import { type Context, type Guard } from './http';
/**
 * The authenticated principal for the current request.
 *
 * Intentionally empty — augment it in your app to describe your user:
 *
 * ```ts
 * declare module "turnover/auth" {
 *   interface Principal { id: string; roles: string[] }
 * }
 * ```
 */
export interface Principal {
}
/**
 * Request-scoped auth accessor.
 *
 * It's a singleton, but every getter reads the *current* request's principal
 * from AsyncLocalStorage — so injecting it into a singleton controller still
 * yields per-request data.
 */
export declare class Auth {
    /**
     * The current request's principal, or throw a bare `401` `Response` (which
     * passes through the pipeline unchanged) when unauthenticated. Use
     * {@link Auth.optional} to branch instead of throw.
     */
    get user(): Principal;
    /** The current request's principal, or `null` if unauthenticated; never throws, unlike {@link Auth.user}. */
    get optional(): Principal | null;
    /** Whether the current request carries a principal. */
    get isAuthenticated(): boolean;
}
/**
 * Guard rejecting with a bare `401` `Response` unless the request already
 * carries a principal — one set earlier by an `authentication()` scheme or a
 * guard calling `setPrincipal`. It only checks presence; use {@link requireRole}
 * / {@link requireScope} / {@link authorize} for claim or policy checks.
 */
export declare const requireAuth: Guard;
/**
 * Decorator (class or method): require an authenticated principal, else `401`.
 * Sugar for `@use(requireAuth)`.
 *
 * ```ts
 * @get('/me') @authenticated me() { return inject(Auth).user }
 * ```
 */
export declare const authenticated: (_value: unknown, context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
/**
 * Decorator (class or method): require the principal to hold at least one of
 * `roles` (on `principal.roles`), else `403` — or `401` if unauthenticated.
 *
 * ```ts
 * @controller('/admin') @requireRole('admin')
 * class Admin { @get('/') list() {} }
 * ```
 *
 * @param roles - claim values; the principal must hold at least one on `principal.roles`
 * @returns a class/method guard decorator that enforces the role check
 */
export declare function requireRole(...roles: string[]): (_value: unknown, context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
/**
 * Like {@link requireRole}, but checks `principal.scopes`.
 *
 * @param scopes - claim values; the principal must hold at least one on `principal.scopes`
 * @returns a class/method guard decorator that enforces the scope check
 */
export declare function requireScope(...scopes: string[]): (_value: unknown, context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
/**
 * Decorator (class or method): allow the request only when `policy` returns
 * truthy for the current principal — the generic escape hatch for ownership,
 * tenancy, or any custom rule. `401` if unauthenticated, `403` if it rejects.
 *
 * ```ts
 * @del('/:id') @authorize((user, ctx) => user.id === ctx.params.id)
 * remove() {}
 * ```
 *
 * @param policy - predicate over the current principal and request context; truthy allows the request
 * @returns a class/method guard decorator that enforces the policy
 */
export declare function authorize(policy: (principal: Principal, ctx: Context) => boolean | Promise<boolean>): (_value: unknown, context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
//# sourceMappingURL=auth.d.ts.map