@rapidrest/auth 1.0.0-beta.1

package/dist/types/auth/types.d.ts

@@ -0,0 +1,127 @@
+/**
+ * The different types of supported contact methods.
+ */
+export declare enum OTPContactType {
+    EMAIL = "email",
+    SMS = "sms"
+}
+/**
+ * Describes a single verified contact that can be used to send a OTP code to the user.
+ */
+export interface OTPContact {
+    /** The contact that the OTP can be sent to. */
+    contact: string;
+    /** The method type of contact (e.g. email, sms). */
+    type: OTPContactType;
+    /** Indicates if the contact has been verified. */
+    verified?: boolean;
+}
+/**
+ * Configuration for a WebAuthn/Passkey relying party.
+ */
+export interface PasskeyConfig {
+    /** The human-readable name of the relying party, shown to the user by the authenticator UI. */
+    rpName: string;
+    /** The relying party ID — a valid domain name (no scheme/port), e.g. `"example.com"`. */
+    rpID: string;
+    /**
+     * The exact scheme+host+port expected in the client's `clientDataJSON.origin` (e.g.
+     * `"https://example.com"`). May be a list to support multiple valid frontend origins.
+     */
+    origin: string | string[];
+    /**
+     * Requested user verification behavior at options-generation time. Set to `"discouraged"` for a
+     * 2FA-style flow, `"required"`/`"preferred"` otherwise. Default is `"preferred"`.
+     */
+    userVerification?: "required" | "preferred" | "discouraged";
+    /**
+     * Whether user verification is *enforced* at response-verification time. This is a distinct
+     * knob from `userVerification` above (which only shapes what's requested from the client).
+     * Default is `true`.
+     */
+    requireUserVerification?: boolean;
+    /** How long (in ms) the user has to complete the ceremony. Default is `60000`. */
+    timeout?: number;
+    /**
+     * Restricts which category of authenticator may be used to create a new credential during
+     * registration. Set to `"cross-platform"` to steer users toward roaming/hardware security keys
+     * (e.g. a YubiKey), or `"platform"` for built-in authenticators (Face ID, Windows Hello, etc).
+     * Leave unset to allow either — the appropriate default for passkey registration.
+     */
+    authenticatorAttachment?: "platform" | "cross-platform";
+    /**
+     * Whether a newly registered credential must be discoverable (usable in a "usernameless" flow).
+     * Default is `"preferred"`. A hardware security key used purely as a known-account credential
+     * typically doesn't need this and can use `"discouraged"`.
+     */
+    residentKey?: "discouraged" | "preferred" | "required";
+}
+/**
+ * The transport hints an authenticator can report supporting. Mirrors `@simplewebauthn/server`'s
+ * `AuthenticatorTransportFuture` union without a compile-time dependency on that optional package.
+ */
+export type PasskeyTransport = "ble" | "cable" | "hybrid" | "internal" | "nfc" | "smart-card" | "usb";
+/**
+ * A previously-registered WebAuthn credential as persisted by the consuming application.
+ */
+export interface StoredPasskeyCredential {
+    /** The base64url-encoded credential ID. */
+    id: string;
+    /** The uid of the user this credential belongs to. */
+    uid: string;
+    /** The credential's public key, as returned by the registration ceremony. */
+    publicKey: Uint8Array;
+    /** The last-known signature counter for this credential, used to detect cloned authenticators. */
+    counter: number;
+    /** The transports the authenticator reported supporting, if any (e.g. `["internal", "hybrid"]`). */
+    transports?: PasskeyTransport[];
+}
+/**
+ * The HMAC hash algorithms supported for TOTP token generation, per RFC 6238 §1.2.
+ */
+export type TOTPAlgorithm = "sha1" | "sha256" | "sha512";
+/**
+ * Configuration for a TOTP (RFC 6238) issuer. Used both to generate the `otpauth://` provisioning
+ * URI (the "Key URI Format" companion convention supported by virtually every TOTP authenticator
+ * app, e.g. Google Authenticator/Authy/1Password) for enrolling a new secret, and as the default
+ * token parameters for newly registered secrets.
+ */
+export interface TOTPConfig {
+    /** The human-readable name of the issuing service, shown to the user by the authenticator app. */
+    issuer: string;
+    /** The number of digits each generated token contains. Default is `6`. */
+    digits?: number;
+    /** The time step, in seconds, that each generated token remains valid for. Default is `30`. */
+    period?: number;
+    /**
+     * The HMAC hash algorithm used to generate tokens. Default is `"sha1"` — the only algorithm
+     * universally supported by authenticator apps despite RFC 6238 permitting SHA-256/SHA-512.
+     */
+    algorithm?: TOTPAlgorithm;
+    /**
+     * Specifies a tolerance window around the current time. It does not represent a strict duration in seconds
+     * (e.g., "±N seconds"), but rather dictates which periods overlap with the tolerance window `[currentTime -
+     * tolerance, currentTime + tolerance]`. Default value is `[5, 0]`.
+     */
+    epochTolerance?: number | number[];
+}
+/**
+ * Describes a secret used for TOTP authentication. The `digits`/`period`/`algorithm` parameters are
+ * captured at registration time (rather than always deferring to the current `TOTPConfig`) so a
+ * secret keeps verifying correctly even if the relying party's configured defaults change later.
+ */
+export interface TOTPSecret {
+    secret: string;
+    /** The number of digits the associated token contains, if it differs from the library default. */
+    digits?: number;
+    /** The time step, in seconds, that the associated token remains valid for, if it differs from the library default. */
+    period?: number;
+    /** The HMAC hash algorithm used to generate the associated token, if it differs from the library default. */
+    algorithm?: TOTPAlgorithm;
+    /**
+     * Specifies a tolerance window around the current time. It does not represent a strict duration in seconds
+     * (e.g., "±N seconds"), but rather dictates which periods overlap with the tolerance window `[currentTime -
+     * tolerance, currentTime + tolerance]`. Default value is `[5, 0]`.
+     */
+    epochTolerance?: number | number[];
+}

package/dist/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./auth/index.js";
+export * from "./models/index.js";
+export * from "./routes/index.js";

package/dist/types/models/index.d.ts

@@ -0,0 +1 @@
+export * from "./types.js";

package/dist/types/models/mongo/AliasMongo.d.ts

@@ -0,0 +1,15 @@
+import { BaseMongoEntity } from "@rapidrest/service-core";
+import { Alias, AliasType } from "../types.js";
+/**
+ * Implementation of the `Alias` interface for storage in a MongoDB database. If SQL is desired, please use
+ * `models.sql.AliasSQL` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class AliasMongo extends BaseMongoEntity implements Alias {
+    alias: string;
+    type: AliasType;
+    userUid: string;
+    verified: boolean;
+    constructor(other?: Partial<AliasMongo>);
+}

package/dist/types/models/mongo/ProfileMongo.d.ts

@@ -0,0 +1,17 @@
+import { BaseMongoEntity } from "@rapidrest/service-core";
+import { Contact, Preferences, Profile } from "../types.js";
+/**
+ * Implementation of the `Profile` interface for storage in a MongoDB database. If SQL is desired, please use
+ * `models.sql.ProfileSQL` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class ProfileMongo extends BaseMongoEntity implements Profile {
+    avatar?: string;
+    birthdate?: Date;
+    contacts: Contact[];
+    givenName?: string;
+    familyName?: string;
+    preferences: Preferences;
+    constructor(other?: Partial<ProfileMongo>);
+}

package/dist/types/models/mongo/SecretMongo.d.ts

@@ -0,0 +1,14 @@
+import { BaseMongoEntity } from "@rapidrest/service-core";
+import { Secret, SecretType } from "../types.js";
+/**
+ * Implementation of the `Secret` interface for storage in a MongoDB database. If SQL is desired, please use
+ * `models.sql.SecretSQL` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class SecretMongo extends BaseMongoEntity implements Secret {
+    data: any;
+    type: SecretType;
+    userUid: string;
+    constructor(other?: Partial<SecretMongo>);
+}

package/dist/types/models/mongo/UserMongo.d.ts

@@ -0,0 +1,14 @@
+import { BaseMongoEntity } from "@rapidrest/service-core";
+import { User } from "../types.js";
+/**
+ * Implementation of the `User` interface for storage in a MongoDB database. If SQL is desired, please use
+ * `models.sql.UserSQL` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class UserMongo extends BaseMongoEntity implements User {
+    roles: string[];
+    scopes: string[];
+    verified: boolean;
+    constructor(other?: Partial<UserMongo>);
+}

package/dist/types/models/mongo/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./AliasMongo.js";
+export * from "./ProfileMongo.js";
+export * from "./SecretMongo.js";
+export * from "./UserMongo.js";

package/dist/types/models/mongo.d.ts

@@ -0,0 +1 @@
+export * from "./mongo/index.js";

package/dist/types/models/sql/AliasSQL.d.ts

@@ -0,0 +1,15 @@
+import { BaseEntity } from "@rapidrest/service-core";
+import { Alias, AliasType } from "../types.js";
+/**
+ * Implementation of the `Alias` interface for storage in a SQL database. If MongoDB is desired, please use
+ * `models.mongo.AliasMongo` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class AliasSQL extends BaseEntity implements Alias {
+    alias: string;
+    type: AliasType;
+    userUid: string;
+    verified: boolean;
+    constructor(other?: Partial<AliasSQL>);
+}

package/dist/types/models/sql/ProfileSQL.d.ts

@@ -0,0 +1,17 @@
+import { BaseEntity } from "@rapidrest/service-core";
+import { Contact, Preferences, Profile } from "../types.js";
+/**
+ * Implementation of the `Profile` interface for storage in a SQL database. If MongoDB is desired, please use
+ * `models.mongo.ProfileMongo` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class ProfileSQL extends BaseEntity implements Profile {
+    avatar?: string;
+    birthdate?: Date;
+    contacts: Contact[];
+    givenName?: string;
+    familyName?: string;
+    preferences: Preferences;
+    constructor(other?: Partial<ProfileSQL>);
+}

package/dist/types/models/sql/SecretSQL.d.ts

@@ -0,0 +1,14 @@
+import { BaseEntity } from "@rapidrest/service-core";
+import { Secret, SecretType } from "../types.js";
+/**
+ * Implementation of the `Secret` interface for storage in a SQL database. If MongoDB is desired, please use
+ * `models.mongo.SecretMongo` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class SecretSQL extends BaseEntity implements Secret {
+    data: any;
+    type: SecretType;
+    userUid: string;
+    constructor(other?: Partial<SecretSQL>);
+}

package/dist/types/models/sql/UserSQL.d.ts

@@ -0,0 +1,14 @@
+import { BaseEntity } from "@rapidrest/service-core";
+import { User } from "../types.js";
+/**
+ * Implementation of the `User` interface for storage in a SQLDB database. If MongoDB is desired, please use
+ * `models.mongo.UserMongo` instead.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class UserSQL extends BaseEntity implements User {
+    roles: string[];
+    scopes: string[];
+    verified: boolean;
+    constructor(other?: Partial<UserSQL>);
+}

package/dist/types/models/sql/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./AliasSQL.js";
+export * from "./ProfileSQL.js";
+export * from "./SecretSQL.js";
+export * from "./UserSQL.js";

package/dist/types/models/sql.d.ts

@@ -0,0 +1 @@
+export * from "./sql/index.js";

package/dist/types/models/types.d.ts

@@ -0,0 +1,136 @@
+import { JWTUser } from "@rapidrest/core";
+import { BaseEntity } from "@rapidrest/service-core";
+/**
+ * @author Jean-Philippe Steinmetz
+ */
+export declare class AuthResult {
+    readonly token: string;
+    readonly user: User;
+    constructor(other: any);
+}
+/**
+ *
+ */
+export declare enum AliasType {
+    EMAIL = "email",
+    NAME = "name",
+    OAUTH = "oauth",
+    PHONE = "phone"
+}
+/**
+ * Defines an alternative unique identifier for a single user account.
+ */
+export interface Alias extends BaseEntity {
+    /** The alias to uniquely identify a specific user account. */
+    alias: string;
+    /** The type of data that the alias represents (e.g. email, phone, name). */
+    type: AliasType;
+    /** The unique identifier of the user account associated with this alias. */
+    userUid: string;
+    /** Indicates if this alias has been verified. */
+    verified: boolean;
+}
+export declare enum ContactType {
+    EMAIL = "email",
+    PHONE = "phone"
+}
+/**
+ * Defines a single contact for a giiven user account. Contacts are stored in a user's
+ * `Profile`.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export interface Contact {
+    /** The contact information of a specific kind (e.g. email, phone number, etc.). */
+    contact: string;
+    /** The type of contact information represented (e.g. email, phone). */
+    type: ContactType;
+    /** Indicates if the contact information has been verified. */
+    verified: boolean;
+}
+/**
+ * Defines the set of preferences for a given user account. Preferences are stored in a user's
+ * `Profile`.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export interface Preferences {
+    /** The list of contact preferences for the user (e.g. 'all', 'marketing', 'system'). */
+    contact: string[];
+}
+/**
+ * Defines available contact methods and preferences for a given user. Requires the `profile` scope to read.
+ *
+ * Note that the `uid` must be the same `uid` as the associated `User` record.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export interface Profile extends BaseEntity {
+    /**
+     * The URL or path to the user's avatar image (e.g. gravatar).
+     */
+    avatar?: string;
+    /**
+     * The user's date of birth.
+     */
+    birthdate?: Date;
+    /**
+     * The list of the user's contacts.
+     */
+    contacts: Contact[];
+    /**
+     * The user's given name (aka: first name).
+     */
+    givenName?: string;
+    /**
+     * The user's family surname (or last name).
+     */
+    familyName?: string;
+    /**
+     * The user's account preferences.
+     */
+    preferences: Preferences;
+}
+/**
+ *
+ */
+export declare enum SecretType {
+    FIDO2 = "fido2",
+    PASSKEY = "passkey",
+    PASSWORD = "password",
+    TOTP = "totp"
+}
+/**
+ * Describes a single authentication secret associated with a specific user account. A secret is used
+ * to authenticate the user with the system.
+ *
+ * Supported types of secrets:
+ * * `fido2`
+ * * `openid`
+ * * `password`
+ * * `passkey`
+ * * `totp`
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export interface Secret extends BaseEntity {
+    /**
+     * The data associated with the secret.
+     */
+    data: any;
+    /**
+     * The type of secret (e.g. `fido2`, `openid`, `password`, `passkey`, `totp`)
+     */
+    type: SecretType;
+    /**
+     * The unique identifier of the user account this secret is associated with.
+     */
+    userUid: string;
+}
+/**
+ * Defines a single user's account within the system.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export interface User extends BaseEntity, JWTUser {
+}

package/dist/types/mongo.d.ts

@@ -0,0 +1,2 @@
+export * from "./models/mongo.js";
+export * from "./routes/mongo.js";

package/dist/types/routes/BaseAliasRoute.d.ts

@@ -0,0 +1,7 @@
+import { CRUDRoute } from "@rapidrest/service-core";
+import { Alias } from "../models/types.js";
+/**
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAliasRoute<T extends Alias> extends CRUDRoute<T> {
+}

package/dist/types/routes/BaseAuthBasicRoute.d.ts

@@ -0,0 +1,27 @@
+import { JWTUser } from "@rapidrest/core";
+import { RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { Alias, AuthResult, Secret, User } from "../models/types.js";
+import { UserUtils } from "./UserUtils.js";
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAuthBasicRoute<U extends User, S extends Secret, A extends Alias> {
+    protected abstract aliasClass: any;
+    protected abstract secretClass: any;
+    protected abstract userClass: any;
+    protected authMiddleware?: AuthMiddleware;
+    protected jwtConfig?: any;
+    protected objectFactory?: ObjectFactory;
+    protected secretRepo?: RepoUtils<S>;
+    protected userUtils?: UserUtils<U, A>;
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    protected initialize(): Promise<void>;
+    /**
+     * Authenticates the user using HTTP Basic and returns a JSON Web Token access token to be used with future API requests.
+     */
+    authenticate(user: JWTUser): Promise<AuthResult | undefined>;
+}

package/dist/types/routes/BaseAuthFIDO2Route.d.ts

@@ -0,0 +1,50 @@
+import { JWTUser, MessagingUtils } from "@rapidrest/core";
+import { RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { Alias, AuthResult, Secret, User } from "../models/types.js";
+import { PasskeyConfig, StoredPasskeyCredential } from "../auth/types.js";
+import { UserUtils } from "./UserUtils.js";
+/**
+ * Authenticates users via a registered FIDO2 hardware security key (e.g. a YubiKey) using
+ * WebAuthn/CTAP2. See `BaseAuthPasskeyRoute` for the software/synced-credential ("Passkey")
+ * counterpart of this route — both share the same underlying WebAuthn ceremony, but look up
+ * credentials stored as `SecretType.FIDO2` rather than `SecretType.PASSKEY`.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAuthFIDO2Route<U extends User, A extends Alias, S extends Secret> {
+    protected abstract aliasClass: any;
+    protected abstract secretClass: any;
+    protected abstract userClass: any;
+    protected aliasRepo?: RepoUtils<A>;
+    protected authMiddleware?: AuthMiddleware;
+    protected jwtConfig?: any;
+    protected objectFactory?: ObjectFactory;
+    protected messagingUtils?: MessagingUtils;
+    protected secretRepo?: RepoUtils<S>;
+    /**
+     * The relying party configuration to use for this FIDO2 strategy. Kept separate from the Passkey
+     * strategy's configuration since a hardware key deployment commonly wants a different
+     * `authenticatorAttachment`/`residentKey` policy (see `BaseSecretRoute.fido2Config`).
+     */
+    protected fido2Config: PasskeyConfig;
+    protected userRepo?: RepoUtils<U>;
+    protected userUtils?: UserUtils<U, A>;
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    protected initialize(): Promise<void>;
+    /**
+     * Authenticates the user using a FIDO2 hardware security key and returns a JSON Web Token access
+     * token to be used with future API requests.
+     */
+    authenticate(user: JWTUser): Promise<AuthResult | undefined>;
+    protected getCredentialById(credentialId: string): Promise<StoredPasskeyCredential | undefined>;
+    protected getCredentials(id: string): Promise<StoredPasskeyCredential[]>;
+    /**
+     * Retrieve the user associated with a given uid or alias.
+     *
+     * @param id The unqique id of the user or alias to lookup.
+     */
+    protected getUser(id: string): Promise<JWTUser | undefined>;
+    protected updateCredentialCounter(credentialId: string, newCounter: number): Promise<void>;
+}

package/dist/types/routes/BaseAuthMFARoute.d.ts

@@ -0,0 +1,61 @@
+import { JWTUser, MessagingUtils } from "@rapidrest/core";
+import { RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { Alias, AliasType, AuthResult, Secret, User } from "../models/types.js";
+import { MFAMethod } from "../auth/MFAStrategy.js";
+import { OTPContact } from "../auth/types.js";
+import { UserUtils } from "./UserUtils.js";
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAuthMFARoute<U extends User, S extends Secret, A extends Alias> {
+    protected abstract aliasClass: any;
+    protected abstract secretClass: any;
+    protected abstract userClass: any;
+    protected aliasRepo?: RepoUtils<A>;
+    protected authMiddleware?: AuthMiddleware;
+    protected jwtConfig?: any;
+    protected objectFactory?: ObjectFactory;
+    protected messagingUtils?: MessagingUtils;
+    protected secretRepo?: RepoUtils<S>;
+    /** The name of the messaging template to use for sending notifications. */
+    protected template: string;
+    protected userRepo?: RepoUtils<U>;
+    protected userUtils?: UserUtils<U, A>;
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    protected initialize(): Promise<void>;
+    /**
+     * Authenticates the user using HTTP MFA and returns a JSON Web Token access token to be used with future API requests.
+     */
+    authenticate(user: JWTUser): Promise<AuthResult | undefined>;
+    protected convertAliasToMethod(alias: Alias, obfuscate?: boolean): MFAMethod | undefined;
+    protected convertSecretToMethod(secret: S): MFAMethod | undefined;
+    /**
+     * Retrieves the user's secondary authentication method for a given id.
+     * @param id The unique id of the secondary auth method to retrieve.
+     */
+    protected getMethod(id: string): Promise<MFAMethod | undefined>;
+    /**
+     * Retrieves the list of secondary authentication methods for the user with the given id. This list is sent to
+     * the user and so should be obfuscated where reasonable so as to limit discovery when a password has been
+     * compromised.
+     * @param uid The unique identifier of the user.
+     */
+    protected getMethods(uid: string): Promise<MFAMethod[]>;
+    /**
+     * Retrieves the user with the given unique id.
+     * @param uid The unique id of the user to retrieve.
+     * @returns The user if found, otherwise `undefined`.
+     */
+    protected getUser(uid: string): Promise<JWTUser | undefined>;
+    protected notifyContact(contact: OTPContact, totp: string): Promise<void>;
+    /**
+     * Obfuscates the given alias and returns the obfuscated value.
+     * @param contact The contact to obfuscate.
+     */
+    protected obfuscateAlias(alias: string, type: AliasType): string;
+    protected verify(name: string, password: string): Promise<JWTUser | undefined>;
+}

package/dist/types/routes/BaseAuthOIDCRoute.d.ts

@@ -0,0 +1,33 @@
+import "reflect-metadata";
+import { JWTUser, MessagingUtils } from "@rapidrest/core";
+import { RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { Alias, AuthResult, Profile, User } from "../models/types.js";
+import { OIDCProvider } from "../auth/OIDCStrategy.js";
+import { UserUtils } from "./UserUtils.js";
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAuthOIDCRoute<U extends User, A extends Alias, P extends Profile> {
+    protected abstract aliasClass: any;
+    protected abstract profileClass: any;
+    protected abstract userClass: any;
+    protected aliasRepo?: RepoUtils<A>;
+    protected authMiddleware?: AuthMiddleware;
+    protected jwtConfig?: any;
+    protected objectFactory?: ObjectFactory;
+    protected messagingUtils?: MessagingUtils;
+    protected profileRepo?: RepoUtils<P>;
+    protected abstract providerConfig: OIDCProvider;
+    protected userRepo?: RepoUtils<U>;
+    protected userUtils?: UserUtils<U, A>;
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    private initialize;
+    /**
+     * Authenticates the user using OIDC and returns a JSON Web Token access token to be used with future API requests.
+     */
+    login(user: JWTUser): Promise<AuthResult | undefined>;
+}

package/dist/types/routes/BaseAuthOTPRoute.d.ts

@@ -0,0 +1,53 @@
+import { JWTUser, MessagingUtils } from "@rapidrest/core";
+import { RepoUtils, AuthMiddleware, ObjectFactory } from "@rapidrest/service-core";
+import { Alias, AliasType, AuthResult, Secret, User } from "../models/types.js";
+import { OTPContact, OTPContactType } from "../auth/types.js";
+import { UserUtils } from "./UserUtils.js";
+/**
+ *
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export declare abstract class BaseAuthOTPRoute<U extends User, A extends Alias, S extends Secret> {
+    protected abstract aliasClass: any;
+    protected abstract secretClass: any;
+    protected abstract userClass: any;
+    protected aliasRepo?: RepoUtils<A>;
+    protected authMiddleware?: AuthMiddleware;
+    protected jwtConfig?: any;
+    protected objectFactory?: ObjectFactory;
+    protected messagingUtils?: MessagingUtils;
+    protected secretRepo?: RepoUtils<S>;
+    /** The name of the messaging template to use for sending notifications. */
+    protected template: string;
+    protected userRepo?: RepoUtils<U>;
+    protected userUtils?: UserUtils<U, A>;
+    /**
+     * Called on server startup to initialize the route with any defaults.
+     */
+    protected initialize(): Promise<void>;
+    /**
+     * Authenticates the user using OTP and returns a JSON Web Token access token to be used with future API requests.
+     */
+    authenticate(user: JWTUser): Promise<AuthResult | undefined>;
+    protected convertAliasType(type: AliasType): OTPContactType;
+    /**
+     * Retrieves the alias with the given unique id.
+     * @param id The unique id of the alias to retrieve.
+     * @returns The alias if found, otherwise `undefined`.
+     */
+    protected getContact(id: string): Promise<OTPContact | undefined>;
+    /**
+     * Retrieves all aliases for the user with the given id.
+     *
+     * @param id The unique id of the user to lookup.
+     */
+    protected getContacts(id: string): Promise<OTPContact[]>;
+    /**
+     * Retrieves the user with the given unique id.
+     * @param uid The unique id of the user to retrieve.
+     * @returns The user if found, otherwise `undefined`.
+     */
+    protected getUser(uid: string): Promise<JWTUser | undefined>;
+    protected notifyContact(contact: OTPContact, totp: string): Promise<void>;
+}