/**
 * Data Loss Prevention (DLP) Content Scanner
 *
 * Comprehensive sensitive data detection and protection:
 * - Credit card numbers (Visa, Mastercard, Amex, Discover)
 * - Social Security Numbers (US SSN)
 * - API keys (AWS, GCP, Azure, Stripe, GitHub)
 * - Private keys (RSA, EC, PGP)
 * - Passwords in URLs/JSON
 * - Email addresses (PII)
 * - Phone numbers (US, international)
 * - IP addresses
 * - JWT tokens
 * - Health data keywords
 *
 * Provides request/response scanning, redaction, and Fastify middleware integration.
 *
 * @packageDocumentation
 */
import type { FastifyRequest, FastifyPluginCallback, preHandlerHookHandler, onSendHookHandler } from 'fastify';
import { z } from 'zod';
import { VorionError } from '../../common/errors.js';
/**
 * Types of sensitive data that can be detected
 */
export declare enum DataType {
    /** Credit card numbers */
    CREDIT_CARD = "CREDIT_CARD",
    /** US Social Security Numbers */
    SSN = "SSN",
    /** API keys (AWS, GCP, Azure, Stripe, GitHub, etc.) */
    API_KEY = "API_KEY",
    /** Private keys (RSA, EC, PGP) */
    PRIVATE_KEY = "PRIVATE_KEY",
    /** Passwords in URLs or JSON */
    PASSWORD = "PASSWORD",
    /** Email addresses */
    EMAIL = "EMAIL",
    /** Phone numbers */
    PHONE = "PHONE",
    /** IP addresses */
    IP_ADDRESS = "IP_ADDRESS",
    /** JWT tokens */
    JWT = "JWT",
    /** Health data keywords */
    HEALTH_DATA = "HEALTH_DATA"
}
/**
 * Risk level assessment
 */
export type DlpRiskLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
/**
 * Scanning mode
 */
export type ScanMode = 'detect' | 'redact' | 'block';
/**
 * Individual sensitive data finding
 */
export interface DLPFinding {
    /** Type of sensitive data detected */
    type: DataType;
    /** Masked value (e.g., "****1234") */
    value: string;
    /** Location in content (JSON path or field name) */
    location: string;
    /** Detection confidence (0-100) */
    confidence: number;
    /** Surrounding text for context */
    context: string;
}
/**
 * DLP scan result
 */
export interface DLPScanResult {
    /** Whether sensitive data was detected */
    hasSensitiveData: boolean;
    /** List of findings */
    findings: DLPFinding[];
    /** Overall risk level */
    riskLevel: DlpRiskLevel;
    /** Time taken to scan in milliseconds */
    scanTimeMs: number;
}
/**
 * DLP scanner configuration
 */
export interface DLPScannerConfig {
    /** Data types to detect (default: all) */
    enabledTypes: DataType[];
    /** Maximum content size to scan in bytes (default: 1MB) */
    maxScanSize: number;
    /** Maximum scan timeout in milliseconds (default: 100ms) */
    scanTimeoutMs: number;
    /** Custom patterns to detect (maps pattern name to regex) */
    customPatterns: Map<string, RegExp>;
    /** Field names to skip scanning */
    skipFields: string[];
    /** Whether to log findings */
    logFindings: boolean;
    /** Context length for findings (characters before/after) */
    contextLength: number;
}
/**
 * Zod schema for DLP scanner configuration
 */
export declare const dlpScannerConfigSchema: z.ZodObject<{
    enabledTypes: z.ZodDefault<z.ZodArray<z.ZodNativeEnum<typeof DataType>, "many">>;
    maxScanSize: z.ZodDefault<z.ZodNumber>;
    scanTimeoutMs: z.ZodDefault<z.ZodNumber>;
    customPatterns: z.ZodOptional<z.ZodMap<z.ZodString, z.ZodType<RegExp, z.ZodTypeDef, RegExp>>>;
    skipFields: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
    logFindings: z.ZodDefault<z.ZodBoolean>;
    contextLength: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    customPatterns?: Map<string, RegExp>;
    enabledTypes?: DataType[];
    maxScanSize?: number;
    scanTimeoutMs?: number;
    skipFields?: string[];
    logFindings?: boolean;
    contextLength?: number;
}, {
    customPatterns?: Map<string, RegExp>;
    enabledTypes?: DataType[];
    maxScanSize?: number;
    scanTimeoutMs?: number;
    skipFields?: string[];
    logFindings?: boolean;
    contextLength?: number;
}>;
/**
 * Base DLP error class
 */
export declare class DLPError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Error thrown when sensitive data is detected and blocking is enabled
 */
export declare class SensitiveDataBlockedError extends VorionError {
    readonly findings: DLPFinding[];
    readonly riskLevel: DlpRiskLevel;
    code: string;
    statusCode: number;
    constructor(message: string, findings: DLPFinding[], riskLevel: DlpRiskLevel);
}
/**
 * Error thrown when scan timeout is exceeded
 */
export declare class DLPScanTimeoutError extends DLPError {
    code: string;
    constructor(timeoutMs: number);
}
/**
 * Default DLP scanner configuration
 */
export declare const DEFAULT_DLP_CONFIG: DLPScannerConfig;
/**
 * Data Loss Prevention Scanner
 *
 * Detects sensitive data in content and provides redaction capabilities.
 *
 * @example
 * ```typescript
 * const scanner = new DLPScanner({
 *   enabledTypes: [DataType.CREDIT_CARD, DataType.SSN],
 *   logFindings: true,
 * });
 *
 * const result = await scanner.scan('My card is 4111111111111111');
 * if (result.hasSensitiveData) {
 *   console.log('Sensitive data detected:', result.findings);
 * }
 * ```
 */
export declare class DLPScanner {
    private readonly config;
    private readonly enabledTypesSet;
    private readonly skipFieldsSet;
    private readonly healthKeywordsPattern;
    /**
     * Create a new DLPScanner instance
     *
     * @param config - Scanner configuration options
     */
    constructor(config?: Partial<DLPScannerConfig>);
    /**
     * Scan content for sensitive data
     *
     * @param content - String or object to scan
     * @returns Scan result with findings
     */
    scan(content: string | object): Promise<DLPScanResult>;
    /**
     * Scan a Fastify request body
     *
     * @param request - Fastify request
     * @returns Scan result
     */
    scanRequest(request: FastifyRequest): Promise<DLPScanResult>;
    /**
     * Scan a response body
     *
     * @param response - Response body (string or object)
     * @returns Scan result
     */
    scanResponse(response: unknown): Promise<DLPScanResult>;
    /**
     * Redact sensitive data from content
     *
     * @param content - Content to redact
     * @param findings - Findings to redact
     * @returns Redacted content
     */
    redact(content: string, findings: DLPFinding[]): string;
    /**
     * Scan content with timeout protection
     */
    private scanWithTimeout;
    /**
     * Perform the actual content scanning
     */
    private scanContent;
    /**
     * Scan for credit card numbers
     */
    private scanCreditCards;
    /**
     * Scan for SSNs
     */
    private scanSSN;
    /**
     * Scan for API keys
     */
    private scanAPIKeys;
    /**
     * Scan for private keys
     */
    private scanPrivateKeys;
    /**
     * Scan for passwords
     */
    private scanPasswords;
    /**
     * Scan for email addresses
     */
    private scanEmails;
    /**
     * Scan for phone numbers
     */
    private scanPhoneNumbers;
    /**
     * Scan for IP addresses
     */
    private scanIPAddresses;
    /**
     * Scan for JWTs
     */
    private scanJWTs;
    /**
     * Scan for health data keywords
     */
    private scanHealthData;
    /**
     * Scan with custom pattern
     */
    private scanCustomPattern;
    /**
     * Calculate overall risk level from findings
     */
    private calculateRiskLevel;
    /**
     * Extract context around a match
     */
    private extractContext;
    /**
     * Validate credit card number with Luhn algorithm
     */
    private isValidLuhn;
    /**
     * Check if IP is private
     */
    private isPrivateIP;
    /**
     * Get API key confidence based on provider
     */
    private getAPIKeyConfidence;
    /**
     * Get patterns for a data type (for redaction)
     */
    private getPatternsForType;
    /**
     * Create a mask based on data type
     */
    private createMask;
    private maskCreditCard;
    private maskSSN;
    private maskAPIKey;
    private maskEmail;
    private maskPhone;
    private maskIP;
    private maskJWT;
    private maskGeneric;
    /**
     * Get the current configuration
     */
    getConfig(): DLPScannerConfig;
    /**
     * Add a custom pattern at runtime
     */
    addCustomPattern(name: string, pattern: RegExp): void;
}
/**
 * Options for DLP request scanner middleware
 */
export interface DLPRequestScannerOptions {
    /** Scanner configuration */
    config?: Partial<DLPScannerConfig>;
    /** Scanning mode */
    mode: ScanMode;
    /** Paths to skip scanning */
    skipPaths?: string[];
    /** HTTP methods to skip */
    skipMethods?: string[];
    /** Data types to detect (overrides config) */
    detectTypes?: DataType[];
    /** Custom error response */
    errorResponse?: {
        statusCode: number;
        code: string;
        message: string;
    };
}
/**
 * Options for DLP response scanner middleware
 */
export interface DLPResponseScannerOptions {
    /** Scanner configuration */
    config?: Partial<DLPScannerConfig>;
    /** Scanning mode */
    mode: ScanMode;
    /** Paths to skip scanning */
    skipPaths?: string[];
    /** Data types to detect */
    detectTypes?: DataType[];
    /** Whether to redact before sending */
    redactResponse?: boolean;
}
/**
 * Create a DLP request scanner middleware (preHandler)
 *
 * @param options - Middleware options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * fastify.addHook('preHandler', dlpRequestScanner({
 *   mode: 'block',
 *   detectTypes: [DataType.CREDIT_CARD, DataType.SSN],
 *   skipPaths: ['/health'],
 * }));
 * ```
 */
export declare function dlpRequestScanner(options: DLPRequestScannerOptions): preHandlerHookHandler;
/**
 * Create a DLP response scanner middleware (onSend)
 *
 * @param options - Middleware options
 * @returns Fastify onSend hook
 *
 * @example
 * ```typescript
 * fastify.addHook('onSend', dlpResponseScanner({
 *   mode: 'redact',
 *   detectTypes: [DataType.CREDIT_CARD, DataType.SSN],
 *   redactResponse: true,
 * }));
 * ```
 */
export declare function dlpResponseScanner(options: DLPResponseScannerOptions): onSendHookHandler;
/**
 * DLP plugin options
 */
export interface DLPPluginOptions {
    /** Scanner configuration */
    config?: Partial<DLPScannerConfig>;
    /** Request scanning options */
    requestScanning?: {
        enabled: boolean;
        mode: ScanMode;
        skipPaths?: string[];
        skipMethods?: string[];
        detectTypes?: DataType[];
    };
    /** Response scanning options */
    responseScanning?: {
        enabled: boolean;
        mode: ScanMode;
        skipPaths?: string[];
        detectTypes?: DataType[];
        redactResponse?: boolean;
    };
}
/**
 * DLP Fastify plugin
 *
 * @example
 * ```typescript
 * await fastify.register(dlpPlugin, {
 *   config: {
 *     enabledTypes: [DataType.CREDIT_CARD, DataType.SSN, DataType.API_KEY],
 *   },
 *   requestScanning: {
 *     enabled: true,
 *     mode: 'block',
 *     skipPaths: ['/health', '/metrics'],
 *   },
 *   responseScanning: {
 *     enabled: true,
 *     mode: 'redact',
 *   },
 * });
 * ```
 */
export declare const dlpPlugin: FastifyPluginCallback<DLPPluginOptions>;
declare module 'fastify' {
    interface FastifyInstance {
        dlpScanner?: DLPScanner;
    }
}
/**
 * Get or create the singleton DLPScanner instance
 *
 * @param config - Optional configuration (only used on first call)
 * @returns The singleton DLPScanner instance
 */
export declare function getDLPScanner(config?: Partial<DLPScannerConfig>): DLPScanner;
/**
 * Reset the singleton instance (for testing)
 */
export declare function resetDLPScanner(): void;
/**
 * Create a new DLPScanner instance
 *
 * @param config - Configuration options
 * @returns New DLPScanner instance
 */
export declare function createDLPScanner(config?: Partial<DLPScannerConfig>): DLPScanner;
//# sourceMappingURL=scanner.d.ts.map