/**
 * Security Middleware
 *
 * Provides security headers, request ID injection, request logging,
 * and sensitive data masking for production API hardening.
 *
 * @packageDocumentation
 */
import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
/** Type for onRequest hook function */
type OnRequestFn = (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/** Type for onResponse hook function */
type OnResponseFn = (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/** Type for preHandler hook function */
type PreHandlerFn = (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Security headers configuration
 */
export interface SecurityHeadersConfig {
    /** Enable CORS headers */
    cors?: boolean | CorsConfig;
    /** Enable Content Security Policy */
    csp?: boolean | CspConfig;
    /** Enable HSTS (HTTP Strict Transport Security) */
    hsts?: boolean | HstsConfig;
    /** Enable X-Content-Type-Options: nosniff */
    noSniff?: boolean;
    /** Enable X-Frame-Options */
    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
    /** Enable X-XSS-Protection */
    xssProtection?: boolean;
    /** Enable Referrer-Policy */
    referrerPolicy?: string | false;
    /** Enable Permissions-Policy */
    permissionsPolicy?: string | false;
    /** Custom headers to add */
    customHeaders?: Record<string, string>;
}
/**
 * CORS configuration
 */
export interface CorsConfig {
    origin: string | string[] | boolean | ((origin: string) => boolean);
    methods?: string[];
    allowedHeaders?: string[];
    exposedHeaders?: string[];
    credentials?: boolean;
    maxAge?: number;
}
/**
 * CSP configuration
 */
export interface CspConfig {
    defaultSrc?: string[];
    scriptSrc?: string[];
    styleSrc?: string[];
    imgSrc?: string[];
    connectSrc?: string[];
    fontSrc?: string[];
    objectSrc?: string[];
    mediaSrc?: string[];
    frameSrc?: string[];
    childSrc?: string[];
    workerSrc?: string[];
    frameAncestors?: string[];
    formAction?: string[];
    upgradeInsecureRequests?: boolean;
    blockAllMixedContent?: boolean;
    reportUri?: string;
}
/**
 * HSTS configuration
 */
export interface HstsConfig {
    maxAge: number;
    includeSubDomains?: boolean;
    preload?: boolean;
}
/**
 * Request logging configuration
 */
export interface RequestLoggingConfig {
    /** Log request start */
    logRequest?: boolean;
    /** Log response completion */
    logResponse?: boolean;
    /** Log request body (be careful with sensitive data) */
    logBody?: boolean;
    /** Log response body */
    logResponseBody?: boolean;
    /** Maximum body size to log (bytes) */
    maxBodyLogSize?: number;
    /** Paths to exclude from logging */
    excludePaths?: string[];
    /** Headers to exclude from logging */
    excludeHeaders?: string[];
    /** Fields to mask in body */
    sensitiveFields?: string[];
}
/**
 * Mask sensitive data in an object
 */
export declare function maskSensitiveData(obj: unknown, sensitiveFields?: string[], maxDepth?: number): unknown;
/**
 * Create security headers middleware
 *
 * @param config - Security headers configuration
 * @returns Fastify onRequest hook
 */
export declare function securityHeaders(config?: SecurityHeadersConfig): OnRequestFn;
/**
 * Create request ID injection middleware
 *
 * Injects a unique request ID into each request for tracing and debugging.
 *
 * @returns Fastify onRequest hook
 */
export declare function requestIdInjection(): OnRequestFn;
/**
 * Create request logging middleware
 *
 * @param config - Logging configuration
 * @returns Object with onRequest and onResponse hooks
 */
export declare function requestLogging(config?: RequestLoggingConfig): {
    onRequest: OnRequestFn;
    onResponse: OnResponseFn;
};
/**
 * Combined security middleware that applies all security features
 *
 * @param options - Configuration options
 * @returns Fastify preHandler hook
 */
export declare function combinedSecurityMiddleware(options?: {
    headers?: SecurityHeadersConfig;
    logging?: RequestLoggingConfig;
}): PreHandlerFn;
/**
 * Register security middleware plugin for Fastify
 *
 * @param server - Fastify instance
 * @param options - Configuration options
 */
export declare function registerSecurityPlugin(server: FastifyInstance, options?: {
    headers?: SecurityHeadersConfig;
    logging?: RequestLoggingConfig;
    /** Skip security for certain paths */
    skipPaths?: string[];
}): Promise<void>;
/**
 * Create timing-safe string comparison to prevent timing attacks
 */
export declare function timingSafeEqual(a: string, b: string): boolean;
export {};
//# sourceMappingURL=security.d.ts.map