/**
 * `/api/dashboard/auth/*` — sign-in, sign-out, whoami for the browser
 * dashboard. The login route is the only one in the entire
 * `/api/dashboard/*` namespace that runs BEFORE the `apiAuthOk` gate
 * in `server.ts`; everything else gates through `requireDashboardAuth`.
 *
 * Surface:
 *   POST /api/dashboard/auth/login   { token } → 200 { ok, workspace, scopes }
 *                                                + Set-Cookie cortex_dash_sid
 *   POST /api/dashboard/auth/logout                 → 200 { ok: true }
 *   GET  /api/dashboard/auth/whoami                 → 200 { workspace, scopes, tokenLabel }
 *
 * The login route enforces a simple per-IP rate limit (5 attempts per
 * 60s). Tracking is in-memory because this is a single-process node
 * server; a horizontal redeploy resets counters which is fine — the
 * limit exists to slow online brute-force, not to enforce a quota.
 */
import type { IncomingMessage, ServerResponse } from "node:http";
import type { RouteContext } from "../route-context.js";
/** Test seam — drops every bucket. Called by tests between cases. */
export declare function _resetRateLimit(): void;
/**
 * Public login handler. Designed to be invoked from server.ts BEFORE
 * the global `apiAuthOk` gate so it can issue a session without
 * needing a prior credential. Returns `true` when the URL matches.
 */
export declare function handleLogin(req: IncomingMessage, res: ServerResponse, logger?: {
    warn: (msg: string, extra?: Record<string, unknown>) => void;
}): Promise<boolean>;
/**
 * Logout + whoami live behind the standard auth gate so we get the
 * route-context plumbing for free. Login does NOT route through here
 * because the gate would reject an unauthenticated client before the
 * handler ever ran.
 */
export declare function handle(req: IncomingMessage, res: ServerResponse, ctx: RouteContext): Promise<boolean>;
//# sourceMappingURL=dashboard-auth.d.ts.map