/**
 * Authentication utilities for Baasix
 * New implementation using the adapter-based auth module
 * Provides backward compatibility with existing exports
 */
import type { JWTPayload, UserWithRolesAndPermissions } from '../types/index.js';
export type { JWTPayload, UserWithRolesAndPermissions };
/**
 * The only JWT algorithm Baasix issues and accepts. Pinning this on every
 * jwt.verify() prevents algorithm-confusion attacks (e.g. `alg:none`, or forging
 * an HS256 token using a public key if the secret were ever asymmetric).
 */
export declare const JWT_ALGORITHM: "HS256";
/** Recommended minimum length for the JWT signing secret. */
export declare const MIN_SECRET_LENGTH = 32;
/**
 * Get the configured JWT secret.
 *
 * Hard requirement: the secret must be present. A missing/empty secret makes every
 * token trivially forgeable, so we always refuse to sign/verify without one.
 *
 * Secret *strength* (length) is NOT enforced here — that is only a recommendation
 * and is surfaced once at startup via validateAuthSecretAtStartup(). This keeps an
 * existing deployment that runs a shorter key working (rather than crashing on the
 * next restart), while still nudging operators to rotate to a stronger secret.
 */
export declare function getJwtSecret(): string;
/**
 * One-time startup validation of the JWT secret. Call this once during server
 * boot (NOT per request). Logs a prominent warning when the secret is shorter than
 * the recommended length so operators can plan a rotation, without breaking a
 * running production system.
 */
export declare function validateAuthSecretAtStartup(): void;
/**
 * Helper function to get and cache roles and permissions
 * Uses PermissionService for role data (cached in memory) and Redis cache for permissions
 */
export declare function getRolesAndPermissions(roleId: string | number): Promise<{
    id: string | number;
    name: string;
    description?: string;
    isTenantSpecific?: boolean;
    permissions: Record<string, {
        action: string;
        collection: string;
        fields?: any;
        conditions?: any;
    }>;
}>;
/**
 * Verify JWT token and return decoded payload
 */
export declare function verifyJWT(token: string): any;
/**
 * Get user with roles, permissions, and tenant information
 */
export declare function getUserRolesPermissionsAndTenant(userId: string | number, tenantId?: string | number | null): Promise<{
    role: {
        id: string | number;
        name: string;
        description?: string;
        isTenantSpecific?: boolean;
    };
    permissions: any;
    tenant?: any;
}>;
/**
 * Generate JWT token for user
 */
export declare function generateJWT(payload: Record<string, any>, expiresIn?: string | number): string;
/**
 * Extract token from Authorization header
 */
export declare function extractTokenFromHeader(authHeader: string | undefined): string | null;
/**
 * Get the public role (from PermissionService hybrid cache)
 * Returns the public role with its ID, or a fallback if not found
 */
export declare function getPublicRole(): Promise<{
    id: string | number | null;
    name: string;
}>;
/**
 * Authentication middleware for Express
 * Verifies JWT token and sets req.accountability
 */
export declare const authMiddleware: (req: any, res: any, next: any) => Promise<any>;
/**
 * Helper function to check if user is an administrator
 */
export declare const isAdmin: (req: any) => boolean;
/**
 * Middleware to check for admin access
 */
export declare const adminOnly: (req: any, res: any, next: any) => any;
/**
 * Create a session in the database
 */
export declare function createSession(user: any, expiresInSeconds: number, sessionType?: string, tenantId?: string | null): Promise<string>;
/**
 * Validate a session token
 */
export declare function validateSession(token: string, expectedTenantId?: string | null): Promise<{
    session: any;
    user: any;
} | null>;
/**
 * Validate session limits for a user
 */
export declare function validateSessionLimits(userId: string, sessionType: string, tenantId?: string | null, role?: {
    id: string | number;
    name: string;
} | null): Promise<{
    isValid: boolean;
    error?: string;
}>;
/**
 * Generate token with session creation
 */
export declare function generateToken(user: any, role: any, tenant?: any, ip?: string | null, sessionType?: string): Promise<string>;
export default authMiddleware;
//# sourceMappingURL=auth.d.ts.map