/**
 * GDPR Rate Limiter
 *
 * Provides distributed rate limiting and request deduplication for GDPR operations.
 * Prevents abuse of resource-intensive export/erasure operations while ensuring
 * legitimate requests can proceed.
 *
 * Features:
 * - Per-user rate limiting for export (3/hour) and erasure (1/24h)
 * - Request deduplication to prevent concurrent duplicate jobs
 * - Tenant-level job queue depth limits
 * - Atomic Redis operations for distributed safety
 *
 * @packageDocumentation
 */
import type { Redis } from 'ioredis';
/**
 * Rate limit check result
 */
export interface RateLimitResult {
    /** Whether the request is allowed */
    allowed: boolean;
    /** Seconds until rate limit resets (if not allowed) */
    retryAfter?: number;
    /** Current count in the window */
    currentCount?: number;
    /** Maximum allowed in the window */
    limit?: number;
}
/**
 * Job queue depth check result
 */
export interface QueueDepthResult {
    /** Whether a new job can be added */
    allowed: boolean;
    /** Current pending job count */
    currentDepth: number;
    /** Maximum allowed depth */
    maxDepth: number;
    /** Seconds to retry after (if not allowed) */
    retryAfter?: number;
}
/**
 * Pending job info
 */
export interface PendingJobInfo {
    /** Job ID */
    jobId: string;
    /** When the job was created */
    createdAt: string;
    /** Job status */
    status: 'pending' | 'processing';
}
/**
 * GDPR Rate Limiter interface
 */
export interface GdprRateLimiter {
    /**
     * Check if an export request is allowed for this user
     */
    checkExportLimit(userId: string, tenantId: string): Promise<RateLimitResult>;
    /**
     * Check if an erasure request is allowed for this user
     */
    checkErasureLimit(userId: string, tenantId: string): Promise<RateLimitResult>;
    /**
     * Get pending job for a user (if any)
     */
    getPendingJob(userId: string, type: 'export' | 'erasure'): Promise<string | null>;
    /**
     * Record a new GDPR request
     */
    recordRequest(userId: string, type: 'export' | 'erasure', jobId: string): Promise<void>;
    /**
     * Check tenant job queue depth
     */
    checkQueueDepth(tenantId: string): Promise<QueueDepthResult>;
    /**
     * Mark a job as completed (removes from pending)
     */
    completeJob(userId: string, type: 'export' | 'erasure', jobId: string, tenantId: string): Promise<void>;
    /**
     * Mark a job as failed (removes from pending)
     */
    failJob(userId: string, type: 'export' | 'erasure', jobId: string, tenantId: string): Promise<void>;
}
/**
 * Rate limit configuration
 */
export interface GdprRateLimiterConfig {
    /** Maximum export requests per hour per user */
    exportMaxPerHour: number;
    /** Maximum erasure requests per 24 hours per user */
    erasureMaxPerDay: number;
    /** Maximum pending GDPR jobs per tenant */
    maxPendingJobsPerTenant: number;
    /** TTL for pending job markers (seconds) */
    pendingJobTtlSeconds: number;
    /** Redis key prefix */
    keyPrefix: string;
}
/**
 * Redis-backed GDPR rate limiter implementation
 */
export declare class RedisGdprRateLimiter implements GdprRateLimiter {
    private redis;
    private config;
    private rateLimitScriptSha;
    private pendingJobScriptSha;
    private queueDepthScriptSha;
    private initialized;
    constructor(redis?: Redis, config?: Partial<GdprRateLimiterConfig>);
    /**
     * Initialize Lua scripts
     */
    private ensureInitialized;
    /**
     * Generate Redis key for rate limiting
     */
    private getRateLimitKey;
    /**
     * Generate Redis key for pending job
     */
    private getPendingJobKey;
    /**
     * Generate Redis key for tenant queue depth
     */
    private getQueueDepthKey;
    /**
     * Check export rate limit
     */
    checkExportLimit(userId: string, tenantId: string): Promise<RateLimitResult>;
    /**
     * Check erasure rate limit
     */
    checkErasureLimit(userId: string, tenantId: string): Promise<RateLimitResult>;
    /**
     * Get pending job for user
     */
    getPendingJob(userId: string, type: 'export' | 'erasure'): Promise<string | null>;
    /**
     * Record a new GDPR request with deduplication
     */
    recordRequest(userId: string, type: 'export' | 'erasure', jobId: string): Promise<void>;
    /**
     * Check tenant queue depth
     */
    checkQueueDepth(tenantId: string): Promise<QueueDepthResult>;
    /**
     * Mark job as completed
     */
    completeJob(userId: string, type: 'export' | 'erasure', jobId: string, tenantId: string): Promise<void>;
    /**
     * Mark job as failed
     */
    failJob(userId: string, type: 'export' | 'erasure', jobId: string, tenantId: string): Promise<void>;
}
/**
 * Get or create the global GDPR rate limiter
 */
export declare function getGdprRateLimiter(redis?: Redis, config?: Partial<GdprRateLimiterConfig>): GdprRateLimiter;
/**
 * Create a new GDPR rate limiter instance
 */
export declare function createGdprRateLimiter(redis?: Redis, config?: Partial<GdprRateLimiterConfig>): GdprRateLimiter;
/**
 * Reset the global rate limiter (for testing)
 */
export declare function resetGdprRateLimiter(): void;
//# sourceMappingURL=gdpr-rate-limiter.d.ts.map