import type { StudioPublicUser, StudioUserRole } from "../shared/contracts.js";
export interface StudioUser {
    readonly id: string;
    readonly username: string;
    readonly password: string;
    readonly passwordResetRequired: boolean;
    readonly role: StudioUserRole;
    readonly disabled: boolean;
    readonly createdAt: string;
    readonly updatedAt: string;
}
export interface StudioSession {
    readonly userId: string;
    readonly issuedAt: number;
    readonly expiresAt: number;
}
export declare class AuthError extends Error {
    readonly status: 401 | 403;
    readonly code: string;
    constructor(status: 401 | 403, code: string, message: string);
}
export interface AuthRuntimeOptions {
    readonly dataRoot: string;
    readonly sessionSecret?: string;
    readonly publicUrl?: string;
}
export declare class AuthRuntime {
    readonly usersPath: string;
    private readonly secureCookie;
    private readonly sessionSecret;
    constructor(options: AuthRuntimeOptions);
    listUsers(): Promise<StudioUser[]>;
    createUser(args: {
        readonly username: string;
        readonly password: string;
        readonly role?: StudioUserRole;
        readonly passwordResetRequired?: boolean;
    }): Promise<StudioUser>;
    resetPassword(username: string, password: string): Promise<StudioUser>;
    setDisabled(username: string, disabled: boolean): Promise<StudioUser>;
    setRole(username: string, role: StudioUserRole): Promise<StudioUser>;
    login(username: string, password: string): Promise<{
        readonly user: StudioUser;
        readonly cookie: string;
    }>;
    changePassword(userId: string, currentPassword: string, newPassword: string): Promise<StudioUser>;
    authenticate(cookieHeader: string | null | undefined): Promise<StudioUser>;
    createLogoutCookie(): string;
    toPublicUser(user: StudioUser): StudioPublicUser;
    private findUserByUsername;
    private findUserById;
    private createSessionCookie;
    private signSession;
    private verifySessionToken;
    private readUsers;
    private writeUsers;
}
export declare function validateUsername(username: string): void;
export declare function validatePassword(password: string): void;
export declare function validateStudioUserRole(role: string): StudioUserRole;
//# sourceMappingURL=auth.d.ts.map