/**
 * Dashboard auth gate.
 *
 * Wraps a route handler with the two-step auth check used by every
 * `/api/dashboard/*` endpoint except `/auth/login`:
 *
 *   1. Resolve a session: either an `Authorization: Bearer <token>`
 *      (verify against the active workspace's token hashes; on success
 *      mint a `dash_<uuid>` session) OR an existing `cortex_dash_sid`
 *      cookie (look up by id).
 *   2. Enforce CSRF + scope: every mutating method requires the
 *      `X-Cortex-Dashboard: 1` header; the resolved session's scopes
 *      must be a superset of `allowed`.
 *
 * The gate returns the resolved session on success or `null` after
 * writing a 401/403 response — handlers should early-return in both
 * cases. Bearer auth is intentionally accepted on every request, not
 * just login: pure-CLI clients (curl, agents) can hit the read API
 * without a cookie. The CSRF header still gates writes, so a
 * cross-site form post stays harmless.
 */
import type { IncomingMessage, ServerResponse } from "node:http";
import { evictDashboardSession, type SessionState } from "../../session-context.js";
export type DashboardScope = "read" | "ingest" | "admin";
declare const COOKIE_NAME = "cortex_dash_sid";
declare const COOKIE_TTL_SEC: number;
declare const CSRF_HEADER = "x-cortex-dashboard";
export interface DashboardAuthSuccess {
    sessionId: string;
    session: SessionState;
}
export interface DashboardAuthDeps {
    /** Override workspace resolution — tests inject a fixed workspace. */
    resolveWorkspace?: () => Promise<{
        slug: string;
        envPath: string;
    } | undefined>;
}
/**
 * Resolve a session id + state without enforcing scope/CSRF. Used by
 * `/api/dashboard/auth/login` (which has its own response shape) and
 * indirectly by the public middleware factory below.
 *
 * On a successful bearer match, the function mints a fresh `dash_<uuid>`
 * id and records the session via `setDashboardSession`. The caller is
 * responsible for writing the `Set-Cookie` header — different routes
 * surface that differently (login returns JSON, the middleware sets it
 * on whatever response the handler writes).
 */
export declare function resolveDashboardSession(req: IncomingMessage, deps?: DashboardAuthDeps): Promise<DashboardAuthSuccess | null>;
/**
 * Render a Set-Cookie header value for the dashboard session id.
 *
 * `__Host-` prefix is intentionally avoided — the brief specifies
 * `cortex_dash_sid` as a plain name so the cookie also works on
 * the http://localhost dev path where Secure cannot be set. We do
 * stamp `Secure` whenever the request actually arrived over TLS.
 */
export declare function buildSessionCookie(req: IncomingMessage, sessionId: string): string;
/** Cookie value used to clear the session on logout. */
export declare function buildClearCookie(req: IncomingMessage): string;
/**
 * Factory: build a gate keyed to a required scope set. Usage:
 *
 *   const gate = requireDashboardAuth(["admin"]);
 *   const ok = await gate(req, res);
 *   if (!ok) return;
 *
 * On a fresh bearer-issued session the gate also attaches the new
 * `Set-Cookie` to the response so the next request can ride the
 * cookie instead of re-presenting the bearer.
 */
export declare function requireDashboardAuth(allowed: ReadonlyArray<DashboardScope>, deps?: DashboardAuthDeps): (req: IncomingMessage, res: ServerResponse) => Promise<DashboardAuthSuccess | null>;
declare function readBearer(req: IncomingMessage): string | undefined;
declare function readCookie(req: IncomingMessage, name: string): string | undefined;
export { COOKIE_NAME, COOKIE_TTL_SEC, CSRF_HEADER, evictDashboardSession, readBearer, readCookie, };
//# sourceMappingURL=require-dashboard-auth.d.ts.map