/**
 * CSRF Protection Module
 *
 * Provides CSRF (Cross-Site Request Forgery) protection for web interfaces.
 * Used when Code Buddy exposes HTTP endpoints (REST API, webhooks, etc.)
 *
 * Features:
 * - Token generation and validation
 * - Double-submit cookie pattern
 * - SameSite cookie configuration
 * - Token rotation
 */
import { EventEmitter } from 'events';
export interface CSRFConfig {
    /** Token length in bytes (default: 32) */
    tokenLength?: number;
    /** Token expiry in milliseconds (default: 1 hour) */
    tokenExpiry?: number;
    /** Cookie name for CSRF token */
    cookieName?: string;
    /** Header name for CSRF token */
    headerName?: string;
    /** Enable double-submit cookie pattern */
    doubleSubmit?: boolean;
    /** SameSite cookie attribute */
    sameSite?: 'strict' | 'lax' | 'none';
    /** Secure cookie (HTTPS only) */
    secure?: boolean;
}
export interface CSRFToken {
    token: string;
    createdAt: Date;
    expiresAt: Date;
    sessionId?: string;
}
export interface CSRFValidationResult {
    valid: boolean;
    error?: string;
    token?: CSRFToken;
}
/**
 * CSRF Protection Manager
 */
export declare class CSRFProtection extends EventEmitter {
    private config;
    private tokens;
    private cleanupInterval;
    constructor(config?: CSRFConfig);
    /**
     * Generate a new CSRF token
     */
    generateToken(sessionId?: string): CSRFToken;
    /**
     * Validate a CSRF token
     */
    validateToken(token: string, options?: {
        sessionId?: string;
        cookieToken?: string;
    }): CSRFValidationResult;
    /**
     * Rotate a token (invalidate old, generate new)
     */
    rotateToken(oldToken: string, sessionId?: string): CSRFToken | null;
    /**
     * Invalidate a specific token
     */
    invalidateToken(token: string): boolean;
    /**
     * Invalidate all tokens for a session
     */
    invalidateSession(sessionId: string): number;
    /**
     * Get cookie options for setting CSRF cookie
     */
    getCookieOptions(): {
        name: string;
        options: {
            httpOnly: boolean;
            secure: boolean;
            sameSite: 'strict' | 'lax' | 'none';
            maxAge: number;
            path: string;
        };
    };
    /**
     * Get header name for CSRF token
     */
    getHeaderName(): string;
    /**
     * Express/Connect middleware for CSRF protection
     */
    middleware(): (req: CSRFRequest, res: CSRFResponse, next: (err?: Error) => void) => void;
    /**
     * Generate HTML meta tag for CSRF token
     */
    getMetaTag(token: string): string;
    /**
     * Generate hidden form field for CSRF token
     */
    getFormField(token: string): string;
    /**
     * Escape HTML special characters
     */
    private escapeHtml;
    /**
     * Start cleanup interval for expired tokens
     */
    private startCleanup;
    /**
     * Clean up expired tokens
     */
    cleanup(): number;
    /**
     * Get statistics
     */
    getStats(): {
        activeTokens: number;
        oldestToken?: Date;
        newestToken?: Date;
    };
    /**
     * Dispose and cleanup resources
     */
    dispose(): void;
}
interface CSRFRequest {
    method?: string;
    headers: Record<string, string | string[] | undefined>;
    cookies?: Record<string, string>;
    body?: Record<string, string>;
    query?: Record<string, string | string[]>;
    sessionID?: string;
    csrfToken?: () => string;
}
interface CSRFResponse {
    cookie: (name: string, value: string, options: Record<string, unknown>) => void;
}
/**
 * Get the CSRF protection instance
 */
export declare function getCSRFProtection(config?: CSRFConfig): CSRFProtection;
/**
 * Reset the CSRF protection instance
 */
export declare function resetCSRFProtection(): void;
export default CSRFProtection;
