/**
 * MFA Middleware for Fastify
 *
 * Provides middleware to enforce MFA verification on protected routes.
 * Can be used as a preHandler hook or route-level middleware.
 *
 * @packageDocumentation
 */
import type { preHandlerHookHandler } from 'fastify';
import type { MfaMiddlewareOptions } from './types.js';
/**
 * Extended request interface with MFA context
 */
export interface MfaRequestContext {
    /** Whether MFA is required for this user */
    mfaRequired: boolean;
    /** Whether MFA has been verified for this session */
    mfaVerified: boolean;
    /** Whether user is in grace period */
    inGracePeriod: boolean;
}
declare module 'fastify' {
    interface FastifyRequest {
        mfaContext?: MfaRequestContext;
    }
}
/**
 * Create MFA middleware that requires MFA verification
 *
 * This middleware checks if the user has MFA enabled and whether the current
 * session has completed MFA verification. If MFA is required but not verified,
 * it returns a 403 response with MFA challenge information.
 *
 * @param options - Middleware configuration options
 * @returns Fastify preHandler hook
 *
 * @example
 * ```typescript
 * // Apply to specific routes
 * fastify.route({
 *   method: 'POST',
 *   url: '/api/v1/sensitive-action',
 *   preHandler: [requireMfa()],
 *   handler: sensitiveActionHandler,
 * });
 *
 * // Apply globally with skip paths
 * fastify.addHook('preHandler', requireMfa({
 *   skipPaths: ['/health', '/api/v1/mfa/challenge'],
 *   allowGracePeriod: true,
 * }));
 * ```
 */
export declare function requireMfa(options?: MfaMiddlewareOptions): preHandlerHookHandler;
/**
 * Create MFA context middleware (non-blocking)
 *
 * This middleware decorates the request with MFA context information
 * but does not block the request. Useful for routes that need to know
 * MFA status but don't require it.
 *
 * @param options - Middleware configuration options
 * @returns Fastify preHandler hook
 */
export declare function mfaContextMiddleware(options?: MfaMiddlewareOptions): preHandlerHookHandler;
/**
 * Create middleware that requires MFA to be enabled for the user
 *
 * This is useful for sensitive operations that should only be available
 * to users with MFA enabled, regardless of current verification status.
 */
export declare function requireMfaEnabled(options?: MfaMiddlewareOptions): preHandlerHookHandler;
export { type MfaMiddlewareOptions, };
//# sourceMappingURL=mfa-middleware.d.ts.map