/**
 * Security Headers Middleware
 *
 * Provides comprehensive security headers for HTTP responses including:
 * - Content Security Policy (CSP) with configurable directives
 * - Subresource Integrity (SRI) hash generation and validation
 * - Standard security headers (HSTS, X-Frame-Options, etc.)
 * - Nonce generation for inline scripts
 * - Environment-specific CSP configurations
 *
 * @packageDocumentation
 */
import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
/**
 * Content Security Policy directive configuration
 */
export interface CspDirectives {
    'default-src'?: string[];
    'script-src'?: string[];
    'style-src'?: string[];
    'img-src'?: string[];
    'font-src'?: string[];
    'connect-src'?: string[];
    'media-src'?: string[];
    'object-src'?: string[];
    'frame-src'?: string[];
    'frame-ancestors'?: string[];
    'form-action'?: string[];
    'base-uri'?: string[];
    'worker-src'?: string[];
    'manifest-src'?: string[];
    'upgrade-insecure-requests'?: boolean;
    'block-all-mixed-content'?: boolean;
    'report-uri'?: string;
    'report-to'?: string;
}
/**
 * Environment-specific CSP configuration
 */
export interface EnvironmentCspConfig {
    /** CSP configuration for development */
    development: CspDirectives;
    /** CSP configuration for staging */
    staging: CspDirectives;
    /** CSP configuration for production */
    production: CspDirectives;
}
/**
 * Security headers configuration options
 */
export interface SecurityHeadersOptions {
    /** Content Security Policy configuration */
    csp?: CspDirectives | false;
    /** Use environment-specific CSP */
    environmentCsp?: EnvironmentCspConfig;
    /** Enable X-Content-Type-Options: nosniff */
    noSniff?: boolean;
    /** X-Frame-Options value */
    frameOptions?: 'DENY' | 'SAMEORIGIN' | false;
    /** Enable X-XSS-Protection header */
    xssProtection?: boolean;
    /** HSTS configuration */
    hsts?: {
        maxAge: number;
        includeSubDomains?: boolean;
        preload?: boolean;
    } | false;
    /** Referrer-Policy value */
    referrerPolicy?: string | false;
    /** Permissions-Policy value */
    permissionsPolicy?: string | false;
    /** Generate nonce for inline scripts */
    useNonce?: boolean;
    /** Custom headers to add */
    customHeaders?: Record<string, string>;
    /** Paths to exclude from CSP */
    excludePaths?: string[];
}
/**
 * Subresource Integrity (SRI) hash
 */
export interface SriHash {
    /** The algorithm used (sha256, sha384, sha512) */
    algorithm: 'sha256' | 'sha384' | 'sha512';
    /** The base64-encoded hash */
    hash: string;
    /** The full integrity attribute value */
    integrity: string;
}
/**
 * Default security headers applied to all responses
 */
export declare const DEFAULT_SECURITY_HEADERS: Record<string, string>;
/**
 * Default CSP directives for APIs
 */
export declare const DEFAULT_API_CSP: CspDirectives;
/**
 * CSP configuration for Swagger UI pages
 */
export declare const SWAGGER_UI_CSP: CspDirectives;
/**
 * Environment-specific CSP configurations
 */
export declare const ENVIRONMENT_CSP_CONFIG: EnvironmentCspConfig;
/**
 * Generate a cryptographically secure nonce for CSP
 *
 * @returns Base64-encoded nonce string
 */
export declare function generateNonce(): string;
/**
 * Generate Subresource Integrity (SRI) hash for content
 *
 * @param content - The content to hash (string or Buffer)
 * @param algorithm - Hash algorithm to use (default: sha384)
 * @returns SRI hash object with algorithm, hash, and full integrity value
 */
export declare function generateSriHash(content: string | Buffer, algorithm?: 'sha256' | 'sha384' | 'sha512'): SriHash;
/**
 * Verify content against SRI hash
 *
 * @param content - Content to verify
 * @param expectedIntegrity - Expected integrity attribute value
 * @returns True if content matches the hash
 */
export declare function verifySriHash(content: string | Buffer, expectedIntegrity: string): boolean;
/**
 * Build CSP header string from directives object
 *
 * @param directives - CSP directives configuration
 * @param nonce - Optional nonce to include in script-src and style-src
 * @returns CSP header value string
 */
export declare function buildCspHeader(directives: CspDirectives, nonce?: string): string;
/**
 * Get CSP configuration for the current environment
 *
 * @param config - Environment CSP configuration
 * @returns CSP directives for current environment
 */
export declare function getEnvironmentCsp(config: EnvironmentCspConfig): CspDirectives;
/**
 * Create security headers middleware for Fastify
 *
 * Applies comprehensive security headers to all responses including:
 * - Content-Security-Policy with configurable directives
 * - X-Content-Type-Options: nosniff
 * - X-Frame-Options
 * - X-XSS-Protection
 * - Strict-Transport-Security (HSTS)
 * - Referrer-Policy
 * - Permissions-Policy
 *
 * @param options - Security headers configuration
 * @returns Fastify onRequest hook function
 *
 * @example
 * ```typescript
 * // Basic usage with defaults
 * server.addHook('onRequest', securityHeadersMiddleware());
 *
 * // With custom CSP
 * server.addHook('onRequest', securityHeadersMiddleware({
 *   csp: {
 *     'default-src': ["'self'"],
 *     'script-src': ["'self'", "'unsafe-inline'"],
 *     'style-src': ["'self'", "'unsafe-inline'"],
 *   }
 * }));
 *
 * // With nonce generation for inline scripts
 * server.addHook('onRequest', securityHeadersMiddleware({
 *   useNonce: true,
 * }));
 * ```
 */
export declare function securityHeadersMiddleware(options?: SecurityHeadersOptions): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Create security headers middleware specifically for Swagger UI
 *
 * Applies CSP and security headers optimized for Swagger UI pages
 * that serve self-hosted Swagger UI assets.
 *
 * @param options - Additional security header options
 * @returns Fastify onRequest hook function
 */
export declare function swaggerSecurityHeaders(options?: Omit<SecurityHeadersOptions, 'csp'>): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Apply default security headers to a FastifyReply
 *
 * Convenience function to apply all default security headers
 * to a single response without middleware registration.
 *
 * @param reply - Fastify reply object
 * @param csp - Optional CSP directives (defaults to API CSP)
 */
export declare function applySecurityHeaders(reply: FastifyReply, csp?: CspDirectives | false): void;
/**
 * Register security headers plugin for Fastify
 *
 * Registers the security headers middleware as a Fastify plugin,
 * applying headers to all requests by default.
 *
 * @param server - Fastify instance
 * @param options - Security headers configuration
 *
 * @example
 * ```typescript
 * await server.register(registerSecurityHeadersPlugin, {
 *   environmentCsp: ENVIRONMENT_CSP_CONFIG,
 *   useNonce: true,
 *   excludePaths: ['/health', '/metrics'],
 * });
 * ```
 */
export declare function registerSecurityHeadersPlugin(server: FastifyInstance, options?: SecurityHeadersOptions): Promise<void>;
/**
 * Pre-computed SRI hashes for Swagger UI 5.x assets
 *
 * These hashes should be updated when Swagger UI version changes.
 * Use generateSriHashForFile() to regenerate hashes.
 *
 * Note: When self-hosting, generate hashes from your actual files.
 */
export declare const SWAGGER_UI_SRI_HASHES: {
    readonly css: "sha384-PLACEHOLDER-GENERATE-FROM-ACTUAL-FILE";
    readonly bundle: "sha384-PLACEHOLDER-GENERATE-FROM-ACTUAL-FILE";
    readonly standalonePreset: "sha384-PLACEHOLDER-GENERATE-FROM-ACTUAL-FILE";
};
/**
 * Generate SRI hash for a file (for build-time hash generation)
 *
 * @param content - File content as string or Buffer
 * @returns SRI integrity attribute value
 */
export declare function generateSriHashForFile(content: string | Buffer): string;
declare module 'fastify' {
    interface FastifyInstance {
        generateCspNonce: typeof generateNonce;
        generateSriHash: typeof generateSriHash;
        verifySriHash: typeof verifySriHash;
    }
    interface FastifyRequest {
        cspNonce?: string;
    }
}
//# sourceMappingURL=security-headers.d.ts.map