/**
 * Injection Detection System
 *
 * Comprehensive detection and prevention of injection attacks including:
 * - SQL Injection
 * - Cross-Site Scripting (XSS)
 * - Command Injection
 * - Template Injection
 * - Path Traversal
 * - LDAP Injection
 * - XML Injection (XXE)
 * - NoSQL Injection
 *
 * Provides configurable detection, allowlisting, and Fastify middleware integration.
 *
 * @packageDocumentation
 */
import type { FastifyPluginCallback, preHandlerHookHandler } from 'fastify';
import { ValidationError } from '../common/validation.js';
/**
 * Types of injection attacks that can be detected
 */
export declare enum InjectionType {
    /** SQL Injection - attacks targeting SQL databases */
    SQL = "SQL",
    /** Cross-Site Scripting - malicious script injection */
    XSS = "XSS",
    /** Command Injection - OS command execution */
    COMMAND = "COMMAND",
    /** Template Injection - server-side template manipulation */
    TEMPLATE = "TEMPLATE",
    /** Path Traversal - unauthorized file system access */
    PATH_TRAVERSAL = "PATH_TRAVERSAL",
    /** LDAP Injection - directory service attacks */
    LDAP = "LDAP",
    /** XML Injection - XML External Entity attacks */
    XML = "XML",
    /** NoSQL Injection - attacks targeting NoSQL databases */
    NOSQL = "NOSQL"
}
/**
 * Comprehensive regex patterns for detecting various injection attacks.
 * Patterns are designed to minimize false positives while catching common attack vectors.
 */
export declare const INJECTION_PATTERNS: Record<InjectionType, RegExp[]>;
/**
 * Configuration options for the injection detector
 */
export interface InjectionDetectorConfig {
    /** Enable SQL injection detection */
    enableSQLDetection: boolean;
    /** Enable XSS detection */
    enableXSSDetection: boolean;
    /** Enable command injection detection */
    enableCommandDetection: boolean;
    /** Enable template injection detection */
    enableTemplateDetection: boolean;
    /** Enable path traversal detection */
    enablePathTraversalDetection: boolean;
    /** Enable LDAP injection detection */
    enableLDAPDetection: boolean;
    /** Enable XML/XXE injection detection */
    enableXMLDetection: boolean;
    /** Enable NoSQL injection detection */
    enableNoSQLDetection: boolean;
    /** Custom regex patterns to check */
    customPatterns: RegExp[];
    /** Known safe patterns to allowlist (bypass detection) */
    allowlist: string[];
    /** Whether to log detection events */
    logDetections: boolean;
    /** Whether to block requests on detection (vs just logging) */
    blockOnDetection: boolean;
}
/**
 * Result of injection detection analysis
 */
export interface InjectionDetectionResult {
    /** Whether any injection was detected */
    detected: boolean;
    /** Types of injections detected */
    types: InjectionType[];
    /** String representations of patterns that matched */
    patterns: string[];
    /** Sanitized version of input if sanitization was applied */
    sanitized?: string;
    /** Original input for reference */
    originalInput?: string;
    /** Timestamp of detection */
    detectedAt?: string;
}
/**
 * Options for the injection detection middleware
 */
export interface InjectionDetectionMiddlewareOptions {
    /** Injection detector configuration */
    config?: Partial<InjectionDetectorConfig>;
    /** Paths to skip detection for */
    skipPaths?: string[];
    /** HTTP methods to skip */
    skipMethods?: string[];
    /** Whether to check query parameters */
    checkQuery?: boolean;
    /** Whether to check request body */
    checkBody?: boolean;
    /** Whether to check headers */
    checkHeaders?: boolean;
    /** Headers to skip checking */
    skipHeaders?: string[];
    /** Custom error response */
    errorResponse?: {
        statusCode: number;
        code: string;
        message: string;
    };
}
/**
 * Default injection detector configuration with all detections enabled
 */
export declare const DEFAULT_INJECTION_DETECTOR_CONFIG: InjectionDetectorConfig;
/**
 * Injection attack detector with comprehensive pattern matching
 *
 * Provides detection, sanitization, and allowlisting capabilities for
 * protecting against various injection attack vectors.
 *
 * @example
 * ```typescript
 * const detector = new InjectionDetector({
 *   enableSQLDetection: true,
 *   enableXSSDetection: true,
 *   logDetections: true,
 * });
 *
 * const result = detector.detect("SELECT * FROM users WHERE id = '1' OR '1'='1'");
 * if (result.detected) {
 *   console.log('Injection detected:', result.types);
 * }
 * ```
 */
export declare class InjectionDetector {
    private config;
    private allowlistPatterns;
    /**
     * Create a new InjectionDetector instance
     *
     * @param config - Configuration options (merged with defaults)
     */
    constructor(config?: Partial<InjectionDetectorConfig>);
    /**
     * Detect injection attacks in an input string
     *
     * Checks the input against all enabled detection patterns and returns
     * detailed information about any matches found.
     *
     * @param input - The string to analyze for injection patterns
     * @returns Detection result with matched types and patterns
     *
     * @example
     * ```typescript
     * const result = detector.detect("<script>alert('xss')</script>");
     * // result.detected === true
     * // result.types includes InjectionType.XSS
     * ```
     */
    detect(input: string): InjectionDetectionResult;
    /**
     * Detect injection attacks in all string values of an object
     *
     * Recursively traverses an object and checks all string values for
     * injection patterns. Returns a map of field paths to detection results.
     *
     * @param obj - The object to analyze
     * @param prefix - Internal prefix for tracking nested paths
     * @returns Map of field paths to their detection results
     *
     * @example
     * ```typescript
     * const results = detector.detectInObject({
     *   username: "admin",
     *   query: "SELECT * FROM users",
     *   nested: { field: "<script>xss</script>" }
     * });
     *
     * for (const [field, result] of results) {
     *   if (result.detected) {
     *     console.log(`Injection in ${field}:`, result.types);
     *   }
     * }
     * ```
     */
    detectInObject(obj: Record<string, unknown>, prefix?: string): Map<string, InjectionDetectionResult>;
    /**
     * Sanitize an input string by removing or escaping dangerous patterns
     *
     * Applies multiple sanitization techniques to neutralize potential
     * injection attacks while preserving legitimate content where possible.
     *
     * @param input - The string to sanitize
     * @returns Sanitized string
     *
     * @example
     * ```typescript
     * const sanitized = detector.sanitize("<script>alert('xss')</script>Hello");
     * // sanitized === "&lt;script&gt;alert('xss')&lt;/script&gt;Hello"
     * ```
     */
    sanitize(input: string): string;
    /**
     * Check if an input string is in the allowlist
     *
     * Allowlisted strings bypass injection detection entirely.
     * Use sparingly for known-safe patterns.
     *
     * @param input - The string to check
     * @returns True if the string is allowlisted
     *
     * @example
     * ```typescript
     * const detector = new InjectionDetector({
     *   allowlist: ['SELECT count(*) FROM users']
     * });
     *
     * detector.isAllowlisted('SELECT count(*) FROM users'); // true
     * detector.isAllowlisted('SELECT * FROM users');        // false
     * ```
     */
    isAllowlisted(input: string): boolean;
    /**
     * Add a pattern to the allowlist at runtime
     *
     * @param pattern - The pattern string to allowlist
     */
    addToAllowlist(pattern: string): void;
    /**
     * Add a custom detection pattern at runtime
     *
     * @param pattern - The regex pattern to add
     */
    addCustomPattern(pattern: RegExp): void;
    /**
     * Get the current configuration
     *
     * @returns Current detector configuration
     */
    getConfig(): InjectionDetectorConfig;
    /**
     * Update configuration at runtime
     *
     * @param updates - Partial configuration updates
     */
    updateConfig(updates: Partial<InjectionDetectorConfig>): void;
}
/**
 * Error thrown when an injection attack is detected
 */
export declare class InjectionDetectedError extends ValidationError {
    /** Types of injections detected */
    injectionTypes: InjectionType[];
    /** Detection result details */
    detectionResult: InjectionDetectionResult;
    constructor(message: string, detectionResult: InjectionDetectionResult, field?: string);
}
/**
 * Fastify middleware type
 */
export type FastifyMiddleware = preHandlerHookHandler;
/**
 * Create a Fastify middleware for injection detection
 *
 * Automatically checks request query parameters, body, and headers
 * for injection attacks based on configuration.
 *
 * @param options - Middleware configuration options
 * @returns Fastify preHandler hook function
 *
 * @example
 * ```typescript
 * import Fastify from 'fastify';
 * import { createInjectionDetectionMiddleware } from './injection-detector.js';
 *
 * const fastify = Fastify();
 *
 * fastify.addHook('preHandler', createInjectionDetectionMiddleware({
 *   config: {
 *     enableSQLDetection: true,
 *     enableXSSDetection: true,
 *     logDetections: true,
 *     blockOnDetection: true,
 *   },
 *   skipPaths: ['/health', '/metrics'],
 *   checkQuery: true,
 *   checkBody: true,
 *   checkHeaders: false,
 * }));
 * ```
 */
export declare function createInjectionDetectionMiddleware(options?: InjectionDetectionMiddlewareOptions): FastifyMiddleware;
/**
 * Fastify plugin options
 */
export interface InjectionDetectionPluginOptions extends InjectionDetectionMiddlewareOptions {
    /** Register the detector as a request decorator */
    decorateRequest?: boolean;
}
/**
 * Fastify plugin for comprehensive injection detection
 *
 * Provides automatic injection detection on all routes with
 * configurable options.
 *
 * @example
 * ```typescript
 * import Fastify from 'fastify';
 * import { injectionDetectionPlugin } from './injection-detector.js';
 *
 * const fastify = Fastify();
 *
 * await fastify.register(injectionDetectionPlugin, {
 *   config: {
 *     enableSQLDetection: true,
 *     enableXSSDetection: true,
 *     blockOnDetection: true,
 *   },
 *   skipPaths: ['/health', '/metrics'],
 * });
 * ```
 */
export declare const injectionDetectionPlugin: FastifyPluginCallback<InjectionDetectionPluginOptions>;
declare module 'fastify' {
    interface FastifyInstance {
        injectionDetector?: InjectionDetector;
    }
}
/**
 * Create a pre-configured detector for SQL-only detection
 *
 * @returns InjectionDetector configured for SQL injection only
 */
export declare function createSQLInjectionDetector(): InjectionDetector;
/**
 * Create a pre-configured detector for XSS-only detection
 *
 * @returns InjectionDetector configured for XSS detection only
 */
export declare function createXSSDetector(): InjectionDetector;
/**
 * Create a pre-configured detector for API security (SQL, NoSQL, Command)
 *
 * @returns InjectionDetector configured for common API attack vectors
 */
export declare function createAPISecurityDetector(): InjectionDetector;
/**
 * Quick check function for ad-hoc injection detection
 *
 * @param input - String to check
 * @param types - Specific injection types to check (default: all)
 * @returns True if any injection patterns are detected
 *
 * @example
 * ```typescript
 * if (hasInjection(userInput, [InjectionType.SQL, InjectionType.XSS])) {
 *   throw new Error('Invalid input');
 * }
 * ```
 */
export declare function hasInjection(input: string, types?: InjectionType[]): boolean;
/**
 * Quick sanitize function for ad-hoc input sanitization
 *
 * @param input - String to sanitize
 * @returns Sanitized string
 */
export declare function sanitizeInput(input: string): string;
//# sourceMappingURL=injection-detector.d.ts.map