/**
 * AuthMiddleware - Authentication and authorization middleware
 *
 * Provides middleware factories for:
 * - Token extraction and validation
 * - User context propagation
 * - RBAC enforcement
 * - Public route handling
 */
import type { AuthenticatedContext, AuthMiddlewareConfig, AuthRequestContext, AuthUser, RBACMiddlewareConfig, TokenExtractionConfig } from "../../types/authTypes.js";
/**
 * Auth middleware error codes
 */
export declare const AuthMiddlewareErrorCodes: {
    readonly MISSING_TOKEN: "AUTH_MIDDLEWARE-001";
    readonly INVALID_TOKEN: "AUTH_MIDDLEWARE-002";
    readonly UNAUTHORIZED: "AUTH_MIDDLEWARE-003";
    readonly FORBIDDEN: "AUTH_MIDDLEWARE-004";
    readonly PROVIDER_ERROR: "AUTH_MIDDLEWARE-005";
    readonly CONFIGURATION_ERROR: "AUTH_MIDDLEWARE-006";
};
/**
 * Auth middleware error factory
 */
export declare const AuthMiddlewareError: {
    codes: {
        readonly MISSING_TOKEN: "AUTH_MIDDLEWARE-001";
        readonly INVALID_TOKEN: "AUTH_MIDDLEWARE-002";
        readonly UNAUTHORIZED: "AUTH_MIDDLEWARE-003";
        readonly FORBIDDEN: "AUTH_MIDDLEWARE-004";
        readonly PROVIDER_ERROR: "AUTH_MIDDLEWARE-005";
        readonly CONFIGURATION_ERROR: "AUTH_MIDDLEWARE-006";
    };
    create: (code: "INVALID_TOKEN" | "MISSING_TOKEN" | "PROVIDER_ERROR" | "CONFIGURATION_ERROR" | "FORBIDDEN" | "UNAUTHORIZED", message: string, options?: {
        retryable?: boolean;
        details?: Record<string, unknown>;
        cause?: Error;
    } | undefined) => import("../../index.js").NeuroLinkFeatureError;
};
/**
 * Minimal request object accepted by {@link createRequestContext}.
 *
 * Avoids `any` for Express/Koa/Hono request objects while remaining
 * compatible with any framework that exposes these standard fields.
 */
export type IncomingRequest = {
    method?: string;
    url?: string;
    path?: string;
    headers?: Record<string, string | string[] | undefined>;
    cookies?: Record<string, string>;
    query?: Record<string, string | string[] | undefined>;
    body?: unknown;
    ip?: string;
    /** Populated by auth middleware after successful authentication */
    user?: AuthUser;
    /** Populated by auth middleware after successful authentication */
    authContext?: AuthenticatedContext;
};
/**
 * Minimal response object for Express-style middleware.
 */
export type OutgoingResponse = {
    status(code: number): OutgoingResponse;
    json(body: unknown): void;
};
/**
 * Middleware handler function type
 */
export type MiddlewareHandler<TContext = AuthRequestContext> = (context: TContext) => Promise<MiddlewareResult>;
/**
 * Middleware result
 */
export type MiddlewareResult = {
    /** Whether to proceed to next handler */
    proceed: boolean;
    /** Updated context (if authenticated) */
    context?: AuthenticatedContext;
    /** Error response if not proceeding */
    error?: {
        statusCode: number;
        message: string;
        code?: string;
    };
};
/**
 * Next function for middleware chaining
 */
export type NextFunction = () => Promise<void>;
/**
 * Express-style middleware function
 */
export type ExpressMiddleware = (req: IncomingRequest, res: OutgoingResponse, next: NextFunction) => Promise<void>;
/**
 * Extract token from request context based on configuration
 */
export declare function extractToken(context: AuthRequestContext, config?: TokenExtractionConfig): Promise<string | null>;
/**
 * Create authentication middleware
 *
 * Validates tokens and attaches user context to requests.
 *
 * @example
 * ```typescript
 * const authMiddleware = await createAuthMiddleware({
 *   provider: 'auth0',
 *   providerConfig: {
 *     type: 'auth0',
 *     domain: 'your-tenant.auth0.com',
 *     clientId: 'your-client-id',
 *   },
 *   publicRoutes: ['/health', '/public/*'],
 * });
 *
 * // Use in request handler
 * const result = await authMiddleware(requestContext);
 * if (result.proceed) {
 *   // Access authenticated context
 *   console.log('User:', result.context?.user);
 * } else {
 *   // Return error response
 *   res.status(result.error.statusCode).json({ error: result.error.message });
 * }
 * ```
 */
export declare function createAuthMiddleware(config: AuthMiddlewareConfig): Promise<MiddlewareHandler<AuthRequestContext>>;
/**
 * Create RBAC (Role-Based Access Control) middleware
 *
 * Checks if authenticated user has required roles/permissions.
 *
 * @example
 * ```typescript
 * const rbacMiddleware = createRBACMiddleware({
 *   roles: ['admin', 'moderator'],
 *   permissions: ['read:users'],
 * });
 *
 * // Use after auth middleware
 * const authResult = await authMiddleware(context);
 * if (authResult.proceed && authResult.context) {
 *   const rbacResult = await rbacMiddleware(authResult.context);
 *   if (!rbacResult.proceed) {
 *     res.status(403).json({ error: rbacResult.error.message });
 *   }
 * }
 * ```
 */
export declare function createRBACMiddleware(config: RBACMiddlewareConfig): MiddlewareHandler<AuthenticatedContext>;
/**
 * Create combined auth + RBAC middleware
 *
 * Convenience function that combines authentication and authorization.
 *
 * @example
 * ```typescript
 * const protectedMiddleware = await createProtectedMiddleware({
 *   auth: {
 *     provider: 'auth0',
 *     providerConfig: { type: 'auth0', domain: '...', clientId: '...' },
 *   },
 *   rbac: {
 *     roles: ['admin'],
 *   },
 * });
 *
 * const result = await protectedMiddleware(context);
 * ```
 */
export declare function createProtectedMiddleware(config: {
    auth: AuthMiddlewareConfig;
    rbac?: RBACMiddlewareConfig;
}): Promise<MiddlewareHandler<AuthRequestContext>>;
/**
 * Create request context from standard request object
 */
export declare function createRequestContext(req: IncomingRequest): AuthRequestContext;
/**
 * Create Express-compatible middleware
 */
export declare function createExpressAuthMiddleware(config: AuthMiddlewareConfig): Promise<ExpressMiddleware>;
