/**
 * Service Token Management
 *
 * JWT-based service tokens with short TTL for service-to-service authentication.
 * Tokens are issued after HMAC signature verification and provide time-limited access.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
import { VorionError } from '../../common/errors.js';
/**
 * Standard JWT payload fields
 */
export interface JWTStandardClaims {
    /** Issued at (Unix timestamp) */
    iat?: number;
    /** Expiration (Unix timestamp) */
    exp?: number;
    /** JWT ID */
    jti?: string;
    /** Issuer */
    iss?: string;
    /** Audience */
    aud?: string | string[];
    /** Subject */
    sub?: string;
}
/**
 * Service token payload
 */
export interface ServiceTokenPayload extends JWTStandardClaims {
    /** Client ID */
    sub: string;
    /** Tenant ID */
    tid: string;
    /** Service name */
    svc: string;
    /** Permissions/scopes */
    permissions: string[];
    /** Token type indicator */
    type: 'service';
    /** IP address that requested the token */
    ip?: string;
}
export declare const serviceTokenPayloadSchema: z.ZodObject<{
    sub: z.ZodString;
    tid: z.ZodString;
    svc: z.ZodString;
    permissions: z.ZodArray<z.ZodString, "many">;
    type: z.ZodLiteral<"service">;
    ip: z.ZodOptional<z.ZodString>;
    iat: z.ZodOptional<z.ZodNumber>;
    exp: z.ZodOptional<z.ZodNumber>;
    jti: z.ZodOptional<z.ZodString>;
    iss: z.ZodOptional<z.ZodString>;
    aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
}, "strip", z.ZodTypeAny, {
    type?: "service";
    sub?: string;
    ip?: string;
    tid?: string;
    iat?: number;
    exp?: number;
    permissions?: string[];
    jti?: string;
    aud?: string | string[];
    iss?: string;
    svc?: string;
}, {
    type?: "service";
    sub?: string;
    ip?: string;
    tid?: string;
    iat?: number;
    exp?: number;
    permissions?: string[];
    jti?: string;
    aud?: string | string[];
    iss?: string;
    svc?: string;
}>;
/**
 * Service signature components
 */
export interface ServiceSignature {
    /** Unix timestamp when signature was created */
    timestamp: number;
    /** HTTP method */
    method: string;
    /** Request path */
    path: string;
    /** Request body hash (SHA-256 of body, empty string if no body) */
    bodyHash: string;
    /** The signature itself */
    signature: string;
}
export declare const serviceSignatureSchema: z.ZodObject<{
    timestamp: z.ZodNumber;
    method: z.ZodString;
    path: z.ZodString;
    bodyHash: z.ZodString;
    signature: z.ZodString;
}, "strip", z.ZodTypeAny, {
    path?: string;
    method?: string;
    timestamp?: number;
    signature?: string;
    bodyHash?: string;
}, {
    path?: string;
    method?: string;
    timestamp?: number;
    signature?: string;
    bodyHash?: string;
}>;
/**
 * Token verification result
 */
export interface TokenVerificationResult {
    /** Whether verification succeeded */
    valid: boolean;
    /** The decoded payload if valid */
    payload?: ServiceTokenPayload;
    /** Error reason if invalid */
    error?: string;
    /** Error code for programmatic handling */
    errorCode?: 'EXPIRED' | 'INVALID_SIGNATURE' | 'INVALID_FORMAT' | 'REVOKED' | 'INVALID_ISSUER';
}
export declare const tokenVerificationResultSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    payload: z.ZodOptional<z.ZodObject<{
        sub: z.ZodString;
        tid: z.ZodString;
        svc: z.ZodString;
        permissions: z.ZodArray<z.ZodString, "many">;
        type: z.ZodLiteral<"service">;
        ip: z.ZodOptional<z.ZodString>;
        iat: z.ZodOptional<z.ZodNumber>;
        exp: z.ZodOptional<z.ZodNumber>;
        jti: z.ZodOptional<z.ZodString>;
        iss: z.ZodOptional<z.ZodString>;
        aud: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
    }, "strip", z.ZodTypeAny, {
        type?: "service";
        sub?: string;
        ip?: string;
        tid?: string;
        iat?: number;
        exp?: number;
        permissions?: string[];
        jti?: string;
        aud?: string | string[];
        iss?: string;
        svc?: string;
    }, {
        type?: "service";
        sub?: string;
        ip?: string;
        tid?: string;
        iat?: number;
        exp?: number;
        permissions?: string[];
        jti?: string;
        aud?: string | string[];
        iss?: string;
        svc?: string;
    }>>;
    error: z.ZodOptional<z.ZodString>;
    errorCode: z.ZodOptional<z.ZodEnum<["EXPIRED", "INVALID_SIGNATURE", "INVALID_FORMAT", "REVOKED", "INVALID_ISSUER"]>>;
}, "strip", z.ZodTypeAny, {
    error?: string;
    valid?: boolean;
    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "INVALID_FORMAT" | "REVOKED" | "INVALID_ISSUER";
    payload?: {
        type?: "service";
        sub?: string;
        ip?: string;
        tid?: string;
        iat?: number;
        exp?: number;
        permissions?: string[];
        jti?: string;
        aud?: string | string[];
        iss?: string;
        svc?: string;
    };
}, {
    error?: string;
    valid?: boolean;
    errorCode?: "EXPIRED" | "INVALID_SIGNATURE" | "INVALID_FORMAT" | "REVOKED" | "INVALID_ISSUER";
    payload?: {
        type?: "service";
        sub?: string;
        ip?: string;
        tid?: string;
        iat?: number;
        exp?: number;
        permissions?: string[];
        jti?: string;
        aud?: string | string[];
        iss?: string;
        svc?: string;
    };
}>;
/**
 * Signature verification result
 */
export interface SignatureVerificationResult {
    /** Whether verification succeeded */
    valid: boolean;
    /** Client ID extracted from headers */
    clientId?: string;
    /** Error reason if invalid */
    error?: string;
    /** Error code for programmatic handling */
    errorCode?: 'EXPIRED' | 'INVALID_SIGNATURE' | 'INVALID_FORMAT' | 'CLOCK_SKEW' | 'MISSING_HEADERS';
}
/**
 * Service token error
 */
export declare class ServiceTokenError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Token expired error
 */
export declare class TokenExpiredError extends ServiceTokenError {
    code: string;
    constructor(expiredAt: Date);
}
/**
 * Invalid signature error
 */
export declare class InvalidSignatureError extends ServiceTokenError {
    code: string;
    constructor(reason: string);
}
/**
 * Signature timestamp error (clock skew)
 */
export declare class SignatureTimestampError extends ServiceTokenError {
    code: string;
    constructor(timestamp: number, currentTime: number, maxSkewSeconds: number);
}
/** Default token TTL in seconds (5 minutes) */
export declare const DEFAULT_TOKEN_TTL_SECONDS = 300;
/** Maximum allowed clock skew for signature validation (5 minutes) */
export declare const MAX_CLOCK_SKEW_SECONDS = 300;
/** Minimum token TTL in seconds */
export declare const MIN_TOKEN_TTL_SECONDS = 60;
/** Maximum token TTL in seconds (1 hour) */
export declare const MAX_TOKEN_TTL_SECONDS = 3600;
/** Service token issuer */
export declare const SERVICE_TOKEN_ISSUER = "vorion:service-auth";
/** Header names for service authentication */
export declare const SERVICE_AUTH_HEADERS: {
    readonly SERVICE_ID: "x-service-id";
    readonly SERVICE_SIGNATURE: "x-service-signature";
    readonly SERVICE_TIMESTAMP: "x-service-timestamp";
};
/**
 * Configuration for service token service
 */
export interface ServiceTokenServiceConfig {
    /** Secret key for signing tokens (32+ bytes recommended) */
    signingSecret: string;
    /** Token TTL in seconds */
    tokenTTL?: number;
    /** Token issuer */
    issuer?: string;
    /** Token audience */
    audience?: string;
    /** Maximum allowed clock skew for signatures in seconds */
    maxClockSkew?: number;
}
export declare const serviceTokenServiceConfigSchema: z.ZodObject<{
    signingSecret: z.ZodString;
    tokenTTL: z.ZodOptional<z.ZodNumber>;
    issuer: z.ZodOptional<z.ZodString>;
    audience: z.ZodOptional<z.ZodString>;
    maxClockSkew: z.ZodOptional<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    tokenTTL?: number;
    issuer?: string;
    signingSecret?: string;
    audience?: string;
    maxClockSkew?: number;
}, {
    tokenTTL?: number;
    issuer?: string;
    signingSecret?: string;
    audience?: string;
    maxClockSkew?: number;
}>;
/**
 * Service token service for creating and verifying JWT tokens
 */
export declare class ServiceTokenService {
    private readonly signingKey;
    private readonly tokenTTL;
    private readonly issuer;
    private readonly audience;
    private readonly maxClockSkew;
    constructor(config: ServiceTokenServiceConfig);
    /**
     * Create a service token
     */
    createToken(params: {
        clientId: string;
        tenantId: string;
        serviceName: string;
        permissions: string[];
        ipAddress?: string;
        customTTL?: number;
    }): Promise<string>;
    /**
     * Verify and decode a service token
     */
    verifyToken(token: string): Promise<TokenVerificationResult>;
    /**
     * Create an HMAC signature for a request
     */
    createSignature(params: {
        clientSecret: string;
        timestamp: number;
        method: string;
        path: string;
        body?: string | Buffer;
    }): string;
    /**
     * Verify a request signature
     */
    verifySignature(params: {
        clientSecret: string;
        providedSignature: string;
        timestamp: number;
        method: string;
        path: string;
        body?: string | Buffer;
    }): SignatureVerificationResult;
    /**
     * Parse service auth headers from a request
     */
    parseAuthHeaders(headers: Record<string, string | string[] | undefined>): {
        clientId: string | null;
        signature: string | null;
        timestamp: number | null;
    };
    /**
     * Get token TTL
     */
    getTokenTTL(): number;
    /**
     * Get max clock skew
     */
    getMaxClockSkew(): number;
}
/**
 * Initialize the default service token service
 */
export declare function initializeServiceTokenService(config: ServiceTokenServiceConfig): ServiceTokenService;
/**
 * Get the default service token service
 */
export declare function getServiceTokenService(): ServiceTokenService;
/**
 * Create a new service token service instance
 */
export declare function createServiceTokenService(config: ServiceTokenServiceConfig): ServiceTokenService;
/**
 * Reset the singleton (for testing)
 */
export declare function resetServiceTokenService(): void;
/**
 * Create signature headers for a request
 */
export declare function createServiceAuthHeaders(params: {
    clientId: string;
    clientSecret: string;
    method: string;
    path: string;
    body?: string | Buffer;
    tokenService?: ServiceTokenService;
}): Record<string, string>;
/**
 * Extract service ID from authorization header if present
 */
export declare function extractServiceIdFromBearer(authHeader: string | undefined): string | null;
//# sourceMappingURL=service-token.d.ts.map