import { VorionError } from '../common/errors.js';
import { type TokenRevocationService } from '../common/token-revocation.js';
import { type RefreshTokenService } from './refresh-token.js';
import { type SessionStore } from './session-store.js';
import { type ApiKeyService } from './api-keys/service.js';
import { SecurityAuditLogger } from '../audit/security-logger.js';
/**
 * Revocation reason types
 */
export type RevocationReason = 'logout' | 'logout_all' | 'password_change' | 'password_reset' | 'role_change' | 'user_disabled' | 'user_deleted' | 'tenant_suspended' | 'security_incident' | 'session_hijack_detected' | 'manual_revocation' | 'device_removed';
/**
 * Revocation trigger events for cascade operations
 */
export type RevocationTrigger = 'user.role_changed' | 'user.disabled' | 'user.deleted' | 'user.password_changed' | 'tenant.suspended' | 'security.incident';
/**
 * Result of a bulk revocation operation
 */
export interface BulkRevocationResult {
    /** Total tokens revoked across all types */
    totalRevoked: number;
    /** JWT tokens revoked */
    jwtTokensRevoked: number;
    /** Refresh token families revoked */
    refreshTokenFamiliesRevoked: number;
    /** API keys revoked */
    apiKeysRevoked: number;
    /** Sessions revoked */
    sessionsRevoked: number;
    /** Duration of the operation in milliseconds */
    durationMs: number;
    /** Any errors that occurred during revocation */
    errors: Array<{
        type: string;
        error: string;
    }>;
    /** Whether the operation was fully successful */
    success: boolean;
}
/**
 * Options for revocation operations
 */
export interface RevocationOptions {
    /** Reason for revocation */
    reason: RevocationReason;
    /** Actor performing the revocation */
    revokedBy: string;
    /** Specific token types to revoke (default: all) */
    tokenTypes?: Array<'jwt' | 'refresh' | 'api_key' | 'session'>;
    /** Session ID to exclude from revocation (for current session) */
    excludeSessionId?: string;
    /** Device ID to target (for device-specific revocation) */
    deviceId?: string;
    /** Additional metadata for audit logging */
    metadata?: Record<string, unknown>;
}
/**
 * Token lifecycle service configuration
 */
export interface TokenLifecycleConfig {
    /** Whether to use Redis pub/sub for cross-instance notification */
    enablePubSub?: boolean;
    /** Redis channel for revocation events */
    revocationChannel?: string;
    /** Default JWT token TTL for revocation tracking */
    defaultJwtTTLSeconds?: number;
}
/**
 * Revocation event published via Redis pub/sub
 */
export interface RevocationEvent {
    type: 'user_all' | 'session' | 'device' | 'tenant';
    userId?: string;
    tenantId: string;
    sessionId?: string;
    deviceId?: string;
    reason: RevocationReason;
    revokedBy: string;
    timestamp: number;
    sourceInstance: string;
}
/**
 * Token lifecycle operation error
 */
export declare class TokenLifecycleError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Unified Token Lifecycle Management Service
 *
 * Provides comprehensive token revocation across all token types with
 * cascade revocation support for security events.
 *
 * @example
 * ```typescript
 * const lifecycle = getTokenLifecycleService();
 *
 * // Revoke all tokens for a user (e.g., on logout all)
 * const result = await lifecycle.revokeAllUserTokens(
 *   'user-123',
 *   'tenant-456',
 *   { reason: 'logout_all', revokedBy: 'user-123' }
 * );
 *
 * // Revoke tokens for a specific session
 * await lifecycle.revokeBySession('session-789');
 *
 * // Revoke tokens for a specific device
 * await lifecycle.revokeByDevice('user-123', 'device-abc');
 *
 * // Handle cascade revocation trigger
 * await lifecycle.handleCascadeRevocation('user.role_changed', {
 *   userId: 'user-123',
 *   tenantId: 'tenant-456',
 * });
 * ```
 */
export declare class TokenLifecycleService {
    private config;
    private redis;
    private subscriber;
    private isSubscribed;
    private readonly instanceId;
    private tokenRevocationService;
    private refreshTokenService;
    private sessionStore;
    private apiKeyService;
    private securityLogger;
    constructor(config?: TokenLifecycleConfig, deps?: {
        tokenRevocationService?: TokenRevocationService;
        refreshTokenService?: RefreshTokenService;
        sessionStore?: SessionStore;
        apiKeyService?: ApiKeyService;
        securityLogger?: SecurityAuditLogger;
    });
    /**
     * Revoke all tokens for a user across all token types
     *
     * This is the primary method for comprehensive user token revocation.
     * Use cases:
     * - Logout from all devices
     * - Password change/reset
     * - Security incident response
     * - User account suspension
     *
     * @param userId - User ID to revoke tokens for
     * @param tenantId - Tenant ID for multi-tenant isolation
     * @param options - Revocation options
     * @returns Bulk revocation result with counts per token type
     */
    revokeAllUserTokens(userId: string, tenantId: string, options: RevocationOptions): Promise<BulkRevocationResult>;
    /**
     * Revoke all tokens associated with a specific session
     *
     * @param sessionId - Session ID to revoke tokens for
     * @returns Whether the revocation was successful
     */
    revokeBySession(sessionId: string): Promise<boolean>;
    /**
     * Revoke all tokens for a specific device
     *
     * @param userId - User ID
     * @param deviceId - Device ID/fingerprint to revoke tokens for
     * @returns Bulk revocation result
     */
    revokeByDevice(userId: string, deviceId: string): Promise<BulkRevocationResult>;
    /**
     * Handle cascade revocation trigger events
     *
     * Called when security-relevant events occur that require token revocation:
     * - User role changes
     * - User account disabled
     * - Tenant suspended
     *
     * @param trigger - Type of trigger event
     * @param context - Event context with relevant IDs
     */
    handleCascadeRevocation(trigger: RevocationTrigger, context: {
        userId?: string;
        tenantId: string;
        metadata?: Record<string, unknown>;
    }): Promise<BulkRevocationResult | null>;
    /**
     * Revoke all tokens for an entire tenant
     *
     * Use with caution - this affects all users in the tenant.
     *
     * @param tenantId - Tenant ID
     * @param reason - Revocation reason
     * @param revokedBy - Actor performing revocation
     */
    revokeAllTenantTokens(tenantId: string, reason: RevocationReason, revokedBy: string): Promise<BulkRevocationResult>;
    /**
     * Check if a tenant has been revoked
     *
     * @param tenantId - Tenant ID to check
     * @returns Whether the tenant is revoked
     */
    isTenantRevoked(tenantId: string): Promise<boolean>;
    /**
     * Check if a user's tokens were revoked after a specific time
     *
     * @param userId - User ID to check
     * @param issuedAt - Token issue time
     * @returns Whether the token should be considered revoked
     */
    isUserTokenRevoked(userId: string, issuedAt: Date): Promise<boolean>;
    /**
     * Get Redis client
     */
    private getRedis;
    /**
     * Subscribe to revocation events from other instances
     */
    private subscribeToRevocations;
    /**
     * Handle incoming revocation event from another instance
     */
    private handleRevocationEvent;
    /**
     * Publish revocation event to other instances
     */
    private publishRevocationEvent;
    /**
     * Determine if API keys should be revoked based on reason
     */
    private shouldRevokeApiKeys;
    /**
     * Build security actor for audit logging
     */
    private buildActor;
    /**
     * Stop the service and cleanup resources
     */
    stop(): Promise<void>;
}
/**
 * Get the token lifecycle service singleton
 */
export declare function getTokenLifecycleService(config?: TokenLifecycleConfig): TokenLifecycleService;
/**
 * Create a new token lifecycle service instance (for testing)
 */
export declare function createTokenLifecycleService(config?: TokenLifecycleConfig, deps?: {
    tokenRevocationService?: TokenRevocationService;
    refreshTokenService?: RefreshTokenService;
    sessionStore?: SessionStore;
    apiKeyService?: ApiKeyService;
    securityLogger?: SecurityAuditLogger;
}): TokenLifecycleService;
/**
 * Reset the token lifecycle service singleton (for testing)
 */
export declare function resetTokenLifecycleService(): Promise<void>;
//# sourceMappingURL=token-lifecycle.d.ts.map