/**
 * Comprehensive Rate Limit Configuration
 *
 * Provides route-specific rate limiting for sensitive endpoints with:
 * - Per-user rate limiting (tracks by user ID, not just IP)
 * - Different limits for authenticated vs anonymous users
 * - Higher limits for admin users
 * - Internal service bypass capability
 * - Standard rate limit headers (X-RateLimit-*)
 * - Audit logging for bypass usage
 *
 * @packageDocumentation
 */
import type { FastifyRequest, FastifyReply, FastifyPluginAsync } from 'fastify';
/**
 * Rate limit configuration for an endpoint
 */
export interface EndpointRateLimitConfig {
    /** Maximum requests allowed in the window */
    max: number;
    /** Time window in seconds */
    windowSeconds: number;
}
/**
 * User type for rate limiting multipliers
 */
export type UserType = 'anonymous' | 'authenticated' | 'admin' | 'service';
/**
 * Multipliers for different user types
 */
export interface RateLimitMultipliers {
    anonymous: number;
    authenticated: number;
    admin: number;
    service: number;
}
/**
 * Rate limit check result
 */
export interface RateLimitStatus {
    /** Route pattern */
    route: string;
    /** Maximum requests allowed */
    limit: number;
    /** Remaining requests in window */
    remaining: number;
    /** Unix timestamp when window resets */
    resetAt: number;
    /** Seconds until reset */
    resetInSeconds: number;
    /** User type applied */
    userType: UserType;
    /** Whether rate limit was bypassed */
    bypassed: boolean;
}
/**
 * Rate limit window entry
 */
interface WindowEntry {
    count: number;
    resetAt: number;
}
/**
 * Rate limit configuration for sensitive endpoints.
 *
 * Format: 'METHOD /path' -> { max, windowSeconds }
 *
 * These limits are for authenticated users. Anonymous users get 50% of these limits.
 * Admin users get 200% of these limits. Service accounts can bypass if authorized.
 */
export declare const rateLimitConfig: Record<string, EndpointRateLimitConfig>;
/**
 * Default rate limit multipliers for different user types
 */
export declare const defaultMultipliers: RateLimitMultipliers;
/**
 * Permission required to bypass rate limits
 */
export declare const RATE_LIMIT_BYPASS_PERMISSION = "rate_limit:bypass";
/**
 * In-memory rate limit store for per-user tracking
 */
declare class UserRateLimitStore {
    private windows;
    private cleanupInterval;
    private readonly maxSize;
    constructor();
    /**
     * Generate a unique key for user + route
     */
    private generateKey;
    /**
     * Check rate limit for a user on a specific route
     */
    check(userId: string, route: string, limit: number, windowSeconds: number): {
        allowed: boolean;
        current: number;
        limit: number;
        remaining: number;
        resetAt: number;
        resetInSeconds: number;
    };
    /**
     * Peek at current state without incrementing
     */
    peek(userId: string, route: string, limit: number): {
        current: number;
        limit: number;
        remaining: number;
        resetAt: number;
        resetInSeconds: number;
    } | null;
    /**
     * Get all rate limit statuses for a user
     */
    getUserStatuses(userId: string): Map<string, WindowEntry>;
    /**
     * Evict oldest entries (LRU-style)
     */
    private evictOldestEntries;
    /**
     * Cleanup expired entries
     */
    private cleanup;
    /**
     * Get statistics
     */
    getStats(): {
        activeKeys: number;
        maxSize: number;
    };
    /**
     * Stop cleanup timer
     */
    stop(): void;
}
/**
 * Get the global user rate limit store
 */
export declare function getUserRateLimitStore(): UserRateLimitStore;
/**
 * Reset the global store (for testing)
 */
export declare function resetUserRateLimitStore(): void;
/**
 * Create comprehensive rate limiting middleware
 *
 * This middleware:
 * 1. Looks up route-specific rate limits from configuration
 * 2. Applies user-type multipliers (anonymous, authenticated, admin)
 * 3. Checks for bypass permissions (service accounts)
 * 4. Sets standard rate limit headers
 * 5. Returns 429 with Retry-After on limit exceeded
 *
 * @example
 * ```typescript
 * server.post('/api/v1/intents', {
 *   preHandler: comprehensiveRateLimit(),
 * }, handler);
 * ```
 */
export declare function comprehensiveRateLimit(options?: {
    /** Custom rate limit config (overrides default) */
    config?: Record<string, EndpointRateLimitConfig>;
    /** Custom multipliers (overrides default) */
    multipliers?: Partial<RateLimitMultipliers>;
    /** Skip rate limiting for certain conditions */
    skip?: (request: FastifyRequest) => boolean;
}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Create rate limit preHandler for a specific endpoint configuration
 *
 * @example
 * ```typescript
 * server.post('/custom-endpoint', {
 *   preHandler: createEndpointRateLimit({ max: 10, windowSeconds: 60 }),
 * }, handler);
 * ```
 */
export declare function createEndpointRateLimit(config: EndpointRateLimitConfig, options?: {
    /** Custom multipliers */
    multipliers?: Partial<RateLimitMultipliers>;
    /** Route pattern for tracking (defaults to request URL) */
    routePattern?: string;
}): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Get current user's rate limit status across all configured endpoints
 */
export declare function getRateLimitStatus(request: FastifyRequest): Promise<{
    user: {
        id: string;
        type: UserType;
        canBypass: boolean;
    };
    limits: RateLimitStatus[];
    storeStats: {
        activeKeys: number;
        maxSize: number;
    };
}>;
/**
 * Plugin options
 */
export interface RateLimitsPluginOptions {
    /** Skip rate limiting for certain paths */
    skipPaths?: string[];
    /** Custom rate limit config */
    config?: Record<string, EndpointRateLimitConfig>;
    /** Custom multipliers */
    multipliers?: Partial<RateLimitMultipliers>;
}
/**
 * Comprehensive Rate Limits Plugin
 */
export declare const rateLimitsPlugin: FastifyPluginAsync<RateLimitsPluginOptions>;
declare module 'fastify' {
    interface FastifyInstance {
        vorionComprehensiveRateLimit: ReturnType<typeof comprehensiveRateLimit>;
        vorionCreateEndpointRateLimit: typeof createEndpointRateLimit;
        vorionGetRateLimitStatus: typeof getRateLimitStatus;
    }
}
export default rateLimitsPlugin;
//# sourceMappingURL=rate-limits.d.ts.map