/**
 * Privileged Access Management (PAM) - Just-In-Time Access
 *
 * Provides time-limited privilege elevation with:
 * - Request-based elevation workflow
 * - Multi-approver support
 * - Automatic session expiration
 * - Full audit trail
 * - Alerting integration
 * - Escalation for SLA breaches
 *
 * @packageDocumentation
 * @module security/pam/jit-access
 */
import type { Redis } from 'ioredis';
import { z } from 'zod';
import type { preHandlerHookHandler } from 'fastify';
import { SecurityAuditLogger } from '../../audit/security-logger.js';
import { SecurityAlertService } from '../alerting/service.js';
/**
 * Elevation urgency levels
 */
export declare const ElevationUrgencySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
export type ElevationUrgency = z.infer<typeof ElevationUrgencySchema>;
/**
 * Ticket status
 */
export declare const TicketStatusSchema: z.ZodEnum<["pending", "approved", "denied", "expired", "revoked"]>;
export type TicketStatus = z.infer<typeof TicketStatusSchema>;
/**
 * Elevation request schema
 */
export declare const ElevationRequestSchema: z.ZodObject<{
    userId: z.ZodString;
    resource: z.ZodString;
    permissions: z.ZodArray<z.ZodString, "many">;
    reason: z.ZodString;
    durationMinutes: z.ZodNumber;
    urgency: z.ZodEnum<["low", "medium", "high", "critical"]>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    reason?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    userId?: string;
    resource?: string;
    urgency?: "critical" | "low" | "medium" | "high";
    durationMinutes?: number;
}, {
    reason?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    userId?: string;
    resource?: string;
    urgency?: "critical" | "low" | "medium" | "high";
    durationMinutes?: number;
}>;
export type ElevationRequest = z.infer<typeof ElevationRequestSchema>;
/**
 * Approval record schema
 */
export declare const ApprovalSchema: z.ZodObject<{
    approverId: z.ZodString;
    approvedAt: z.ZodString;
    comment: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    approvedAt?: string;
    comment?: string;
    approverId?: string;
}, {
    approvedAt?: string;
    comment?: string;
    approverId?: string;
}>;
export type Approval = z.infer<typeof ApprovalSchema>;
/**
 * Elevation ticket schema
 */
export declare const ElevationTicketSchema: z.ZodObject<{
    id: z.ZodString;
    status: z.ZodEnum<["pending", "approved", "denied", "expired", "revoked"]>;
    request: z.ZodObject<{
        userId: z.ZodString;
        resource: z.ZodString;
        permissions: z.ZodArray<z.ZodString, "many">;
        reason: z.ZodString;
        durationMinutes: z.ZodNumber;
        urgency: z.ZodEnum<["low", "medium", "high", "critical"]>;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        reason?: string;
        metadata?: Record<string, unknown>;
        permissions?: string[];
        userId?: string;
        resource?: string;
        urgency?: "critical" | "low" | "medium" | "high";
        durationMinutes?: number;
    }, {
        reason?: string;
        metadata?: Record<string, unknown>;
        permissions?: string[];
        userId?: string;
        resource?: string;
        urgency?: "critical" | "low" | "medium" | "high";
        durationMinutes?: number;
    }>;
    requiredApprovers: z.ZodArray<z.ZodString, "many">;
    requiredApprovalCount: z.ZodNumber;
    currentApprovals: z.ZodArray<z.ZodObject<{
        approverId: z.ZodString;
        approvedAt: z.ZodString;
        comment: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        approvedAt?: string;
        comment?: string;
        approverId?: string;
    }, {
        approvedAt?: string;
        comment?: string;
        approverId?: string;
    }>, "many">;
    deniedBy: z.ZodOptional<z.ZodString>;
    deniedAt: z.ZodOptional<z.ZodString>;
    denialReason: z.ZodOptional<z.ZodString>;
    revokedBy: z.ZodOptional<z.ZodString>;
    revokedAt: z.ZodOptional<z.ZodString>;
    revocationReason: z.ZodOptional<z.ZodString>;
    createdAt: z.ZodString;
    expiresAt: z.ZodString;
    escalatedAt: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    status?: "pending" | "approved" | "denied" | "expired" | "revoked";
    createdAt?: string;
    request?: {
        reason?: string;
        metadata?: Record<string, unknown>;
        permissions?: string[];
        userId?: string;
        resource?: string;
        urgency?: "critical" | "low" | "medium" | "high";
        durationMinutes?: number;
    };
    expiresAt?: string;
    denialReason?: string;
    revokedAt?: string;
    revokedBy?: string;
    revocationReason?: string;
    deniedBy?: string;
    requiredApprovers?: string[];
    requiredApprovalCount?: number;
    currentApprovals?: {
        approvedAt?: string;
        comment?: string;
        approverId?: string;
    }[];
    deniedAt?: string;
    escalatedAt?: string;
}, {
    id?: string;
    status?: "pending" | "approved" | "denied" | "expired" | "revoked";
    createdAt?: string;
    request?: {
        reason?: string;
        metadata?: Record<string, unknown>;
        permissions?: string[];
        userId?: string;
        resource?: string;
        urgency?: "critical" | "low" | "medium" | "high";
        durationMinutes?: number;
    };
    expiresAt?: string;
    denialReason?: string;
    revokedAt?: string;
    revokedBy?: string;
    revocationReason?: string;
    deniedBy?: string;
    requiredApprovers?: string[];
    requiredApprovalCount?: number;
    currentApprovals?: {
        approvedAt?: string;
        comment?: string;
        approverId?: string;
    }[];
    deniedAt?: string;
    escalatedAt?: string;
}>;
export type ElevationTicket = z.infer<typeof ElevationTicketSchema>;
/**
 * Elevated session schema
 */
export declare const ElevatedSessionSchema: z.ZodObject<{
    id: z.ZodString;
    ticketId: z.ZodString;
    userId: z.ZodString;
    grantedPermissions: z.ZodArray<z.ZodString, "many">;
    resource: z.ZodString;
    startedAt: z.ZodString;
    expiresAt: z.ZodString;
    lastActivityAt: z.ZodString;
    revokedAt: z.ZodOptional<z.ZodString>;
    revokedBy: z.ZodOptional<z.ZodString>;
    revocationReason: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    userId?: string;
    expiresAt?: string;
    revokedAt?: string;
    resource?: string;
    lastActivityAt?: string;
    startedAt?: string;
    revokedBy?: string;
    revocationReason?: string;
    grantedPermissions?: string[];
    ticketId?: string;
}, {
    id?: string;
    userId?: string;
    expiresAt?: string;
    revokedAt?: string;
    resource?: string;
    lastActivityAt?: string;
    startedAt?: string;
    revokedBy?: string;
    revocationReason?: string;
    grantedPermissions?: string[];
    ticketId?: string;
}>;
export type ElevatedSession = z.infer<typeof ElevatedSessionSchema>;
/**
 * Audit action schema
 */
export declare const AuditActionSchema: z.ZodEnum<["request_created", "approval_granted", "approval_denied", "session_started", "session_activity", "session_expired", "session_revoked", "ticket_expired", "ticket_escalated"]>;
export type AuditAction = z.infer<typeof AuditActionSchema>;
/**
 * PAM audit entry schema
 */
export declare const PAMAuditEntrySchema: z.ZodObject<{
    id: z.ZodString;
    timestamp: z.ZodString;
    action: z.ZodEnum<["request_created", "approval_granted", "approval_denied", "session_started", "session_activity", "session_expired", "session_revoked", "ticket_expired", "ticket_escalated"]>;
    ticketId: z.ZodOptional<z.ZodString>;
    sessionId: z.ZodOptional<z.ZodString>;
    userId: z.ZodString;
    actorId: z.ZodString;
    resource: z.ZodString;
    details: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    action?: "request_created" | "approval_granted" | "approval_denied" | "session_started" | "session_activity" | "session_expired" | "session_revoked" | "ticket_expired" | "ticket_escalated";
    details?: Record<string, unknown>;
    id?: string;
    userId?: string;
    sessionId?: string;
    actorId?: string;
    timestamp?: string;
    resource?: string;
    ticketId?: string;
}, {
    action?: "request_created" | "approval_granted" | "approval_denied" | "session_started" | "session_activity" | "session_expired" | "session_revoked" | "ticket_expired" | "ticket_escalated";
    details?: Record<string, unknown>;
    id?: string;
    userId?: string;
    sessionId?: string;
    actorId?: string;
    timestamp?: string;
    resource?: string;
    ticketId?: string;
}>;
export type PAMAuditEntry = z.infer<typeof PAMAuditEntrySchema>;
/**
 * JIT Access service configuration
 */
export interface JITAccessConfig {
    /** Redis key prefix override */
    keyPrefix?: string;
    /** Default required approval count */
    defaultApprovalCount?: number;
    /** SLA overrides by urgency (minutes) */
    approvalSLAMinutes?: Partial<Record<ElevationUrgency, number>>;
    /** Enable auto-escalation on SLA breach */
    enableEscalation?: boolean;
    /** Escalation check interval in milliseconds */
    escalationCheckIntervalMs?: number;
    /** Function to determine required approvers for a request */
    getApprovers?: (request: ElevationRequest) => Promise<{
        approvers: string[];
        requiredCount: number;
    }>;
    /** Function to notify approvers of new requests */
    notifyApprovers?: (ticket: ElevationTicket, approvers: string[]) => Promise<void>;
}
/**
 * Service dependencies
 */
export interface JITAccessDependencies {
    redis?: Redis;
    securityLogger?: SecurityAuditLogger;
    alertService?: SecurityAlertService;
}
/**
 * Just-In-Time Access Service
 *
 * Manages temporary privilege elevation with full approval workflow,
 * session management, and audit trail.
 */
export declare class JITAccessService {
    private readonly redis;
    private readonly securityLogger;
    private readonly alertService;
    private readonly config;
    private escalationCheckInterval;
    private sessionExpirationTimers;
    constructor(config?: JITAccessConfig, deps?: JITAccessDependencies);
    /**
     * Request temporary privilege elevation
     *
     * Creates a new elevation ticket that requires approval before
     * privileges are granted.
     *
     * @param request - Elevation request details
     * @returns Created elevation ticket
     */
    requestElevation(request: ElevationRequest): Promise<ElevationTicket>;
    /**
     * Approve an elevation request
     *
     * Adds an approval to the ticket. If sufficient approvals are reached,
     * creates an elevated session.
     *
     * @param ticketId - Ticket to approve
     * @param approverId - ID of the approving user
     * @param comment - Optional approval comment
     * @returns Created elevated session if approval threshold met
     */
    approveElevation(ticketId: string, approverId: string, comment?: string): Promise<ElevatedSession>;
    /**
     * Deny an elevation request
     *
     * @param ticketId - Ticket to deny
     * @param approverId - ID of the denying user
     * @param reason - Reason for denial
     */
    denyElevation(ticketId: string, approverId: string, reason: string): Promise<void>;
    /**
     * Revoke an active elevation session
     *
     * @param sessionId - Session to revoke
     * @param reason - Reason for revocation
     * @param revokedBy - ID of the revoking user (default: 'system')
     */
    revokeElevation(sessionId: string, reason: string, revokedBy?: string): Promise<void>;
    /**
     * Get all active elevation sessions for a user
     *
     * @param userId - User ID to query
     * @returns Array of active elevated sessions
     */
    getActiveElevations(userId: string): Promise<ElevatedSession[]>;
    /**
     * Check if a user has elevation for a specific resource
     *
     * @param userId - User ID to check
     * @param resource - Resource to check access for
     * @param permission - Optional specific permission to check
     * @returns True if user has active elevation
     */
    checkElevation(userId: string, resource: string, permission?: string): Promise<boolean>;
    /**
     * Get pending tickets for a user
     *
     * @param userId - User ID to query
     * @returns Array of pending tickets
     */
    getPendingTickets(userId: string): Promise<ElevationTicket[]>;
    /**
     * Get tickets pending approval for an approver
     *
     * @param approverId - Approver user ID
     * @returns Array of tickets awaiting approval
     */
    getTicketsForApproval(approverId: string): Promise<ElevationTicket[]>;
    /**
     * Get a specific ticket by ID
     */
    getTicket(ticketId: string): Promise<ElevationTicket | null>;
    /**
     * Get a specific session by ID
     */
    getSession(sessionId: string): Promise<ElevatedSession | null>;
    /**
     * Create middleware to check elevation for a resource
     *
     * @param resource - Resource identifier
     * @param permissions - Required permissions
     * @returns Fastify preHandler hook
     */
    requireElevation(resource: string, permissions: string[]): preHandlerHookHandler;
    /**
     * Stop the service and clean up resources
     */
    stop(): Promise<void>;
    /**
     * Store ticket in Redis
     */
    private storeTicket;
    /**
     * Store session in Redis
     */
    private storeSession;
    /**
     * Create an elevated session from an approved ticket
     */
    private createElevatedSession;
    /**
     * Set timer to handle session expiration
     */
    private setSessionExpirationTimer;
    /**
     * Cancel session expiration timer
     */
    private cancelSessionTimer;
    /**
     * Handle session expiration
     */
    private handleSessionExpiration;
    /**
     * Update session last activity timestamp
     */
    private updateSessionActivity;
    /**
     * Start periodic escalation check
     */
    private startEscalationCheck;
    /**
     * Check for tickets that need escalation
     */
    private checkForEscalations;
    /**
     * Escalate a ticket that has breached SLA
     */
    private escalateTicket;
    /**
     * Create a PAM audit entry
     */
    private createAuditEntry;
    /**
     * Build security actor from user ID
     */
    private buildActor;
    /**
     * Build security resource from resource string
     */
    private buildResource;
    /**
     * Get alert severity for elevation urgency
     */
    private getSeverityForUrgency;
}
/**
 * Error codes for elevation operations
 */
export type ElevationErrorCode = 'TICKET_NOT_FOUND' | 'SESSION_NOT_FOUND' | 'INVALID_TICKET_STATUS' | 'UNAUTHORIZED_APPROVER' | 'ALREADY_APPROVED' | 'SESSION_ALREADY_REVOKED' | 'PENDING_APPROVALS' | 'VALIDATION_ERROR';
/**
 * Custom error for elevation operations
 */
export declare class ElevationError extends Error {
    readonly code: ElevationErrorCode;
    constructor(code: ElevationErrorCode, message: string);
}
/**
 * Get the singleton JITAccessService instance
 */
export declare function getJITAccessService(config?: JITAccessConfig, deps?: JITAccessDependencies): JITAccessService;
/**
 * Create a new JITAccessService instance
 */
export declare function createJITAccessService(config?: JITAccessConfig, deps?: JITAccessDependencies): JITAccessService;
/**
 * Reset the singleton instance (for testing)
 */
export declare function resetJITAccessService(): Promise<void>;
//# sourceMappingURL=jit-access.d.ts.map