import { CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
/**
 * CSRF protection for cookie-authenticated state-changing requests.
 * Runs after SessionGuard. Public routes (login) are exempt — they are not
 * cookie-authenticated. Requests without a session cookie fail auth anyway.
 * The expected token is recomputed from the session cookie (session-bound
 * double-submit), so no server-side state is required.
 */
export declare class CsrfGuard implements CanActivate {
    private readonly reflector;
    constructor(reflector: Reflector);
    canActivate(context: ExecutionContext): boolean;
}
//# sourceMappingURL=csrf.guard.d.ts.map