/**
 * @fileoverview Provides utility functions for authorization, specifically for
 * checking token scopes against required permissions for a given operation.
 * @module src/mcp-server/transports/auth/core/authUtils
 */
import { type RequestContext } from '../../../../utils/internal/requestContext.js';
/**
 * Checks if the current authentication context contains all the specified scopes.
 * When auth is disabled (`MCP_AUTH_MODE=none`), scope checks are skipped.
 * When auth is enabled and the auth context is missing, fails closed with Unauthorized.
 * When `MCP_AUTH_DISABLE_SCOPE_CHECKS=true`, scope enforcement is bypassed after the
 * auth-context presence check; signature, audience, issuer, and expiry validation
 * remain intact.
 *
 * @param requiredScopes - An array of scope strings that are mandatory for the operation.
 * @param parentContext - Optional parent request context for trace correlation.
 * @throws {McpError} Throws `Unauthorized` if auth is enabled but no auth context exists.
 * @throws {McpError} Throws `Forbidden` if auth is active and required scopes are missing.
 */
export declare function withRequiredScopes(requiredScopes: string[], parentContext?: RequestContext): void;
//# sourceMappingURL=authUtils.d.ts.map