/**
 * Service Authentication Middleware
 *
 * Fastify preHandler middleware for service-to-service authentication.
 * Validates HMAC signatures in request headers and optionally issues JWT tokens.
 *
 * @packageDocumentation
 */
import type { FastifyRequest, FastifyReply, preHandlerHookHandler } from 'fastify';
import { UnauthorizedError, ForbiddenError } from '../../common/errors.js';
import { ServiceAccountManager, type ServiceAccount } from './service-account.js';
import { ServiceTokenService, type ServiceTokenPayload } from './service-token.js';
/**
 * Service authentication context added to request
 */
export interface ServiceAuthContext {
    /** The authenticated service account */
    serviceAccount: ServiceAccount;
    /** The client ID */
    clientId: string;
    /** The tenant ID */
    tenantId: string;
    /** Service name */
    serviceName: string;
    /** Permissions granted to the service */
    permissions: string[];
    /** Whether request was authenticated via signature or token */
    authMethod: 'signature' | 'token';
    /** The service token if one was issued/verified */
    token?: string;
    /** Token payload if authenticated via token */
    tokenPayload?: ServiceTokenPayload;
}
/**
 * Extended Fastify request with service auth context
 */
export interface ServiceAuthenticatedRequest extends FastifyRequest {
    serviceAuth?: ServiceAuthContext;
}
/**
 * Middleware configuration options
 */
export interface ServiceAuthMiddlewareOptions {
    /** Service account manager instance */
    accountManager?: ServiceAccountManager;
    /** Service token service instance */
    tokenService?: ServiceTokenService;
    /** Whether to allow token-based auth (in addition to signature) */
    allowTokenAuth?: boolean;
    /** Whether to issue a token after successful signature auth */
    issueToken?: boolean;
    /** Paths to skip authentication */
    skipPaths?: string[];
    /** Custom skip function */
    skipFn?: (request: FastifyRequest) => boolean;
    /** Whether to validate IP whitelist */
    validateIpWhitelist?: boolean;
    /** Required permissions (all must be present) */
    requiredPermissions?: string[];
    /** Required permissions (any one must be present) */
    anyPermissions?: string[];
    /** Custom error handler */
    onError?: (error: Error, request: FastifyRequest, reply: FastifyReply) => Promise<void>;
}
/**
 * Service authentication error
 */
export declare class ServiceAuthError extends UnauthorizedError {
    code: string;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Missing authentication headers error
 */
export declare class MissingAuthHeadersError extends ServiceAuthError {
    code: string;
    constructor();
}
/**
 * Invalid signature error
 */
export declare class InvalidServiceSignatureError extends ServiceAuthError {
    code: string;
    constructor(reason?: string);
}
/**
 * IP not allowed error
 */
export declare class IpNotAllowedError extends ForbiddenError {
    code: string;
    constructor(clientId: string, ip: string);
}
/**
 * Insufficient permissions error
 */
export declare class InsufficientPermissionsError extends ForbiddenError {
    code: string;
    constructor(required: string[], actual: string[]);
}
/**
 * Create service authentication middleware
 */
export declare function createServiceAuthMiddleware(options?: ServiceAuthMiddlewareOptions): preHandlerHookHandler;
/**
 * Create middleware that requires specific permissions
 */
export declare function requireServicePermissions(permissions: string[], options?: {
    all?: boolean;
}): preHandlerHookHandler;
/**
 * Create middleware that requires any of the specified permissions
 */
export declare function requireAnyServicePermission(permissions: string[]): preHandlerHookHandler;
/**
 * Create middleware that validates service belongs to a specific tenant
 */
export declare function requireServiceTenant(tenantId: string): preHandlerHookHandler;
/**
 * Get service auth context from request
 */
export declare function getServiceAuth(request: FastifyRequest): ServiceAuthContext | undefined;
/**
 * Require service auth context from request
 */
export declare function requireServiceAuth(request: FastifyRequest): ServiceAuthContext;
/**
 * Check if request has service auth
 */
export declare function hasServiceAuth(request: FastifyRequest): boolean;
/**
 * Get service client ID from request
 */
export declare function getServiceClientId(request: FastifyRequest): string | undefined;
/**
 * Get service tenant ID from request
 */
export declare function getServiceTenantId(request: FastifyRequest): string | undefined;
/**
 * Get service permissions from request
 */
export declare function getServicePermissions(request: FastifyRequest): string[];
/**
 * Check if service has a specific permission
 */
export declare function serviceHasPermission(request: FastifyRequest, permission: string): boolean;
import type { FastifyPluginAsync } from 'fastify';
/**
 * Service auth plugin options
 */
export interface ServiceAuthPluginOptions extends ServiceAuthMiddlewareOptions {
    /** Register as global preHandler */
    global?: boolean;
    /** Decorate request with helper methods */
    decorateRequest?: boolean;
}
/**
 * Service auth Fastify plugin
 */
export declare const serviceAuthPlugin: FastifyPluginAsync<ServiceAuthPluginOptions>;
declare module 'fastify' {
    interface FastifyRequest {
        serviceAuth?: ServiceAuthContext;
        getServiceAuth?: () => ServiceAuthContext | undefined;
        requireServiceAuth?: () => ServiceAuthContext;
        hasServiceAuth?: () => boolean;
        serviceHasPermission?: (permission: string) => boolean;
    }
    interface FastifyInstance {
        serviceAuthMiddleware?: typeof createServiceAuthMiddleware;
        requireServicePermissions?: typeof requireServicePermissions;
        requireAnyServicePermission?: typeof requireAnyServicePermission;
    }
}
//# sourceMappingURL=service-auth-middleware.d.ts.map