/**
 * Request source verification middleware for API protection.
 *
 * Verifies requests are coming from expected origins/referers.
 * CSRF protection is provided by `SameSite: strict` on session cookies
 * (see `auth/session_middleware.ts`). This module provides origin allowlisting
 * for locally-running services — preventing untrusted websites from
 * making requests as the user browses the web.
 *
 * @module
 */
import type { Handler } from 'hono';
/**
 * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
 * Origin allowlisting for locally-running services — not the CSRF layer
 * (that's `SameSite: strict` on session cookies).
 *
 * Accepts comma-separated patterns with limited wildcards:
 * - Exact origins: `https://api.fuz.dev`
 * - Wildcard subdomains: `https://*.fuz.dev` (matches exactly one subdomain level)
 * - Multiple wildcards: `https://*.staging.*.fuz.dev` (for deep subdomains)
 * - Wildcard ports: `http://localhost:*` (matches any port or no port)
 * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]`
 * - Combined: `https://*.fuz.dev:*`
 *
 * Examples:
 * - `http://localhost:3000,https://prod.fuz.dev`
 * - `https://*.api.fuz.dev,http://127.0.0.1:*`
 * - `http://[::1]:*,https://*.*.corp.fuz.dev:*`
 *
 * @throws Error if any individual pattern is invalid (missing protocol, partial wildcards, etc.)
 */
export declare const parse_allowed_origins: (env_value: string | undefined) => Array<RegExp>;
/**
 * Tests if a request source (origin or referer) matches any of the allowed patterns.
 * Pattern matching is case-insensitive for domains (as per web standards).
 */
export declare const should_allow_origin: (origin: string, allowed_patterns: ReadonlyArray<RegExp>) => boolean;
/**
 * Middleware that verifies the request source against an allowlist.
 *
 * Origin allowlisting (not the CSRF layer — that's `SameSite: strict` cookies):
 * - Checks the `Origin` header (if present) against the allowlist
 * - Allows requests without an `Origin` header (direct access, curl, etc.)
 *
 * Origin-only by design — Fetch spec mandates `Origin` on every unsafe
 * method (POST / PUT / DELETE / PATCH) regardless of `Referrer-Policy`,
 * so every real browser request on the state-changing surface carries it.
 * Non-browser clients (curl, server-to-server, CLI) don't ship auto-
 * attached session cookies, so CSRF isn't the relevant threat there —
 * auth (bearer / daemon token) is the actual control. A Referer fallback
 * would only widen the accepted-shape envelope without closing a real
 * CSRF hole; mirrors `zzz_server::auth::is_request_origin_allowed`.
 *
 * @param allowed_patterns - compiled regex patterns from `parse_allowed_origins`
 */
export declare const verify_request_source: (allowed_patterns: ReadonlyArray<RegExp>) => Handler;
//# sourceMappingURL=origin.d.ts.map