import type { Express, Request, Response } from 'express';
import type { OnboardingService } from '../services/onboarding/onboarding-service.js';
import type { OwoxTokenFacade } from '../facades/owox-token-facade.js';
/**
 * Handles onboarding questionnaire pages and submissions.
 */
export declare class OnboardingController {
    private readonly onboardingService;
    private readonly tokenFacade;
    private readonly gtmContainerId?;
    private readonly logger;
    constructor(onboardingService: OnboardingService, tokenFacade: OwoxTokenFacade, gtmContainerId?: string | undefined);
    /**
     * GET /auth/onboarding — renders the questionnaire page.
     * Requires a valid refreshToken cookie and the user must meet onboarding criteria.
     * View-only sessions are redirected home (they cannot submit answers).
     */
    onboardingPage(req: Request, res: Response): Promise<void>;
    /**
     * POST /auth/onboarding — saves answers and returns redirect URL.
     * Express route (outside Nest IdpGuard) — enforces view-only here.
     */
    submitAnswers(req: Request, res: Response): Promise<void>;
    /**
     * Checks whether the user is eligible for onboarding via OnboardingService.shouldShowQuestionnaire.
     * Returns false on any error (fail-safe: don't block the user).
     */
    private isEligible;
    /**
     * Resolves userId, projectId, biUserId, role, and viewOnly from the refresh token cookie.
     * Refreshes the token and updates the cookie following the standard auth pattern.
     */
    private resolveUserContext;
    /**
     * Validates redirect is a safe relative path. Returns '/' for any suspicious value.
     */
    private sanitizeRedirect;
    registerRoutes(app: Express): void;
}
//# sourceMappingURL=onboarding-controller.d.ts.map