/**
 * Service Account Management
 *
 * Provides types, interfaces, and management functions for service accounts
 * used in service-to-service authentication.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
import { VorionError, NotFoundError } from '../../common/errors.js';
/**
 * Service account status
 */
export declare const ServiceAccountStatus: {
    readonly ACTIVE: "active";
    readonly REVOKED: "revoked";
    readonly SUSPENDED: "suspended";
};
export type ServiceAccountStatus = (typeof ServiceAccountStatus)[keyof typeof ServiceAccountStatus];
export declare const serviceAccountStatusSchema: z.ZodNativeEnum<{
    readonly ACTIVE: "active";
    readonly REVOKED: "revoked";
    readonly SUSPENDED: "suspended";
}>;
/**
 * Service account interface
 */
export interface ServiceAccount {
    /** Unique client identifier */
    clientId: string;
    /** Hashed client secret (SHA-256) */
    clientSecret: string;
    /** Human-readable name for the service */
    name: string;
    /** List of permissions granted to this service */
    permissions: string[];
    /** Optional IP whitelist for additional security */
    ipWhitelist?: string[];
    /** Service account status */
    status: ServiceAccountStatus;
    /** Tenant ID this service belongs to */
    tenantId: string;
    /** Description of the service */
    description?: string;
    /** When the account was created */
    createdAt: Date;
    /** When the account was last used */
    lastUsedAt?: Date;
    /** When the secret was last rotated */
    secretRotatedAt?: Date;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Service account schema for validation
 */
export declare const serviceAccountSchema: z.ZodObject<{
    clientId: z.ZodString;
    clientSecret: z.ZodString;
    name: z.ZodString;
    permissions: z.ZodArray<z.ZodString, "many">;
    ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    status: z.ZodNativeEnum<{
        readonly ACTIVE: "active";
        readonly REVOKED: "revoked";
        readonly SUSPENDED: "suspended";
    }>;
    tenantId: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    createdAt: z.ZodDate;
    lastUsedAt: z.ZodOptional<z.ZodDate>;
    secretRotatedAt: z.ZodOptional<z.ZodDate>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    status?: "active" | "revoked" | "suspended";
    createdAt?: Date;
    lastUsedAt?: Date;
    name?: string;
    description?: string;
    clientId?: string;
    clientSecret?: string;
    tenantId?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
    secretRotatedAt?: Date;
}, {
    status?: "active" | "revoked" | "suspended";
    createdAt?: Date;
    lastUsedAt?: Date;
    name?: string;
    description?: string;
    clientId?: string;
    clientSecret?: string;
    tenantId?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
    secretRotatedAt?: Date;
}>;
/**
 * Input for creating a service account
 */
export interface CreateServiceAccountInput {
    name: string;
    permissions: string[];
    tenantId: string;
    ipWhitelist?: string[];
    description?: string;
    metadata?: Record<string, unknown>;
}
export declare const createServiceAccountInputSchema: z.ZodObject<{
    name: z.ZodString;
    permissions: z.ZodArray<z.ZodString, "many">;
    tenantId: z.ZodString;
    ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    description: z.ZodOptional<z.ZodString>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    description?: string;
    tenantId?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
}, {
    name?: string;
    description?: string;
    tenantId?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
}>;
/**
 * Result of creating a service account (includes plaintext secret)
 */
export interface ServiceAccountCreationResult {
    account: ServiceAccount;
    /** The plaintext client secret - only returned once at creation */
    clientSecretPlaintext: string;
}
/**
 * Result of rotating a service account secret
 */
export interface SecretRotationResult {
    account: ServiceAccount;
    /** The new plaintext client secret */
    newClientSecretPlaintext: string;
    /** Previous secret hash (for audit) */
    previousSecretHash: string;
}
/**
 * Input for updating a service account
 */
export interface UpdateServiceAccountInput {
    name?: string;
    permissions?: string[];
    ipWhitelist?: string[];
    description?: string;
    metadata?: Record<string, unknown>;
}
export declare const updateServiceAccountInputSchema: z.ZodObject<{
    name: z.ZodOptional<z.ZodString>;
    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    ipWhitelist: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    description: z.ZodOptional<z.ZodString>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    description?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
}, {
    name?: string;
    description?: string;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    ipWhitelist?: string[];
}>;
/**
 * Service account specific error
 */
export declare class ServiceAccountError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Service account not found error
 */
export declare class ServiceAccountNotFoundError extends NotFoundError {
    code: string;
    constructor(clientId: string);
}
/**
 * Service account revoked error
 */
export declare class ServiceAccountRevokedError extends VorionError {
    code: string;
    statusCode: number;
    constructor(clientId: string);
}
/**
 * Service account suspended error
 */
export declare class ServiceAccountSuspendedError extends VorionError {
    code: string;
    statusCode: number;
    constructor(clientId: string);
}
/** Prefix for client IDs */
export declare const SERVICE_CLIENT_ID_PREFIX = "svc_";
/**
 * Generate a cryptographically secure client secret
 */
export declare function generateClientSecret(): string;
/**
 * Generate a unique client ID
 */
export declare function generateClientId(): string;
/**
 * Hash a client secret using SHA-256
 */
export declare function hashClientSecret(secret: string): string;
/**
 * Verify a client secret against its hash using timing-safe comparison
 */
export declare function verifyClientSecret(secret: string, hashedSecret: string): boolean;
/**
 * Interface for service account storage
 */
export interface IServiceAccountStore {
    /** Create a new service account */
    create(account: ServiceAccount): Promise<ServiceAccount>;
    /** Find a service account by client ID */
    findByClientId(clientId: string): Promise<ServiceAccount | null>;
    /** Find all service accounts for a tenant */
    findByTenantId(tenantId: string): Promise<ServiceAccount[]>;
    /** Update a service account */
    update(clientId: string, updates: Partial<ServiceAccount>): Promise<ServiceAccount>;
    /** Delete a service account */
    delete(clientId: string): Promise<boolean>;
    /** Update last used timestamp */
    updateLastUsed(clientId: string): Promise<void>;
}
/**
 * In-memory implementation of service account store
 */
export declare class InMemoryServiceAccountStore implements IServiceAccountStore {
    private accounts;
    create(account: ServiceAccount): Promise<ServiceAccount>;
    findByClientId(clientId: string): Promise<ServiceAccount | null>;
    findByTenantId(tenantId: string): Promise<ServiceAccount[]>;
    update(clientId: string, updates: Partial<ServiceAccount>): Promise<ServiceAccount>;
    delete(clientId: string): Promise<boolean>;
    updateLastUsed(clientId: string): Promise<void>;
    /** Clear all accounts (for testing) */
    clear(): void;
}
/**
 * Service account manager configuration
 */
export interface ServiceAccountManagerConfig {
    /** Store implementation */
    store: IServiceAccountStore;
    /** Minimum secret rotation interval in days */
    minSecretRotationDays?: number;
    /** Maximum number of service accounts per tenant */
    maxAccountsPerTenant?: number;
}
/**
 * Service account manager
 */
export declare class ServiceAccountManager {
    private readonly store;
    private readonly minSecretRotationDays;
    private readonly maxAccountsPerTenant;
    constructor(config: ServiceAccountManagerConfig);
    /**
     * Create a new service account
     */
    createAccount(input: CreateServiceAccountInput): Promise<ServiceAccountCreationResult>;
    /**
     * Get a service account by client ID
     */
    getAccount(clientId: string): Promise<ServiceAccount>;
    /**
     * Get a service account if it exists
     */
    findAccount(clientId: string): Promise<ServiceAccount | null>;
    /**
     * List all service accounts for a tenant
     */
    listAccounts(tenantId: string): Promise<ServiceAccount[]>;
    /**
     * Update a service account
     */
    updateAccount(clientId: string, input: UpdateServiceAccountInput): Promise<ServiceAccount>;
    /**
     * Revoke a service account
     */
    revokeAccount(clientId: string): Promise<ServiceAccount>;
    /**
     * Suspend a service account
     */
    suspendAccount(clientId: string): Promise<ServiceAccount>;
    /**
     * Reactivate a suspended service account
     */
    reactivateAccount(clientId: string): Promise<ServiceAccount>;
    /**
     * Delete a service account permanently
     */
    deleteAccount(clientId: string): Promise<boolean>;
    /**
     * Rotate a service account's secret
     */
    rotateSecret(clientId: string): Promise<SecretRotationResult>;
    /**
     * Verify credentials for a service account
     */
    verifyCredentials(clientId: string, clientSecret: string): Promise<ServiceAccount>;
    /**
     * Check if an IP address is allowed for a service account
     */
    isIpAllowed(clientId: string, ipAddress: string): Promise<boolean>;
    /**
     * Check if a service account has a specific permission
     */
    hasPermission(clientId: string, permission: string): Promise<boolean>;
    /**
     * Check if secret rotation is recommended
     */
    isSecretRotationRecommended(clientId: string): Promise<boolean>;
}
/**
 * Get the default service account store
 */
export declare function getServiceAccountStore(): IServiceAccountStore;
/**
 * Set a custom service account store
 */
export declare function setServiceAccountStore(store: IServiceAccountStore): void;
/**
 * Get the default service account manager
 */
export declare function getServiceAccountManager(): ServiceAccountManager;
/**
 * Create a service account manager with custom config
 */
export declare function createServiceAccountManager(config: ServiceAccountManagerConfig): ServiceAccountManager;
/**
 * Reset singleton instances (for testing)
 */
export declare function resetServiceAccountSingletons(): void;
//# sourceMappingURL=service-account.d.ts.map