}
/**
 * Sensitive operation types that may require re-authentication
 */
export type SensitiveOperation = 'password_change' | 'email_change' | 'mfa_change' | 'api_key_create' | 'delete_account' | 'export_data' | 'admin_action' | 'high_value_transaction';
/**
 * Session manager for secure session lifecycle
 */
export declare class SessionManager {
    private store;
    private config;
    private fingerprintService;
    constructor(config?: Partial<SessionManagerConfig>);
    /**
     * Create a new session for a user
     */
    createSession(input: CreateSessionInput): Promise<Session>;
    /**
     * Validate a session and check security conditions
     */
    validateSession(sessionId: string, options?: {
        operation?: SensitiveOperation;
        ipAddress?: string;
        checkInactivity?: boolean;
        /** Request headers for fingerprint validation */
        requestHeaders?: RequestHeaders;
    }): Promise<SessionValidationResult>;
    /**
     * Revoke a specific session
     */
    revokeSession(sessionId: string, reason: string, revokedBy?: string): Promise<boolean>;
    /**
     * Revoke all sessions for a user (e.g., on password change)
     */
    revokeAllUserSessions(userId: string, reason: string, revokedBy?: string, exceptCurrentSession?: string): Promise<number>;
    /**
     * Revoke other sessions (keep current)
     */
    revokeOtherSessions(userId: string, currentSessionId: string, reason?: string): Promise<number>;
    /**
     * Regenerate a session with a new ID while preserving session data
     *
     * This is a security best practice after privilege changes (e.g., login,
     * role change, password reset) to prevent session fixation attacks.
     *
     * Steps performed:
     * 1. Gets the old session data
     * 2. Creates a new session with the same data (optionally with updates)
     * 3. Revokes the old session
     * 4. Returns the new session
     *
     * @param oldSessionId - The current session ID to regenerate
     * @param options - Options for the new session
     * @returns The new session, or null if old session doesn't exist
     */
    regenerateSession(oldSessionId: string, options?: RegenerateSessionOptions): Promise<Session | null>;
    /**
     * Compute and store fingerprint for a session
     *
     * Use this when creating sessions to enable fingerprint validation.
     *
     * @param sessionId - Session to update
     * @param headers - Request headers for fingerprint computation
     * @returns The computed fingerprint, or null if session not found
     */
    setSessionFingerprint(sessionId: string, headers: RequestHeaders): Promise<string | null>;
    /**
     * Handle password change - revoke all sessions if configured
     */
    onPasswordChange(userId: string, currentSessionId?: string): Promise<{
        revokedCount: number;
    }>;
    /**
     * Handle email change - revoke all sessions if configured
     */
    onEmailChange(userId: string, currentSessionId?: string): Promise<{
        revokedCount: number;
    }>;
    /**
     * Handle security incident - revoke all sessions immediately
     */
    onSecurityIncident(userId: string, incidentType: string, details?: string): Promise<{
        revokedCount: number;
    }>;
    /**
     * Get all active sessions for a user
     */
    getUserSessions(userId: string): Promise<Session[]>;
    /**
     * Get session count for a user
     */
    getUserSessionCount(userId: string): Promise<number>;
    /**
     * Record that user re-authenticated (for sensitive operations)
     */
    recordReauthentication(sessionId: string): Promise<boolean>;
    /**
     * Check if an operation requires re-authentication
     */
    private operationRequiresReauth;
    /**
     * Check for suspicious concurrent sessions
     */
    private checkConcurrentSessions;
}
/**
 * Get the session manager singleton
 */
export declare function getSessionManager(config?: Partial<SessionManagerConfig>): SessionManager;
/**
 * Create a new session manager instance (for testing)
 */
export declare function createSessionManager(config?: Partial<SessionManagerConfig>): SessionManager;
export type { Session, CreateSessionInput, SessionStoreConfig };
export type { RequestHeaders, FingerprintValidationResult };
export { extractFingerprintHeaders } from './fingerprint-service.js';
//# sourceMappingURL=session-manager.d.ts.map