import * as util from "util";
import { OperationContext, RegistryEntry, Store } from "../index.js";
import { DeepPartial, Service, ServiceParameters } from "./service.js";
export declare class SecretString {
    protected str: string;
    protected encrypter: string;
    constructor(str: string, encrypter: string);
    static from(value: string | SecretString, path?: string): string;
    getValue(): string;
    toString(): string;
    [util.inspect.custom](depth: any, options: any, inspect: any): string;
}
export interface KeysRegistry {
    /**
     * Contains the instanceId of the last
     * service who rotated
     */
    rotationInstance: string;
    /**
     * Key storage
     */
    [keys: `key_${string}`]: {
        publicKey: string;
        privateKey: string;
        symetric: string;
    };
    /**
     * Current key
     */
    current: string;
}
/**
 * Encrypt/Decrypt string
 */
export interface StringEncrypter {
    /**
     * Encrypt a string
     * @param data
     * @returns
     */
    encrypt(data: string, options?: any): Promise<string>;
    /**
     * Decrypt a string
     * @param data
     * @returns
     */
    decrypt(data: string, options?: any): Promise<string>;
}
/**
 * JWT Options
 */
export interface JWTOptions {
    /**
     * Secret to use with JWT
     */
    secretOrPublicKey?: string | Buffer | {
        key: string;
        passphrase: string;
    };
    /**
     * Algorithm for JWT token
     *
     * @see https://www.npmjs.com/package/jsonwebtoken
     * @default "HS256"
     */
    algorithm?: "HS256" | "HS384" | "HS512" | "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512";
    /**
     * expressed in seconds or a string describing a time span zeit/ms.
     *
     * Eg: 60, "2 days", "10h", "7d". A numeric value is interpreted as a seconds count. If you use a string be sure you provide the time units (days, hours, etc), otherwise milliseconds unit is used by default ("120" is equal to "120ms").
     */
    expiresIn?: number | string;
    /**
     * Audience for the jwt
     */
    audience?: string;
    /**
     * Issuer of the token
     */
    issuer?: string;
    /**
     * Subject for JWT
     */
    subject?: string;
    keyid?: any;
}
export declare class CryptoServiceParameters extends ServiceParameters {
    /**
     * Number of hours a key should be used for encryption
     *
     * if auto-rotate is not set this
     */
    keyActiveLifespan: number;
    /**
     * Number of hours allowed to decrypt data encrypted with this key
     */
    keyLifespan: number;
    /**
     * Try to rotate keys when they expire in days
     */
    autoRotate?: number;
    /**
     * Create first set of key if does not exist
     */
    autoCreate?: boolean;
    /**
     * To expose JWKS
     *
     * @see https://datatracker.ietf.org/doc/html/rfc7517
     */
    url?: string;
    /**
     * Type of asymetric key
     *
     * https://nodejs.org/api/crypto.html#cryptogeneratekeypairsynctype-options
     * https://nodejs.org/docs/latest-v14.x/api/crypto.html#crypto_crypto_generatekeypairsync_type_options
     */
    asymetricType: "rsa" | "dsa" | "ec" | "ed25519" | "ed448" | "x25519" | "x448" | "dh";
    /**
     * Options for asymetric generation
     */
    asymetricOptions?: {
        /**
         * @default 2048
         */
        modulusLength?: number;
        /**
         * Only if asymetricType "ec"
         */
        namedCurve?: string;
        publicKeyEncoding?: {
            /**
             * @default spki
             */
            type?: "spki" | "pkcs1";
            format?: "pem";
        };
        privateKeyEncoding?: {
            /**
             * https://nodejs.org/docs/latest-v14.x/api/crypto.html#crypto_keyobject_export_options
             * @default pkcs8
             */
            type?: "pkcs1" | "pkcs8" | "sec1";
            format?: "pem";
            cipher?: string;
            passphrase?: string;
        };
    };
    /**
     * @default 256
     */
    symetricKeyLength?: number;
    /**
     * @default "aes-256-ctr"
     */
    symetricCipher?: string;
    /**
     * Default JWT options
     */
    jwt?: JWTOptions;
    constructor(params: any);
}
interface KeysDefinition {
    publicKey: string;
    privateKey: string;
    symetric: string;
}
/**
 * @WebdaModda
 */
export default class CryptoService<T extends CryptoServiceParameters = CryptoServiceParameters> extends Service<T> implements StringEncrypter {
    private static encrypters;
    /**
     * Register an encrypter for configuration
     * @param name
     * @param encrypter
     */
    static registerEncrypter(name: string, encrypter: {
        encrypt: (data: string) => Promise<string>;
        decrypt: (data: string) => Promise<string>;
    }): void;
    currentSymetricKey: string;
    currentAsymetricKey: {
        publicKey: string;
        privateKey: string;
    };
    current: string;
    age: number;
    keys: {
        [key: string]: KeysDefinition;
    };
    /**
     * JWKS cache
     */
    jwks: {
        [key: string]: {
            n: string;
            e: string;
        };
    };
    registry: Store<RegistryEntry>;
    /**
     * @override
     */
    loadParameters(params: DeepPartial<T>): ServiceParameters;
    /**
     * @override
     */
    init(): Promise<this>;
    /**
     *
     */
    serveJWKS(context: OperationContext): Promise<void>;
    /**
     * Load keys from registry
     */
    load(): Promise<boolean>;
    /**
     * Generate asymetric key
     * @returns
     */
    generateAsymetricKeys(): {
        publicKey: string;
        privateKey: string;
    };
    /**
     * Generate symetric key
     * @returns
     */
    generateSymetricKey(): string;
    /**
     * Return current key set
     */
    getCurrentKeys(): Promise<{
        id: string;
        keys: KeysDefinition;
    }>;
    /**
     * Retrieve a HMAC for a string
     * @param data
     * @param keyId to use
     * @returns
     */
    hmac(data: string | any, keyId?: string): Promise<string>;
    /**
     * Verify a HMAC for a string
     * @param data
     * @returns
     */
    hmacVerify(data: string | any, hmac: string): Promise<boolean>;
    /**
     * JWT token generation
     */
    jwtSign(data: any, options?: JWTOptions): Promise<string>;
    /**
     *
     * @param keyId
     * @returns
     */
    checkKey(keyId: string): Promise<boolean>;
    /**
     * Get JWT key based on kid
     */
    getJWTKey(header: any, callback: any): Promise<void>;
    /**
     * JWT token verification
     */
    jwtVerify(token: string, options?: JWTOptions): Promise<string | any>;
    /**
     * Encrypt data
     */
    encrypt(data: any): Promise<string>;
    /**
     * Parse the JWT header section
     */
    getJWTHeader(token: string): any;
    /**
     * Encrypt configuration
     * @param data
     */
    static encryptConfiguration(data: any): Promise<any>;
    /**
     *
     * @param data
     */
    static decryptConfiguration(data: any): Promise<any>;
    /**
     * Decrypt data
     */
    decrypt(token: string): Promise<any>;
    /**
     * Get next id
     */
    getNextId(): {
        id: string;
        age: number;
    };
    /**
     * Rotate keys
     */
    rotate(): Promise<void>;
}
export { CryptoService };