/**
 * Authentication Middleware
 *
 * Provides JWT-based authentication with tenant context extraction.
 *
 * @packageDocumentation
 */
import { FastifyRequest, FastifyReply } from 'fastify';
import { AuthContext as CanonicalAuthContext, GovernanceRole, HierarchyLevel, authContextSchema, governanceRoleSchema, hierarchyLevelSchema } from '@vorionsys/contracts/canonical';
export { CanonicalAuthContext, GovernanceRole, HierarchyLevel, authContextSchema, governanceRoleSchema, hierarchyLevelSchema, };
/**
 * Authenticated user context
 *
 * @deprecated Use `CanonicalAuthContext` from `@vorionsys/contracts` for new code.
 *             This interface is maintained for backwards compatibility and is a subset
 *             of the canonical type. The canonical type includes additional fields for
 *             governanceRole, sessionId, agentId, hierarchyLevel, and attributes.
 */
export interface AuthContext {
    userId: string;
    tenantId: string;
    roles: string[];
    permissions: string[];
}
/**
 * Extend FastifyRequest with auth context
 */
declare module 'fastify' {
    interface FastifyRequest {
        auth?: AuthContext;
    }
}
/**
 * Authentication middleware
 */
export declare function authenticate(request: FastifyRequest, reply: FastifyReply): Promise<void>;
/**
 * Authorization middleware factory
 * Checks if user has required permission
 */
export declare function requirePermission(permission: string): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Tenant authorization middleware
 * Verifies user can access the specified tenant's resources
 *
 * SECURITY FIX: Only 'super_admin' role can access cross-tenant resources.
 * Regular 'admin' role is now scoped to their own tenant only.
 * All cross-tenant access attempts are logged for audit purposes.
 */
export declare function requireTenantAccess(getTenantId: (request: FastifyRequest) => string | undefined): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Role check middleware factory
 */
export declare function requireRole(...roles: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
//# sourceMappingURL=auth.d.ts.map