export type QueuedashAuthMode = "session" | "basic";
export type QueuedashAuthOptions = {
    username: string;
    password: string;
    /**
     * `session` renders the Queuedash login screen and authenticates requests
     * with an HttpOnly cookie. `basic` keeps the browser-native Basic Auth
     * challenge. Defaults to `session`.
     */
    mode?: QueuedashAuthMode;
    session?: {
        /**
         * Shared signing secret for sessions that must survive restarts or work
         * across multiple application instances. A random process-local secret is
         * used when omitted.
         */
        secret?: string;
        /**
         * Session lifetime in seconds. Defaults to 12 hours.
         */
        ttlSeconds?: number;
        /**
         * Force the Secure cookie attribute on or off. By default it follows the
         * request protocol.
         */
        secure?: boolean;
    };
};
/** @deprecated Use QueuedashAuthOptions instead. */
export type QueueDashAuthOptions = QueuedashAuthOptions;
export type QueuedashPublicAuthConfig = {
    baseUrl: string;
};
export declare const QUEUEDASH_AUTH_CHALLENGE = "Basic realm=\"Queuedash\", charset=\"UTF-8\"";
export declare const QUEUEDASH_AUTH_REQUIRED_MESSAGE = "Authentication required";
export declare const QUEUEDASH_SESSION_COOKIE = "queuedash_session";
export declare const getQueuedashAuthMode: (auth: QueuedashAuthOptions | undefined) => QueuedashAuthMode | undefined;
/**
 * Checks `auth` once, when an adapter is created. Configuration read from
 * environment variables, JSON, or YAML is untyped: a mode of "Session" or a
 * numeric password would otherwise throw on every request instead, which is a
 * 500 on most frameworks and an unhandled rejection that ends the process on
 * Express 4.
 */
export declare const validateQueuedashAuthOptions: (auth: QueuedashAuthOptions | undefined) => QueuedashAuthMode | undefined;
export declare const isQueuedashBasicAuthorized: (authorization: string | null | undefined, auth: QueuedashAuthOptions | undefined) => boolean;
/** @deprecated Use isQueuedashBasicAuthorized instead. */
export declare const isQueueDashAuthorized: (authorization: string | null | undefined, auth: QueuedashAuthOptions | undefined) => boolean;
export declare const createQueuedashSessionToken: (auth: QueuedashAuthOptions, now?: number) => string;
export declare const isQueuedashSessionAuthorized: (cookieHeader: string | null | undefined, auth: QueuedashAuthOptions | undefined, now?: number) => boolean;
export declare const createQueuedashSessionCookie: ({ auth, baseUrl, requestIsSecure, }: {
    auth: QueuedashAuthOptions;
    baseUrl: string;
    requestIsSecure: boolean;
}) => string;
export declare const createQueuedashExpiredSessionCookie: (baseUrl: string) => string;
/**
 * What a request beneath the dashboard's base path is for. The adapters
 * classify requests here rather than in their own routers, so that all four
 * answer every path the same way.
 */
export type QueuedashRoute = "app" | "trpc" | "auth-session" | "auth-login" | "auth-logout" | "not-found";
/**
 * `path` is relative to the base path, such as "/trpc/queue.list". Nothing
 * under "/trpc" or "/auth" falls through to the dashboard shell.
 */
export declare const getQueuedashRoute: (method: string, path: string) => QueuedashRoute;
/** A response the adapter sends exactly as described. */
export type QueuedashResponse = {
    type: "respond";
    status: number;
    headers: Record<string, string>;
    body?: string;
};
export type QueuedashRequestDecision = 
/** Serve the dashboard's HTML shell. */
{
    type: "app";
}
/** Hand the request to tRPC and add `headers` to its response. */
 | {
    type: "trpc";
    headers: Record<string, string>;
} | QueuedashResponse;
/**
 * The one auth decision every adapter applies. Basic mode challenges every
 * path; session mode leaves the shell public so the login screen can render,
 * and requires a session for tRPC.
 */
export declare const resolveQueuedashRequest: (auth: QueuedashAuthOptions | undefined, request: {
    route: QueuedashRoute;
    method: string;
    authorization: string | null | undefined;
    cookie: string | null | undefined;
    contentType: string | null | undefined;
    /** The dashboard's full mount path, which scopes the session cookie. */
    baseUrl: string;
    isSecure: boolean;
}) => QueuedashRequestDecision;
export declare const createQueuedashUnauthorizedResponse: ({ challenge, }?: {
    challenge?: boolean;
}) => Response;
/** @deprecated Use createQueuedashUnauthorizedResponse instead. */
export declare const createQueueDashUnauthorizedResponse: () => Response;
/**
 * For a tRPC handler you serve yourself, such as a Next.js route: the 415 the
 * built-in adapters send for a POST that isn't application/json, or undefined
 * when the request can go on to tRPC. tRPC also runs mutations posted as
 * multipart/form-data, which a plain form on another website can send.
 */
export declare const rejectNonJsonPost: (request: Request) => Response | undefined;
//# sourceMappingURL=auth.d.ts.map