import type { IncomingMessage } from "node:http";
import type { GatewayAuthConfig, GatewayTailscaleMode, GatewayTrustedProxyConfig } from "../config/config.js";
import { type TailscaleWhoisIdentity } from "../infra/tailscale.js";
import { type AuthRateLimiter } from "./auth-rate-limit.js";
export type ResolvedGatewayAuthMode = "none" | "token" | "password" | "trusted-proxy";
export type ResolvedGatewayAuth = {
    mode: ResolvedGatewayAuthMode;
    modeSource?: "config" | "env" | "default";
    token?: string;
    password?: string;
    allowTailscale: boolean;
    trustedProxy?: GatewayTrustedProxyConfig;
    sessionTokenVerifier?: SessionTokenVerifier;
};
export type GatewayAuthResult = {
    ok: boolean;
    method?: "none" | "token" | "password" | "tailscale" | "device-token" | "trusted-proxy" | "session-token";
    user?: string;
    reason?: string;
    /** Present when the request was blocked by the rate limiter. */
    rateLimited?: boolean;
    /** Milliseconds the client should wait before retrying (when rate-limited). */
    retryAfterMs?: number;
};
type ConnectAuth = {
    token?: string;
    password?: string;
};
type SessionTokenVerifier = (params: {
    token: string;
    req?: IncomingMessage;
    trustedProxies?: string[];
}) => Promise<{
    ok: true;
    user?: string;
} | {
    ok: false;
}>;
type TailscaleWhoisLookup = (ip: string) => Promise<TailscaleWhoisIdentity | null>;
export declare function isLocalDirectRequest(req?: IncomingMessage, trustedProxies?: string[], allowRealIpFallback?: boolean): boolean;
export declare function resolveGatewayAuth(params: {
    authConfig?: GatewayAuthConfig | null;
    env?: NodeJS.ProcessEnv;
    tailscaleMode?: GatewayTailscaleMode;
}): ResolvedGatewayAuth;
export declare function assertGatewayAuthConfigured(auth: ResolvedGatewayAuth): void;
export { authorizeGatewayConnect as authorizeHttpGatewayConnect };
export { authorizeGatewayConnect as authorizeWsControlUiGatewayConnect };
export declare function authorizeGatewayConnect(params: {
    auth: ResolvedGatewayAuth;
    connectAuth?: ConnectAuth | null;
    req?: IncomingMessage;
    trustedProxies?: string[];
    tailscaleWhois?: TailscaleWhoisLookup;
    /** Optional rate limiter instance; when provided, failed attempts are tracked per IP. */
    rateLimiter?: AuthRateLimiter;
    /** Client IP used for rate-limit tracking. Falls back to proxy-aware request IP resolution. */
    clientIp?: string;
    /** Allow fallback to req.socket.remoteAddress if proxy-aware resolution fails. */
    allowRealIpFallback?: boolean;
    /** Optional limiter scope; defaults to shared-secret auth scope. */
    rateLimitScope?: string;
}): Promise<GatewayAuthResult>;
