import { JwtService } from '@nestjs/jwt';
import { Repository } from 'typeorm';
import { UserEntity } from '../entities/user.entity';
import { TenantEntity } from '../entities/tenant.entity';
import { TenantSettingsEntity } from '../entities/tenant-settings.entity';
import { RolePermissionEntity } from '../entities/role-permission.entity';
import { PasswordResetEntity } from '../entities/password-reset.entity';
import { RefreshTokenEntity } from '../entities/refresh-token.entity';
import { RedisService } from '../redis/redis.service';
import { MailerService } from '../modules/mailer/mailer.service';
import { LoginDto, AuthResponseDto, ForgotPasswordDto, ResetPasswordDto } from './dto';
import { ConfigService } from '@nestjs/config';
export interface JwtPayload {
    sub: string;
    email: string;
    tenant_id: string;
    impersonator_id?: string;
    read_only?: boolean;
}
export declare class AuthService {
    private readonly userRepo;
    private readonly tenantRepo;
    private readonly settingsRepo;
    private readonly rolePermRepo;
    private readonly resetRepo;
    private readonly refreshRepo;
    private readonly jwtService;
    private readonly redisService;
    private readonly mailer;
    private readonly configService;
    private readonly logger;
    constructor(userRepo: Repository<UserEntity>, tenantRepo: Repository<TenantEntity>, settingsRepo: Repository<TenantSettingsEntity>, rolePermRepo: Repository<RolePermissionEntity>, resetRepo: Repository<PasswordResetEntity>, refreshRepo: Repository<RefreshTokenEntity>, jwtService: JwtService, redisService: RedisService, mailer: MailerService, configService: ConfigService);
    private getPermissionsMap;
    private getLockoutKey;
    private checkLockout;
    private recordFailedAttempt;
    private clearFailedAttempts;
    login(dto: LoginDto, tenantId: string): Promise<AuthResponseDto>;
    startImpersonation(adminUserId: string, tenantId: string, targetUserId: string, reqContext?: {
        ip?: string | null;
    }): Promise<{
        accessToken: string;
        target: {
            id: string;
            name: string;
            email: string;
        };
    }>;
    stopImpersonation(adminUserId: string, tenantId: string, reqContext?: {
        ip?: string | null;
    }): Promise<{
        accessToken: string;
    }>;
    validateUserFromToken(payload: JwtPayload): Promise<UserEntity | null>;
    getProfile(userId: string, tenantId: string): Promise<{
        id: string;
        name: string;
        email: string;
        phone: string | null;
        tenant_id: string;
        role: string | null;
        role_id: string | null;
        permissions: Record<string, string>;
        view_all_bookings_queries: boolean;
        active_destination_id: string | null;
        destinations: any;
    }>;
    private static readonly RESET_TOKEN_BYTES;
    private static readonly RESET_TOKEN_TTL_MIN;
    private hashResetToken;
    forgotPassword(dto: ForgotPasswordDto, tenantId: string, ctx: {
        ip?: string | null;
        userAgent?: string | null;
        resetUrlBase: string;
    }): Promise<void>;
    resetPassword(dto: ResetPasswordDto, ctx: {
        ip?: string | null;
        userAgent?: string | null;
    }): Promise<void>;
    private static readonly REFRESH_TOKEN_BYTES;
    private hashRefreshToken;
    issueRefreshToken(user: {
        id: string;
        tenant_id: string;
    }, ctx: {
        ip?: string | null;
        userAgent?: string | null;
        familyId?: string;
    }): Promise<{
        raw: string;
        familyId: string;
        expiresAt: Date;
    }>;
    rotateRefreshToken(rawToken: string, ctx: {
        ip?: string | null;
        userAgent?: string | null;
    }): Promise<{
        accessToken: string;
        refreshToken: string;
        refreshExpiresAt: Date;
        user: UserEntity;
    }>;
    revokeRefreshToken(rawToken: string | null | undefined): Promise<void>;
}