/**
 * Token Revocation Check Middleware
 *
 * Provides efficient token revocation checking using a two-tier approach:
 * 1. Bloom filter for fast negative lookups (not revoked)
 * 2. Redis fallback for bloom filter hits (possible false positives)
 *
 * The bloom filter provides O(1) lookup time and eliminates Redis roundtrips
 * for the majority of tokens (which are not revoked). On bloom filter hits,
 * we fall back to Redis for authoritative revocation status.
 *
 * Key features:
 * - In-memory bloom filter for < 0.1ms lookups
 * - Configurable false positive rate (default: 0.1%)
 * - Automatic synchronization via Redis pub/sub
 * - Graceful degradation on Redis unavailability
 *
 * @packageDocumentation
 */
import type { preHandlerHookHandler } from 'fastify';
/**
 * Revocation check middleware options
 */
export interface RevocationCheckOptions {
    /** Paths to skip revocation checking */
    skipPaths?: string[];
    /** Expected number of revoked tokens (for bloom filter sizing) */
    expectedRevokedTokens?: number;
    /** Desired false positive rate (default: 0.001 = 0.1%) */
    falsePositiveRate?: number;
    /** Whether to check user-level revocation timestamps */
    checkUserRevocation?: boolean;
    /** Whether to check tenant-level revocation */
    checkTenantRevocation?: boolean;
    /** Redis key prefix for revoked tokens */
    redisKeyPrefix?: string;
    /** How often to sync with Redis (ms) */
    syncIntervalMs?: number;
}
/**
 * Revocation check result
 */
export interface RevocationCheckResult {
    /** Whether the token is revoked */
    revoked: boolean;
    /** Reason for revocation if revoked */
    reason?: string;
    /** Source of the check result */
    source: 'bloom_filter' | 'redis' | 'user_timestamp' | 'tenant';
    /** Duration of the check in milliseconds */
    durationMs: number;
}
/**
 * Token Revocation Check Service
 *
 * Provides efficient token revocation checking using a bloom filter
 * with Redis fallback for handling false positives.
 */
export declare class RevocationCheckService {
    private options;
    private bloomFilter;
    private redis;
    private subscriber;
    private isSubscribed;
    private syncInterval;
    private tokenRevocationService;
    private securityLogger;
    private readonly instanceId;
    private readonly redisKeyPrefix;
    private readonly revocationChannel;
    constructor(options?: RevocationCheckOptions);
    /**
     * Check if a token is revoked
     *
     * Uses bloom filter for fast negative lookups, falling back to Redis
     * for bloom filter hits to handle false positives.
     *
     * @param jti - JWT ID (token identifier)
     * @param userId - User ID for user-level revocation check
     * @param issuedAt - Token issue timestamp for user-level revocation
     * @param tenantId - Tenant ID for tenant-level revocation
     * @returns Revocation check result
     */
    checkRevocation(jti: string, userId?: string, issuedAt?: Date, tenantId?: string): Promise<RevocationCheckResult>;
    /**
     * Add a revoked token to the bloom filter
     *
     * Called when a token is revoked to update the local filter.
     */
    addRevokedToken(jti: string): void;
    /**
     * Check tenant-level revocation
     */
    private checkTenantRevocation;
    /**
     * Check Redis for token revocation
     */
    private checkRedis;
    /**
     * Get Redis client
     */
    private getRedis;
    /**
     * Subscribe to revocation events for bloom filter updates
     */
    private subscribeToRevocations;
    /**
     * Handle incoming revocation event
     */
    private handleRevocationEvent;
    /**
     * Publish revocation event to other instances
     */
    publishRevocation(jti: string): Promise<void>;
    /**
     * Start sync interval to periodically rebuild bloom filter from Redis
     */
    private startSyncInterval;
    /**
     * Sync bloom filter from Redis
     *
     * Rebuilds the bloom filter from all revoked tokens in Redis.
     * This handles cases where revocation events were missed.
     */
    syncFromRedis(): Promise<void>;
    /**
     * Get service statistics
     */
    getStats(): {
        bloomFilterItems: number;
        bloomFilterSizeBytes: number;
        estimatedFalsePositiveRate: number;
        isSubscribed: boolean;
        instanceId: string;
    };
    /**
     * Check service health
     */
    checkHealth(): Promise<{
        healthy: boolean;
        bloomFilterHealthy: boolean;
        redisHealthy: boolean;
        latencyMs?: number;
        error?: string;
    }>;
    /**
     * Stop the service
     */
    stop(): Promise<void>;
}
/**
 * Create revocation check middleware
 *
 * Checks token revocation status before allowing request to proceed.
 * Uses bloom filter for efficient negative lookups with Redis fallback.
 *
 * @param service - Revocation check service instance
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * const revocationService = new RevocationCheckService({
 *   expectedRevokedTokens: 100000,
 *   falsePositiveRate: 0.001,
 * });
 *
 * fastify.addHook('preHandler', revocationCheckMiddleware(revocationService, {
 *   skipPaths: ['/health', '/metrics', '/docs'],
 * }));
 * ```
 */
export declare function revocationCheckMiddleware(service: RevocationCheckService, options?: {
    skipPaths?: string[];
}): preHandlerHookHandler;
/**
 * Get the revocation check service singleton
 */
export declare function getRevocationCheckService(options?: RevocationCheckOptions): RevocationCheckService;
/**
 * Create a new revocation check service instance (for testing)
 */
export declare function createRevocationCheckService(options?: RevocationCheckOptions): RevocationCheckService;
/**
 * Reset the revocation check service singleton (for testing)
 */
export declare function resetRevocationCheckService(): Promise<void>;
//# sourceMappingURL=revocation-check.d.ts.map