import './assert_dev_env.js';
import type { SessionOptions } from '../auth/session_cookie.js';
import type { AppServerContext } from '../server/app_server.js';
import type { RouteSpec } from '../http/route_spec.js';
import { type SuiteAppOptions } from './app_server.js';
import { type DbFactory } from './db.js';
import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
/**
 * Configuration for `describe_rate_limiting_tests`.
 */
export interface RateLimitingTestOptions {
    /** Session config for cookie-based auth. */
    session_options: SessionOptions<string>;
    /** Route spec factory — same one used in production. */
    create_route_specs: (ctx: AppServerContext) => Array<RouteSpec>;
    /** Optional overrides for `AppServerOptions`. */
    app_options?: SuiteAppOptions;
    /**
     * Database factories to run tests against. Default: pglite only.
     */
    db_factories?: Array<DbFactory>;
    /**
     * Maximum attempts before rate limiting kicks in.
     * Default: `2` (tight limit for fast tests).
     */
    max_attempts?: number;
    /**
     * RPC endpoint specs — required so the bearer-auth rate limiting test
     * can probe an authenticated method via the `account_verify` RPC
     * action. Hard-fails via `require_rpc_endpoint_path` on setup.
     *
     * Accepts either an array (eager) or a factory
     * `(ctx: AppServerContext) => Array<RpcEndpointSpec>` — the factory form
     * is required when action handlers must close over the per-test
     * `ctx.deps`. The factory must return the same
     * endpoint `path` regardless of ctx — it is invoked once at setup with
     * a stub ctx for path lookup and again per-test by `create_app_server`
     * for live dispatch.
     */
    rpc_endpoints: RpcEndpointsSuiteOption;
}
/**
 * Standard rate limiting integration test suite.
 *
 * Creates 3 test groups:
 * 1. IP rate limiting on login — fires `max_attempts + 1` login requests,
 *    verifies the last returns 429 with a valid `RateLimitError` body.
 * 2. Per-account rate limiting on login — fires `max_attempts + 1` login
 *    requests with the same username, verifies the last returns 429.
 * 3. Bearer auth IP rate limiting — fires `max_attempts + 1` bearer requests
 *    with an invalid token, verifies the last returns 429.
 *
 * Each test group asserts that required routes exist, failing with a descriptive
 * message if the consumer's route specs are misconfigured.
 *
 * @throws Error at setup time when `options.rpc_endpoints` is empty — the
 *   bearer-auth rate-limit test probes via the `account_verify` RPC action,
 *   so the suite hard-fails via `require_rpc_endpoint_path`.
 */
export declare const describe_rate_limiting_tests: (options: RateLimitingTestOptions) => void;
//# sourceMappingURL=rate_limiting.d.ts.map