/**
 * Dual Authentication System
 *
 * Supports both API Key and Session authentication in a single endpoint.
 * Used by the unified /api/v1/ endpoints.
 */
import { NextRequest, NextResponse } from 'next/server';
/**
 * System Admin Team - Members can bypass team context validation
 * This team is created in core/migrations/090_sample_data.sql
 */
export declare const SYSTEM_ADMIN_TEAM_ID = "team-nextspark-001";
/**
 * Header required to confirm cross-team access intention
 */
export declare const ADMIN_BYPASS_HEADER = "x-admin-bypass";
export declare const ADMIN_BYPASS_VALUE = "confirm-cross-team-access";
/**
 * Development-only override header: a developer caller can resolve the request
 * AS a different user by sending `x-act-as-user: <userId>`. Useful for
 * exercising session-scoped ("me"/personal) endpoints as any user without
 * switching sessions. Strictly non-production and developer-role gated (see
 * applyActAsOverride). Core-level and theme-agnostic — every endpoint that
 * authenticates via authenticateRequest honors it.
 */
export declare const ACT_AS_USER_HEADER = "x-act-as-user";
export interface DualAuthUser {
    id: string;
    email: string;
    role: string;
    name?: string;
    defaultTeamId?: string;
}
export interface DualAuthResult {
    success: boolean;
    type: 'api-key' | 'session' | 'none';
    user: DualAuthUser | null;
    scopes?: string[];
    rateLimitResponse?: Response;
    /** Set when a dev-only x-act-as-user override replaced the real caller. */
    actingAs?: {
        originalUserId: string;
        originalRole: string;
    };
}
/**
 * Try to authenticate request using either API Key or Session
 */
export declare function authenticateRequest(request: NextRequest): Promise<DualAuthResult>;
/**
 * Check if user has required scope (for API Key auth)
 */
export declare function hasRequiredScope(authResult: DualAuthResult, requiredScope: string): boolean;
/**
 * Resolve and validate team context from request.
 *
 * Resolution priority: x-team-id header > activeTeamId cookie > user's defaultTeamId
 *
 * Returns the validated teamId string on success, or a NextResponse error if:
 * - No team context can be resolved (400)
 * - User is not a member of the resolved team (403)
 *
 * @example
 * const teamResult = await resolveTeamContext(request, authResult)
 * if (teamResult instanceof NextResponse) return teamResult
 * const teamId = teamResult
 */
export declare function resolveTeamContext(request: NextRequest, authResult: DualAuthResult): Promise<string | NextResponse>;
/**
 * Check if user can bypass team context validation
 *
 * Three-layer security model:
 * 1. User must have elevated role (superadmin/developer)
 * 2. Request must include confirmation header (x-admin-bypass)
 * 3. User must be member of System Admin Team (NextSpark Team)
 *
 * @returns true if all conditions are met
 */
export declare function canBypassTeamContext(authResult: DualAuthResult, request: NextRequest): Promise<boolean>;
/**
 * Create standardized auth error response
 */
export declare function createAuthError(message?: string, status?: number): NextResponse<{
    success: boolean;
    error: string;
    code: string;
}>;
//# sourceMappingURL=dual-auth.d.ts.map