import type { AppConfig } from '../config.js';
import type { FileStore } from '../storage/fileStore.js';
import { InMemoryRateLimit } from './rateLimit.js';
import type { TotpService } from './totpService.js';
export declare class AuthError extends Error {
    readonly code: string;
    readonly statusCode: number;
    constructor(code: string, message: string, statusCode?: number);
}
export interface PasswordSession {
    sessionId: string;
    expiresAt: string;
}
export interface LoginResult {
    session: PasswordSession;
    deviceToken: string;
}
export interface AuthContext {
    ip?: string | null | undefined;
    userAgent?: string | null | undefined;
    rememberNetwork?: boolean | undefined;
    deviceToken?: string | null | undefined;
    clientKey?: string | undefined;
}
export interface TrustedDeviceSummary {
    id: string;
    label: string;
    createdAt: string;
    lastSeenAt: string;
    current: boolean;
}
export interface IpRuleSummary {
    id: string;
    value: string;
    label: string;
    createdAt: string;
}
export interface AuthServiceOptions {
    now?: () => number;
    passwordRateLimit?: InMemoryRateLimit;
    totpService?: TotpService;
}
export type SessionValidationDiagnosticReason = 'valid' | 'missing_session_cookie' | 'unknown_session' | 'expired' | 'ip_mismatch';
export interface SessionValidationDiagnostic {
    valid: boolean;
    reason: SessionValidationDiagnosticReason;
    sessionCookiePresent: boolean;
    sessionKnown: boolean;
    sessionIpBound: boolean;
    ipProvided: boolean;
    ipParsed: boolean;
    ipMatchedSessionNetwork: boolean;
    ipWhitelisted: boolean;
    expiresAt: string | null;
}
export declare class AuthService {
    private readonly config;
    private readonly store;
    private readonly now;
    private readonly passwordRateLimit;
    private readonly sessions;
    private readonly totpService;
    constructor(config: AppConfig, store: FileStore, options?: AuthServiceOptions);
    setupPassword(password: string, ctx?: AuthContext): Promise<LoginResult>;
    loginWithPassword(password: string, otp?: string, ctx?: AuthContext): Promise<LoginResult>;
    reauthWithOtp(otp: string | undefined, ctx?: AuthContext): Promise<PasswordSession>;
    setupTotp(sessionId: string | undefined, ip?: string | null): Promise<{
        secret: string;
        qrDataUrl: string;
    }>;
    activateTotp(sessionId: string | undefined, secret: string, otp: string, ip?: string | null): Promise<void>;
    disableTotp(sessionId: string | undefined, ip?: string | null): Promise<void>;
    isTotpEnabled(): Promise<boolean>;
    validateSession(sessionId: string | undefined, ip?: string | null, options?: {
        destroy?: boolean;
    }): Promise<boolean>;
    diagnoseSession(sessionId: string | undefined, ip?: string | null): Promise<SessionValidationDiagnostic>;
    getSessionStatus(sessionId: string | undefined, ctx?: {
        ip?: string | null | undefined;
        deviceToken?: string | null | undefined;
    }): Promise<{
        passwordSet: boolean;
        authenticated: boolean;
        totpEnabled: boolean;
        deviceTrusted: boolean;
        currentIpWhitelisted: boolean;
        expiresAt: string | null;
    }>;
    requireSession(request: {
        cookies?: Record<string, string | undefined>;
        headers?: Record<string, string | string[] | undefined>;
        ip?: string;
    }): Promise<{
        sessionId: string;
    } | null>;
    logout(sessionId: string | undefined, deviceToken?: string | null): Promise<void>;
    listTrustedDevices(currentDeviceToken?: string | null): Promise<TrustedDeviceSummary[]>;
    revokeTrustedDevice(id: string): Promise<void>;
    listIpRules(): Promise<IpRuleSummary[]>;
    addIpRule(value: string, label: string): Promise<IpRuleSummary>;
    removeIpRule(id: string): Promise<void>;
    private createSession;
    private buildTrustedDevice;
    private pruneDevices;
    private findValidDevice;
    private deviceMatchesToken;
    private hashDeviceToken;
    private maybeAddIp;
    private validatePassword;
    private hashPassword;
    private verifyPassword;
    private safeEqual;
    private parseCookieHeader;
}
