import { User } from '@stacksjs/orm';
/**
 * Decide whether a stored session must be rejected because its captured
 * fingerprint no longer matches the current request (basic hijack detection,
 * stacksjs/stacks#1985 — H-6 stored these fields but never compared them).
 *
 * OFF by default: a legitimately changing client IP (mobile/VPN) would
 * otherwise lock the real user out. Opt in via
 * `config.auth.session.enforceFingerprint` — `true` enforces both fields, or
 * `{ ip, userAgent }` enforces each independently (userAgent-only is the
 * safest, since it rarely changes for a real user).
 *
 * A field is compared ONLY when both the stored value and a current-request
 * value are present, so a check outside request scope, or a session logged in
 * without headers, is never a false "mismatch". On mismatch we reject THIS
 * request but leave the session row intact — the real owner (original
 * fingerprint) keeps working; we don't punish them for an attacker's attempt.
 */
export declare function fingerprintMismatch(enforce: boolean | { ip?: boolean, userAgent?: boolean } | undefined | null, stored: { ip?: unknown, userAgent?: unknown }, current: { ip: string | null, userAgent: string | null }): boolean;
/**
 * Authenticate a user via email and password, creating a session.
 * Sessions are persisted to the database so they survive server restarts.
 *
 * The `fingerprint` override is mainly for tests; in normal HTTP
 * handling the active request's IP + UA are captured automatically.
 */
export declare function sessionLogin(email: string, password: string, fingerprint?: { ip?: string | null, userAgent?: string | null }): Promise<{ user: UserModel, sessionId: string }>;
/**
 * Destroy the session for the given session ID.
 */
export declare function sessionLogout(sessionId: string): Promise<void>;
/**
 * Destroy every session for a user — the credential-change sweep.
 * Sessions are validated purely on row existence + `expires_at`, never
 * re-checked against the password hash, so without this a stolen
 * session cookie survives a password reset for up to 24h
 * (stacksjs/stacks#1947).
 *
 * Unlike `sessionLogout`, real failures propagate (fail loud): a reset
 * that reports success while the attacker's session lives would be a
 * lie. A missing `sessions` table alone is a benign no-op — no
 * framework migration creates it (only userland adopting session-auth
 * does), and without the table `sessionCheck` can never validate a
 * session, so there is no credential left to revoke.
 */
export declare function sessionDestroyAll(userId: number): Promise<void>;
/**
 * Get the authenticated user from a session ID.
 */
export declare function sessionUser(sessionId: string): Promise<UserModel | undefined>;
/**
 * Check if a session is authenticated.
 */
export declare function sessionCheck(sessionId: string): Promise<boolean>;
/**
 * Refresh a session's expiry time.
 */
export declare function sessionRefresh(sessionId: string, ttlMs?: unknown): Promise<boolean>;
export declare const SessionAuth: {
  login: unknown;
  logout: unknown;
  destroyAll: unknown;
  user: unknown;
  check: unknown;
  refresh: unknown
};
declare type UserModel = NonNullable<Awaited<ReturnType<typeof User.find>>>;