import type { AppRequest, AppResponse, MiddlewareHandler } from '@rudderjs/contracts';
import type { PasswordBroker } from './password-reset.js';
/** Minimal surface the controller needs from a user Model. */
export interface AuthUserModelLike {
    query(): {
        where(field: string, value: unknown): {
            first(): Promise<unknown>;
        };
    };
    create(attrs: Record<string, unknown>): Promise<Record<string, unknown>>;
    update(id: string | number, attrs: Record<string, unknown>): Promise<unknown>;
}
/** Minimal surface matching the `Hash` facade from @rudderjs/hash. */
export interface AuthHashLike {
    make(plain: string): Promise<string>;
    check(plain: string, hashed: string): Promise<boolean>;
}
/** Per-method rate-limit middleware applied to `BaseAuthController` POST handlers. */
export interface AuthRateLimits {
    signIn?: MiddlewareHandler | null;
    signUp?: MiddlewareHandler | null;
    requestPasswordReset?: MiddlewareHandler | null;
}
export declare const DEFAULT_AUTH_RATE_LIMITS: Readonly<Required<AuthRateLimits>>;
/**
 * Laravel Breeze-style auth controller — subclass it and set `userModel` +
 * `hash` to get the five POST handlers wired to `/auth/*`.
 *
 * The controller is mounted under `/auth/*` (not `/api/auth/*`) because
 * session-based auth lives on the `web` group, matching Laravel's `/login`
 * convention. The `/api/*` namespace is reserved for token-based API auth
 * (Sanctum / Passport bearer routes).
 *
 * **Default rate-limits** apply to `signIn` / `signUp` / `requestPasswordReset`
 * out of the box (see {@link DEFAULT_AUTH_RATE_LIMITS}). Override per-method
 * via the static `rateLimits` field on the subclass — or set it to `{}` to
 * disable entirely (e.g. internal admin panels behind VPN auth):
 *
 * ```ts
 * import { RateLimit } from '@rudderjs/middleware'
 * import { BaseAuthController } from '@rudderjs/auth'
 *
 * export class AuthController extends BaseAuthController {
 *   protected userModel = User
 *   protected hash      = Hash
 *
 *   // Tighten one method, accept defaults for the rest.
 *   static override rateLimits = {
 *     ...DEFAULT_AUTH_RATE_LIMITS,
 *     signIn: RateLimit.perMinute(3).message('Too many login attempts.'),
 *   }
 * }
 * ```
 *
 * Then in `routes/web.ts`:
 *
 * ```ts
 * import { AuthController } from '../app/Controllers/AuthController.js'
 * Route.registerController(AuthController)
 * ```
 *
 * Routes must be registered from the `web` group (`routes/web.ts`) so
 * `AuthMiddleware` + `SessionMiddleware` auto-install and `Auth.attempt/login`
 * can read and write the session.
 */
export declare abstract class BaseAuthController {
    protected abstract userModel: AuthUserModelLike;
    protected abstract hash: AuthHashLike;
    /** Optional — set to enable `/request-password-reset` + `/reset-password`. */
    protected passwordBroker?: PasswordBroker;
    /**
     * Per-method rate-limit middleware. Defaults to {@link DEFAULT_AUTH_RATE_LIMITS}
     * (credential-stuffing + email-flood protection). Override on the subclass
     * to tighten / loosen individual methods, or set to `{}` to disable entirely.
     *
     * Read once when the controller's first instance is constructed (i.e. when
     * `Route.registerController()` runs). Mutating after registration has no
     * effect — re-mount the controller on a fresh `Router` if needed.
     */
    static rateLimits: AuthRateLimits;
    constructor();
    signIn(req: AppRequest, res: AppResponse): Promise<void>;
    signUp(req: AppRequest, res: AppResponse): Promise<void>;
    signOut(_req: AppRequest, res: AppResponse): Promise<void>;
    requestPasswordReset(req: AppRequest, res: AppResponse): Promise<void>;
    resetPassword(req: AppRequest, res: AppResponse): Promise<void>;
    /**
     * Override to send the reset-link email via your mail system. Default
     * writes to stdout so the scaffolded flow is testable without a mailer.
     */
    protected sendResetEmail(email: string, token: string): Promise<void>;
}
//# sourceMappingURL=base-auth-controller.d.ts.map