import { SecurityAuditLogger } from '../audit/security-logger.js';
/**
 * Session data structure
 */
export interface Session {
    /** Unique session identifier */
    id: string;
    /** User ID this session belongs to */
    userId: string;
    /** Tenant ID for multi-tenant isolation */
    tenantId: string;
    /** Device fingerprint for identification */
    deviceFingerprint?: string;
    /** IP address at session creation */
    ipAddress: string;
    /** User agent string */
    userAgent: string;
    /** When the session was created */
    createdAt: Date;
    /** Last activity timestamp */
    lastActivityAt: Date;
    /** When the session expires */
    expiresAt: Date;
    /** Whether the session has been revoked */
    revoked: boolean;
    /** When the session was revoked */
    revokedAt?: Date;
    /** Reason for revocation */
    revokedReason?: string;
    /** Who revoked the session (user ID or 'system') */
    revokedBy?: string;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Session creation input
 */
export interface CreateSessionInput {
    userId: string;
    tenantId: string;
    ipAddress: string;
    userAgent: string;
    deviceFingerprint?: string;
    ttlSeconds?: number;
    metadata?: Record<string, unknown>;
}
/**
 * Session store configuration
 */
export interface SessionStoreConfig {
    /** Redis key prefix */
    keyPrefix: string;
    /** Default session TTL in seconds */
    defaultTTL: number;
    /** Maximum sessions per user */
    maxSessionsPerUser: number;
    /** Whether to track session activity */
    trackActivity: boolean;
}
/**
 * Redis-backed session store with pub/sub revocation propagation
 */
export declare class SessionStore {
    private config;
    private redis;
    private subscriber;
    private readonly instanceId;
    private isSubscribed;
    private cleanupInterval;
    private securityLogger;
    constructor(config?: Partial<SessionStoreConfig>, securityLogger?: SecurityAuditLogger);
    /**
     * Get Redis client, initializing if needed
     */
    private getRedis;
    /**
     * Subscribe to session revocation events for cross-instance propagation
     */
    private subscribeToRevocations;
    /**
     * Publish a session revocation event to other instances
     */
    private publishRevocation;
    /**
     * Add a session ID to the local revoked cache
     */
    private addToRevokedCache;
    /**
     * Check if a session is in the local revoked cache
     */
    private isInRevokedCache;
    /**
     * Start cleanup interval for revoked sessions cache
     */
    private startCacheCleanup;
    /**
     * Generate session key for Redis
     */
    private sessionKey;
    /**
     * Generate user sessions index key
     */
    private userSessionsKey;
    /**
     * Create a new session
     */
    create(input: CreateSessionInput): Promise<Session>;
    /**
     * Get a session by ID
     */
    get(sessionId: string): Promise<Session | null>;
    /**
     * Update session activity timestamp
     */
    touch(sessionId: string): Promise<boolean>;
    /**
     * Revoke a session and notify other instances immediately
     */
    revoke(sessionId: string, reason: string, revokedBy?: string): Promise<boolean>;
    /**
     * Revoke all sessions for a user
     */
    revokeAllForUser(userId: string, reason: string, revokedBy?: string, exceptSessionId?: string): Promise<number>;
    /**
     * Get all session IDs for a user
     */
    getSessionIdsForUser(userId: string): Promise<string[]>;
    /**
     * Get all active sessions for a user
     */
    getSessionsForUser(userId: string): Promise<Session[]>;
    /**
     * Delete a session permanently
     */
    delete(sessionId: string): Promise<boolean>;
    /**
     * Validate a session is active and not revoked
     *
     * First checks the local revoked cache for immediate revocation detection,
     * then validates against Redis for the full session state.
     */
    validate(sessionId: string): Promise<{
        valid: boolean;
        session?: Session;
        reason?: string;
    }>;
    /**
     * Enforce maximum sessions per user
     */
    private enforceSessionLimit;
    /**
     * Serialize session for storage
     */
    private serializeSession;
    /**
     * Deserialize session from storage
     */
    private deserializeSession;
    /**
     * Stop the session store and cleanup resources
     */
    stop(): Promise<void>;
    /**
     * Check if Redis is healthy
     */
    checkHealth(): Promise<{
        healthy: boolean;
        latencyMs?: number;
        error?: string;
    }>;
    /**
     * Get store statistics
     */
    getStats(): {
        revokedCacheSize: number;
        instanceId: string;
        isSubscribed: boolean;
    };
}
/**
 * Get the session store singleton
 */
export declare function getSessionStore(config?: Partial<SessionStoreConfig>): SessionStore;
/**
 * Create a new session store instance (for testing)
 */
export declare function createSessionStore(config?: Partial<SessionStoreConfig>, securityLogger?: SecurityAuditLogger): SessionStore;
/**
 * Reset the session store singleton (for testing)
 */
export declare function resetSessionStore(): Promise<void>;
//# sourceMappingURL=session-store.d.ts.map