/**
 * Password Policy Engine for Vorion Platform
 *
 * Provides comprehensive password validation, strength calculation,
 * and policy enforcement with support for multi-tenant configurations.
 *
 * @module security/password-policy
 */
/**
 * Password policy configuration interface
 */
export interface PasswordPolicy {
    /** Minimum password length (default: 12) */
    minLength: number;
    /** Maximum password length (default: 128) */
    maxLength: number;
    /** Require at least one uppercase letter (default: true) */
    requireUppercase: boolean;
    /** Require at least one lowercase letter (default: true) */
    requireLowercase: boolean;
    /** Require at least one number (default: true) */
    requireNumbers: boolean;
    /** Require at least one special character (default: true) */
    requireSpecialChars: boolean;
    /** Allowed special characters (default: '!@#$%^&*()_+-=[]{}|;:,.<>?') */
    specialChars: string;
    /** Prevent common passwords from being used (default: true) */
    preventCommonPasswords: boolean;
    /** Prevent passwords containing user info like email, username, name (default: true) */
    preventUserInfo: boolean;
    /** Number of previous passwords to check for reuse (default: 12) */
    preventReuse: number;
    /** Maximum password age in days, 0 = never expires (default: 0) */
    maxAge: number;
    /** Minimum password age in days before it can be changed (default: 0) */
    minAge: number;
}
/**
 * Default password policy with strong security settings
 */
export declare const DEFAULT_PASSWORD_POLICY: PasswordPolicy;
/**
 * NIST 800-63B compliant password policy
 *
 * Based on NIST Digital Identity Guidelines (SP 800-63B):
 * - Minimum 8 characters
 * - No composition rules (uppercase, numbers, special chars)
 * - Block common/compromised passwords
 * - No periodic password expiration
 * - Allow all printable characters
 *
 * @see https://pages.nist.gov/800-63-3/sp800-63b.html
 */
export declare const NIST_PASSWORD_POLICY: PasswordPolicy;
/**
 * Result of password validation
 */
export interface PasswordValidationResult {
    /** Whether the password meets all policy requirements */
    valid: boolean;
    /** Password strength score from 0-100 */
    score: number;
    /** List of policy violations that must be fixed */
    errors: string[];
    /** Non-blocking warnings about the password */
    warnings: string[];
    /** Suggestions for improving the password */
    suggestions: string[];
}
/**
 * User information for context-aware validation
 */
export interface UserInfo {
    /** User's email address */
    email?: string;
    /** User's username */
    username?: string;
    /** User's full name or display name */
    name?: string;
}
/**
 * Password Policy Engine
 *
 * Provides comprehensive password validation and policy enforcement
 * with support for multi-tenant configurations.
 */
export declare class PasswordPolicyEngine {
    private tenantPolicies;
    private defaultPolicy;
    /**
     * Creates a new PasswordPolicyEngine instance
     * @param defaultPolicy - The default policy to use when no tenant-specific policy exists
     */
    constructor(defaultPolicy?: PasswordPolicy);
    /**
     * Validates a password against the configured policy
     *
     * @param password - The password to validate
     * @param userInfo - Optional user information for context-aware validation
     * @param tenantId - Optional tenant ID for multi-tenant policy lookup
     * @returns Validation result with errors, warnings, and suggestions
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     * const result = engine.validate('MyP@ssw0rd!', {
     *   email: 'user@example.com',
     *   username: 'johndoe'
     * });
     *
     * if (!result.valid) {
     *   console.error('Password validation failed:', result.errors);
     * }
     * ```
     */
    validate(password: string, userInfo?: UserInfo, tenantId?: string): PasswordValidationResult;
    /**
     * Calculates password strength score from 0-100
     *
     * Uses the zxcvbn library for realistic password strength estimation,
     * with additional scoring for length and character diversity.
     *
     * @param password - The password to evaluate
     * @returns Strength score from 0 (weakest) to 100 (strongest)
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     * const strength = engine.calculateStrength('MyP@ssw0rd!');
     * console.log(`Password strength: ${strength}/100`);
     * ```
     */
    calculateStrength(password: string): number;
    /**
     * Checks if a password is in the common passwords list
     *
     * @param password - The password to check
     * @returns True if the password is common, false otherwise
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     * if (engine.isCommonPassword('password123')) {
     *   console.warn('This password is too common!');
     * }
     * ```
     */
    isCommonPassword(password: string): boolean;
    /**
     * Checks if a password has been used previously
     *
     * Compares the password against a list of hashed previous passwords
     * using timing-safe comparison to prevent timing attacks.
     *
     * @param userId - The user's ID (for logging purposes)
     * @param password - The password to check
     * @param hashedHistory - Array of previously hashed passwords
     * @returns Promise resolving to true if password was previously used
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     * const wasUsed = await engine.checkPasswordHistory(
     *   'user-123',
     *   'newPassword',
     *   user.passwordHistory
     * );
     *
     * if (wasUsed) {
     *   throw new Error('Password was recently used');
     * }
     * ```
     */
    checkPasswordHistory(userId: string, password: string, hashedHistory: string[]): Promise<boolean>;
    /**
     * Creates a hash of the password for storage in password history
     *
     * Uses SHA-256 with a static salt for consistent comparison.
     * Note: This is NOT for password storage authentication - use bcrypt/argon2 for that.
     * This is only for checking password reuse in history.
     *
     * @param password - The password to hash
     * @returns Hex-encoded hash string
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     * const hash = engine.hashForHistory('userPassword');
     * // Store hash in user's password history
     * ```
     */
    hashForHistory(password: string): string;
    /**
     * Gets the password policy for a tenant
     *
     * @param tenantId - Optional tenant ID, returns default policy if not specified
     * @returns The applicable password policy
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     *
     * // Get default policy
     * const defaultPolicy = engine.getPolicy();
     *
     * // Get tenant-specific policy
     * const tenantPolicy = engine.getPolicy('tenant-123');
     * ```
     */
    getPolicy(tenantId?: string): PasswordPolicy;
    /**
     * Sets a custom password policy for a tenant
     *
     * @param tenantId - The tenant ID to configure
     * @param policy - Partial policy to merge with defaults
     *
     * @example
     * ```typescript
     * const engine = getPasswordPolicyEngine();
     *
     * // Set a stricter policy for a specific tenant
     * engine.setPolicy('enterprise-tenant', {
     *   minLength: 16,
     *   preventReuse: 24,
     *   maxAge: 90,
     * });
     * ```
     */
    setPolicy(tenantId: string, policy: Partial<PasswordPolicy>): void;
    /**
     * Removes a tenant-specific policy, reverting to defaults
     *
     * @param tenantId - The tenant ID to remove the policy for
     */
    removePolicy(tenantId: string): void;
    /**
     * Updates the default password policy
     *
     * @param policy - Partial policy to merge with current defaults
     */
    setDefaultPolicy(policy: Partial<PasswordPolicy>): void;
    /**
     * Validates policy configuration for consistency
     * @param policy - The policy to validate
     * @throws Error if policy configuration is invalid
     */
    private validatePolicyConfig;
    /**
     * Checks if password contains user information
     * @param password - The password to check
     * @param userInfo - User information to check against
     * @returns Array of error messages for violations
     */
    private checkUserInfo;
    /**
     * Checks for sequential character patterns
     * @param password - The password to check
     * @returns True if sequential pattern found
     */
    private hasSequentialPattern;
    /**
     * Checks for repeating character patterns
     * @param password - The password to check
     * @returns True if repeating pattern found
     */
    private hasRepeatingPattern;
}
/**
 * Gets the singleton PasswordPolicyEngine instance
 *
 * @param defaultPolicy - Optional custom default policy (only used on first call)
 * @returns The PasswordPolicyEngine singleton instance
 *
 * @example
 * ```typescript
 * import { getPasswordPolicyEngine, NIST_PASSWORD_POLICY } from './password-policy.js';
 *
 * // Get engine with default policy
 * const engine = getPasswordPolicyEngine();
 *
 * // Or initialize with NIST policy (first call only)
 * const nistEngine = getPasswordPolicyEngine(NIST_PASSWORD_POLICY);
 *
 * // Validate a password
 * const result = engine.validate('MySecureP@ssw0rd!', {
 *   email: 'user@example.com',
 *   username: 'johndoe',
 *   name: 'John Doe'
 * });
 *
 * if (result.valid) {
 *   console.log('Password is valid with strength:', result.score);
 * } else {
 *   console.error('Validation errors:', result.errors);
 * }
 * ```
 */
export declare function getPasswordPolicyEngine(defaultPolicy?: PasswordPolicy): PasswordPolicyEngine;
/**
 * Resets the singleton instance (primarily for testing)
 */
export declare function resetPasswordPolicyEngine(): void;
export default PasswordPolicyEngine;
//# sourceMappingURL=password-policy.d.ts.map