/**
 * MFA (Multi-Factor Authentication) Types
 *
 * Type definitions for the MFA system including TOTP authentication,
 * backup codes, and challenge/verification flows.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
/**
 * MFA methods supported by the system
 */
export declare const MfaMethod: {
    readonly TOTP: "totp";
    readonly BACKUP_CODES: "backup_codes";
};
export type MfaMethod = (typeof MfaMethod)[keyof typeof MfaMethod];
export declare const mfaMethodSchema: z.ZodEnum<["totp", "backup_codes"]>;
/**
 * MFA enrollment and activation status
 */
export declare const MfaStatus: {
    readonly PENDING: "pending";
    readonly ACTIVE: "active";
    readonly DISABLED: "disabled";
};
export type MfaStatus = (typeof MfaStatus)[keyof typeof MfaStatus];
export declare const mfaStatusSchema: z.ZodEnum<["pending", "active", "disabled"]>;
/**
 * Default configuration values
 */
export declare const MFA_DEFAULTS: {
    /** Number of backup codes to generate */
    readonly BACKUP_CODE_COUNT: 10;
    /** Enrollment session expiry in milliseconds (15 minutes) */
    readonly ENROLLMENT_EXPIRY_MS: number;
    /** Challenge expiry in milliseconds (5 minutes) */
    readonly CHALLENGE_EXPIRY_MS: number;
    /** Maximum verification attempts before lockout */
    readonly MAX_ATTEMPTS: 5;
    /** Grace period after enabling MFA in milliseconds (24 hours) */
    readonly GRACE_PERIOD_MS: number;
};
/**
 * User MFA settings stored in the database
 */
export interface UserMfaRecord {
    id: string;
    userId: string;
    tenantId: string;
    totpSecret: string | null;
    totpSecretEncrypted: boolean;
    status: MfaStatus;
    enabledAt: Date | null;
    enrollmentStartedAt: Date | null;
    enrollmentExpiresAt: Date | null;
    gracePeriodEndsAt: Date | null;
    createdAt: Date;
    updatedAt: Date;
}
/**
 * Backup code stored in the database
 */
export interface MfaBackupCodeRecord {
    id: string;
    userMfaId: string;
    codeHash: string;
    usedAt: Date | null;
    usedFromIp: string | null;
    createdAt: Date;
}
/**
 * MFA challenge stored in the database
 */
export interface MfaChallengeRecord {
    id: string;
    userId: string;
    sessionId: string;
    challengeToken: string;
    verified: boolean;
    verifiedAt: Date | null;
    attempts: number;
    maxAttempts: number;
    expiresAt: Date;
    createdAt: Date;
}
/**
 * Input for creating a new user MFA record
 */
export interface CreateUserMfaInput {
    userId: string;
    tenantId: string;
    totpSecret: string;
    totpSecretEncrypted?: boolean;
}
export declare const createUserMfaInputSchema: z.ZodObject<{
    userId: z.ZodString;
    tenantId: z.ZodString;
    totpSecret: z.ZodString;
    totpSecretEncrypted: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
}, "strip", z.ZodTypeAny, {
    userId?: string;
    tenantId?: string;
    totpSecret?: string;
    totpSecretEncrypted?: boolean;
}, {
    userId?: string;
    tenantId?: string;
    totpSecret?: string;
    totpSecretEncrypted?: boolean;
}>;
/**
 * Input for creating a backup code
 */
export interface CreateBackupCodeInput {
    userMfaId: string;
    codeHash: string;
}
/**
 * Input for creating an MFA challenge
 */
export interface CreateChallengeInput {
    userId: string;
    sessionId: string;
    expiresAt: Date;
    maxAttempts?: number;
}
export declare const createChallengeInputSchema: z.ZodObject<{
    userId: z.ZodString;
    sessionId: z.ZodString;
    expiresAt: z.ZodDate;
    maxAttempts: z.ZodOptional<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    userId?: string;
    expiresAt?: Date;
    sessionId?: string;
    maxAttempts?: number;
}, {
    userId?: string;
    expiresAt?: Date;
    sessionId?: string;
    maxAttempts?: number;
}>;
/**
 * Enrollment initiation response
 */
export interface MfaEnrollmentResponse {
    /** Base32-encoded TOTP secret */
    secret: string;
    /** OTPAuth URL for QR code generation */
    otpauthUrl: string;
    /** QR code as data URL (base64 PNG) */
    qrCode: string;
    /** When the enrollment session expires */
    expiresAt: string;
}
export declare const mfaEnrollmentResponseSchema: z.ZodObject<{
    secret: z.ZodString;
    otpauthUrl: z.ZodString;
    qrCode: z.ZodString;
    expiresAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    expiresAt?: string;
    secret?: string;
    otpauthUrl?: string;
    qrCode?: string;
}, {
    expiresAt?: string;
    secret?: string;
    otpauthUrl?: string;
    qrCode?: string;
}>;
/**
 * Enrollment completion response
 */
export interface MfaEnrollmentCompleteResponse {
    /** Backup codes (shown only once) */
    backupCodes: string[];
    /** Number of backup codes */
    backupCodeCount: number;
    /** When MFA was enabled */
    enabledAt: string;
    /** End of grace period (MFA not required until then) */
    gracePeriodEndsAt: string;
}
export declare const mfaEnrollmentCompleteResponseSchema: z.ZodObject<{
    backupCodes: z.ZodArray<z.ZodString, "many">;
    backupCodeCount: z.ZodNumber;
    enabledAt: z.ZodString;
    gracePeriodEndsAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    backupCodeCount?: number;
    backupCodes?: string[];
    enabledAt?: string;
    gracePeriodEndsAt?: string;
}, {
    backupCodeCount?: number;
    backupCodes?: string[];
    enabledAt?: string;
    gracePeriodEndsAt?: string;
}>;
/**
 * MFA status response
 */
export interface MfaStatusResponse {
    /** Whether MFA is enabled and active */
    enabled: boolean;
    /** Current MFA status */
    status: MfaStatus;
    /** When MFA was enabled */
    enabledAt: string | null;
    /** Whether user is in enrollment process */
    enrollmentPending: boolean;
    /** Number of unused backup codes remaining */
    backupCodesRemaining: number;
    /** Whether user is in grace period */
    inGracePeriod: boolean;
    /** When grace period ends (if applicable) */
    gracePeriodEndsAt: string | null;
}
export declare const mfaStatusResponseSchema: z.ZodObject<{
    enabled: z.ZodBoolean;
    status: z.ZodEnum<["pending", "active", "disabled"]>;
    enabledAt: z.ZodNullable<z.ZodString>;
    enrollmentPending: z.ZodBoolean;
    backupCodesRemaining: z.ZodNumber;
    inGracePeriod: z.ZodBoolean;
    gracePeriodEndsAt: z.ZodNullable<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    status?: "pending" | "active" | "disabled";
    enabled?: boolean;
    enabledAt?: string;
    gracePeriodEndsAt?: string;
    enrollmentPending?: boolean;
    backupCodesRemaining?: number;
    inGracePeriod?: boolean;
}, {
    status?: "pending" | "active" | "disabled";
    enabled?: boolean;
    enabledAt?: string;
    gracePeriodEndsAt?: string;
    enrollmentPending?: boolean;
    backupCodesRemaining?: number;
    inGracePeriod?: boolean;
}>;
/**
 * MFA challenge response
 */
export interface MfaChallengeResponse {
    /** Unique challenge token */
    challengeToken: string;
    /** When the challenge expires */
    expiresAt: string;
    /** Remaining verification attempts */
    attemptsRemaining: number;
}
export declare const mfaChallengeResponseSchema: z.ZodObject<{
    challengeToken: z.ZodString;
    expiresAt: z.ZodString;
    attemptsRemaining: z.ZodNumber;
}, "strip", z.ZodTypeAny, {
    expiresAt?: string;
    attemptsRemaining?: number;
    challengeToken?: string;
}, {
    expiresAt?: string;
    attemptsRemaining?: number;
    challengeToken?: string;
}>;
/**
 * Challenge verification response
 */
export interface MfaVerifyResponse {
    /** Whether verification succeeded */
    verified: boolean;
    /** Method used for verification */
    method: MfaMethod | null;
    /** Remaining attempts (if not verified) */
    attemptsRemaining?: number;
    /** Error message (if not verified) */
    error?: string;
}
export declare const mfaVerifyResponseSchema: z.ZodObject<{
    verified: z.ZodBoolean;
    method: z.ZodNullable<z.ZodEnum<["totp", "backup_codes"]>>;
    attemptsRemaining: z.ZodOptional<z.ZodNumber>;
    error: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    verified?: boolean;
    error?: string;
    method?: "totp" | "backup_codes";
    attemptsRemaining?: number;
}, {
    verified?: boolean;
    error?: string;
    method?: "totp" | "backup_codes";
    attemptsRemaining?: number;
}>;
/**
 * Backup codes regeneration response
 */
export interface MfaBackupCodesResponse {
    /** New backup codes (shown only once) */
    backupCodes: string[];
    /** Number of backup codes */
    backupCodeCount: number;
    /** When codes were generated */
    generatedAt: string;
}
export declare const mfaBackupCodesResponseSchema: z.ZodObject<{
    backupCodes: z.ZodArray<z.ZodString, "many">;
    backupCodeCount: z.ZodNumber;
    generatedAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    backupCodeCount?: number;
    generatedAt?: string;
    backupCodes?: string[];
}, {
    backupCodeCount?: number;
    generatedAt?: string;
    backupCodes?: string[];
}>;
/**
 * Enrollment verification request
 */
export declare const mfaEnrollVerifyRequestSchema: z.ZodObject<{
    code: z.ZodString;
}, "strip", z.ZodTypeAny, {
    code?: string;
}, {
    code?: string;
}>;
export type MfaEnrollVerifyRequest = z.infer<typeof mfaEnrollVerifyRequestSchema>;
/**
 * Challenge verification request
 */
export declare const mfaChallengeVerifyRequestSchema: z.ZodObject<{
    challengeToken: z.ZodString;
    code: z.ZodString;
}, "strip", z.ZodTypeAny, {
    code?: string;
    challengeToken?: string;
}, {
    code?: string;
    challengeToken?: string;
}>;
export type MfaChallengeVerifyRequest = z.infer<typeof mfaChallengeVerifyRequestSchema>;
/**
 * MFA service configuration
 */
export interface MfaServiceConfig {
    /** TOTP issuer name (displayed in authenticator apps) */
    issuer: string;
    /** Number of backup codes to generate */
    backupCodeCount: number;
    /** Enrollment session expiry in milliseconds */
    enrollmentExpiryMs: number;
    /** Challenge expiry in milliseconds */
    challengeExpiryMs: number;
    /** Maximum verification attempts */
    maxAttempts: number;
    /** Grace period after enabling MFA in milliseconds */
    gracePeriodMs: number;
    /** Whether to encrypt TOTP secrets */
    encryptSecrets: boolean;
}
export declare const mfaServiceConfigSchema: z.ZodObject<{
    issuer: z.ZodDefault<z.ZodString>;
    backupCodeCount: z.ZodDefault<z.ZodNumber>;
    enrollmentExpiryMs: z.ZodDefault<z.ZodNumber>;
    challengeExpiryMs: z.ZodDefault<z.ZodNumber>;
    maxAttempts: z.ZodDefault<z.ZodNumber>;
    gracePeriodMs: z.ZodDefault<z.ZodNumber>;
    encryptSecrets: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    issuer?: string;
    backupCodeCount?: number;
    maxAttempts?: number;
    gracePeriodMs?: number;
    enrollmentExpiryMs?: number;
    challengeExpiryMs?: number;
    encryptSecrets?: boolean;
}, {
    issuer?: string;
    backupCodeCount?: number;
    maxAttempts?: number;
    gracePeriodMs?: number;
    enrollmentExpiryMs?: number;
    challengeExpiryMs?: number;
    encryptSecrets?: boolean;
}>;
/**
 * Options for MFA middleware
 */
export interface MfaMiddlewareOptions {
    /** Skip MFA check during grace period */
    allowGracePeriod?: boolean;
    /** Skip MFA for specific paths */
    skipPaths?: string[];
    /** Function to extract user ID from request */
    extractUserId?: (request: unknown) => string | undefined;
    /** Function to extract tenant ID from request */
    extractTenantId?: (request: unknown) => string | undefined;
    /** Function to extract session ID from request */
    extractSessionId?: (request: unknown) => string | undefined;
}
export declare const mfaMiddlewareOptionsSchema: z.ZodObject<{
    allowGracePeriod: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
    skipPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    skipPaths?: string[];
    allowGracePeriod?: boolean;
}, {
    skipPaths?: string[];
    allowGracePeriod?: boolean;
}>;
//# sourceMappingURL=types.d.ts.map