/**
 * Fastify Security Middleware
 *
 * Provides Fastify plugins and middleware for CAR security hardening:
 * - DPoP proof verification
 * - Token introspection for high-value operations
 * - Revocation checking
 * - Security context decoration
 *
 * @packageDocumentation
 */
import type { FastifyRequest, FastifyPluginCallback, preHandlerHookHandler } from 'fastify';
import { type SecurityPluginOptions, type TrustTier, type SecurityRequirements } from './types.js';
import { DPoPService } from './dpop.js';
import { TokenIntrospectionService } from './introspection.js';
import { RevocationService } from './revocation.js';
import { SecurityService } from './security-service.js';
/**
 * Fastify middleware function type
 */
export type FastifyMiddleware = preHandlerHookHandler;
/**
 * Decorated request with security context
 */
export interface SecurityRequestContext {
    /** Security service instance */
    security: SecurityService;
    /** Agent trust tier */
    trustTier: TrustTier;
    /** Security requirements for this tier */
    requirements: SecurityRequirements;
    /** Agent DID (from JWT sub claim) */
    agentDid?: string;
    /** DPoP key thumbprint (if DPoP was verified) */
    dpopKeyThumbprint?: string;
    /** Whether this is a high-value operation */
    isHighValueOperation?: boolean;
}
declare module 'fastify' {
    interface FastifyRequest {
        securityContext?: SecurityRequestContext;
    }
}
/**
 * Create DPoP verification middleware
 *
 * Verifies DPoP proofs for requests from trust tiers that require it.
 * Extracts the DPoP header, validates the proof, and optionally validates
 * token binding.
 *
 * @param dpopService - DPoP service instance
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * const dpop = createDPoPService({ requiredForTiers: [2, 3, 4, 5] });
 *
 * fastify.addHook('preHandler', dpopMiddleware(dpop, {
 *   skipPaths: ['/health', '/metrics'],
 * }));
 * ```
 */
export declare function dpopMiddleware(dpopService: DPoPService, options?: {
    skipPaths?: string[];
}): FastifyMiddleware;
/**
 * Create token introspection middleware for high-value operations
 *
 * Performs real-time token validation via introspection endpoint
 * for operations that require it (T4+ or L3+ operations).
 *
 * @param introspectionService - Token introspection service
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * const introspection = createTokenIntrospectionService('https://auth.example.com/introspect');
 *
 * // Apply to specific routes
 * fastify.route({
 *   method: 'POST',
 *   url: '/financial-transaction',
 *   preHandler: [introspectionMiddleware(introspection)],
 *   handler: handleTransaction,
 * });
 * ```
 */
export declare function introspectionMiddleware(introspectionService: TokenIntrospectionService, options?: {
    /** Force introspection regardless of tier */
    alwaysIntrospect?: boolean;
    /** Cache TTL override in milliseconds */
    cacheTTL?: number;
    /** Skip introspection for these paths */
    skipPaths?: string[];
}): FastifyMiddleware;
/**
 * Create revocation check middleware
 *
 * Verifies that the agent has not been revoked. For high-trust tiers
 * or high-value operations, performs synchronous revocation check.
 *
 * @param revocationService - Revocation service
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * const revocation = createRevocationService();
 *
 * fastify.addHook('preHandler', revocationMiddleware(revocation, {
 *   skipPaths: ['/health'],
 * }));
 * ```
 */
export declare function revocationMiddleware(revocationService: RevocationService, options?: {
    /** Skip revocation check for these paths */
    skipPaths?: string[];
    /** Force synchronous check regardless of tier */
    alwaysSyncCheck?: boolean;
}): FastifyMiddleware;
/**
 * Create security context initialization middleware
 *
 * Extracts security-related information from the request and
 * decorates it with a security context for downstream middleware.
 *
 * @param securityService - Security service instance
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 */
export declare function securityContextMiddleware(securityService: SecurityService, options?: {
    /** Skip for these paths */
    skipPaths?: string[];
    /** Function to extract trust tier from request */
    extractTier?: (request: FastifyRequest) => TrustTier;
    /** Function to extract agent DID from request */
    extractAgentDid?: (request: FastifyRequest) => string | undefined;
    /** High-value operation paths */
    highValuePaths?: string[];
}): FastifyMiddleware;
/**
 * Security hardening Fastify plugin
 */
export declare const securityHardeningPlugin: FastifyPluginCallback<SecurityPluginOptions>;
declare module 'fastify' {
    interface FastifyInstance {
        securityService?: SecurityService;
    }
}
/**
 * Create a high-value operation marker middleware
 *
 * Marks requests as high-value operations, triggering additional
 * security checks (introspection, sync revocation check).
 *
 * @returns Fastify preHandler hook
 */
export declare function markHighValueOperation(): FastifyMiddleware;
/**
 * Create a tier requirement middleware
 *
 * Requires a minimum trust tier for the route.
 *
 * @param minimumTier - Minimum required trust tier
 * @returns Fastify preHandler hook
 */
export declare function requireTier(minimumTier: TrustTier): FastifyMiddleware;
/**
 * Create a DPoP required middleware
 *
 * Requires DPoP proof regardless of trust tier.
 *
 * @param dpopService - DPoP service
 * @returns Fastify preHandler hook
 */
export declare function requireDPoP(dpopService: DPoPService): FastifyMiddleware;
//# sourceMappingURL=middleware.d.ts.map