/**
 * Error Sanitization Middleware
 *
 * Prevents information disclosure through error messages by:
 * - Detecting and redacting sensitive data patterns
 * - Classifying errors (operational vs programming)
 * - Generating user-safe error messages
 * - Providing correlation IDs for support
 *
 * @packageDocumentation
 * @module security/error-sanitizer
 */
import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyError } from 'fastify';
import { z } from 'zod';
/**
 * Sanitized error response structure
 */
export interface SanitizedError {
    /** Machine-readable error code */
    code: string;
    /** User-safe error message */
    message: string;
    /** Request ID for support correlation */
    requestId?: string;
    /** Additional details (only in development mode) */
    details?: unknown;
}
/**
 * Error classification type
 */
export type ErrorClassification = 'operational' | 'programming';
/**
 * Configuration for error sanitizer
 */
export interface ErrorSanitizerConfig {
    /** Whether running in production mode */
    isProduction: boolean;
    /** Whether to include stack traces in development */
    includeStackInDev: boolean;
    /** Whether to include error details in development */
    includeDetailsInDev: boolean;
    /** Custom error code mappings */
    errorCodeMappings?: Map<string, ErrorCodeMapping>;
    /** Additional sensitive patterns to detect */
    additionalPatterns?: RegExp[];
    /** Whether to log sanitized errors */
    logSanitizedErrors: boolean;
    /** Function to generate request IDs */
    generateRequestId?: () => string;
}
/**
 * Mapping from internal error code to user-facing response
 */
export interface ErrorCodeMapping {
    /** User-friendly message */
    message: string;
    /** HTTP status code */
    statusCode: number;
}
/**
 * Zod schema for error sanitizer configuration
 */
export declare const errorSanitizerConfigSchema: z.ZodObject<{
    isProduction: z.ZodDefault<z.ZodBoolean>;
    includeStackInDev: z.ZodDefault<z.ZodBoolean>;
    includeDetailsInDev: z.ZodDefault<z.ZodBoolean>;
    additionalPatterns: z.ZodOptional<z.ZodArray<z.ZodType<RegExp, z.ZodTypeDef, RegExp>, "many">>;
    logSanitizedErrors: z.ZodDefault<z.ZodBoolean>;
}, "strip", z.ZodTypeAny, {
    isProduction?: boolean;
    includeStackInDev?: boolean;
    includeDetailsInDev?: boolean;
    additionalPatterns?: RegExp[];
    logSanitizedErrors?: boolean;
}, {
    isProduction?: boolean;
    includeStackInDev?: boolean;
    includeDetailsInDev?: boolean;
    additionalPatterns?: RegExp[];
    logSanitizedErrors?: boolean;
}>;
/**
 * Patterns for detecting sensitive data that should be redacted
 */
export declare const SENSITIVE_PATTERNS: {
    /** File paths - Unix and Windows */
    readonly FILE_PATHS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
    /** IPv4 addresses */
    readonly IPV4: readonly [RegExp];
    /** IPv6 addresses */
    readonly IPV6: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    /** Database connection strings */
    readonly DATABASE_CONNECTIONS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    /** API keys, tokens, and credentials */
    readonly CREDENTIALS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
    /** Stack traces */
    readonly STACK_TRACES: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    /** SQL queries */
    readonly SQL_QUERIES: readonly [RegExp, RegExp, RegExp];
    /** Internal service URLs */
    readonly INTERNAL_URLS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp];
    /** Environment variable references */
    readonly ENV_VARIABLES: readonly [RegExp, RegExp, RegExp, RegExp];
    /** JWT tokens */
    readonly JWT_TOKENS: readonly [RegExp];
    /** UUIDs (often used as internal IDs) */
    readonly UUIDS: readonly [RegExp];
};
/**
 * Default mappings from internal error codes to user-friendly responses
 */
export declare const DEFAULT_ERROR_MAPPINGS: Map<string, ErrorCodeMapping>;
/**
 * ErrorSanitizer class for preventing information disclosure
 *
 * @example
 * ```typescript
 * const sanitizer = new ErrorSanitizer({ isProduction: true });
 *
 * // Sanitize an error message
 * const safeMessage = sanitizer.sanitizeMessage(error.message);
 *
 * // Generate a safe error response
 * const response = sanitizer.createSafeResponse(error, requestId);
 * ```
 */
export declare class ErrorSanitizer {
    private readonly config;
    private readonly errorMappings;
    private readonly allPatterns;
    /**
     * Creates a new ErrorSanitizer instance
     *
     * @param config - Configuration options
     */
    constructor(config?: Partial<ErrorSanitizerConfig>);
    /**
     * Sanitize an error message by removing sensitive data
     *
     * @param message - The error message to sanitize
     * @returns Sanitized message
     */
    sanitizeMessage(message: string): string;
    /**
     * Classify an error as operational or programming
     *
     * Operational errors are expected errors from normal operation
     * (e.g., validation failures, not found, rate limits).
     *
     * Programming errors are bugs that shouldn't happen
     * (e.g., TypeError, ReferenceError, unexpected exceptions).
     *
     * @param error - The error to classify
     * @returns Error classification
     */
    classifyError(error: Error): ErrorClassification;
    /**
     * Generate a safe error message for the user
     *
     * @param error - The error to generate a message for
     * @returns User-safe error message
     */
    generateSafeMessage(error: Error): string;
    /**
     * Get the error code from an error
     *
     * @param error - The error
     * @returns Error code string
     */
    getErrorCode(error: Error): string;
    /**
     * Get the HTTP status code for an error
     *
     * @param error - The error
     * @returns HTTP status code
     */
    getStatusCode(error: Error): number;
    /**
     * Create a sanitized error response
     *
     * @param error - The error to create a response for
     * @param requestId - Optional request ID for correlation
     * @returns Sanitized error response
     */
    createSafeResponse(error: Error, requestId?: string): SanitizedError;
    /**
     * Sanitize an object by redacting sensitive values
     *
     * @param obj - Object to sanitize
     * @param depth - Current recursion depth
     * @returns Sanitized object
     */
    private sanitizeObject;
    /**
     * Add a custom error code mapping
     *
     * @param code - Error code
     * @param mapping - Error code mapping
     */
    addErrorMapping(code: string, mapping: ErrorCodeMapping): void;
    /**
     * Check if running in production mode
     */
    isProductionMode(): boolean;
}
/**
 * Sanitize an error message by removing sensitive data
 *
 * Standalone utility function for one-off sanitization.
 *
 * @param message - The error message to sanitize
 * @returns Sanitized message
 *
 * @example
 * ```typescript
 * const safe = sanitizeErrorMessage('Error connecting to postgres://user:pass@host/db');
 * // Returns: 'Error connecting to [REDACTED]'
 * ```
 */
export declare function sanitizeErrorMessage(message: string): string;
/**
 * Classify an error as operational or programming
 *
 * @param error - The error to classify
 * @returns 'operational' or 'programming'
 *
 * @example
 * ```typescript
 * const classification = classifyError(new ValidationError('Invalid input'));
 * // Returns: 'operational'
 *
 * const bugClassification = classifyError(new TypeError('undefined is not a function'));
 * // Returns: 'programming'
 * ```
 */
export declare function classifyError(error: Error): ErrorClassification;
/**
 * Generate a safe error message for the user
 *
 * @param error - The error to generate a message for
 * @returns User-safe error message
 *
 * @example
 * ```typescript
 * const safeMsg = generateSafeMessage(new Error('Connection to 192.168.1.1:5432 failed'));
 * // Returns: 'An unexpected error occurred'
 * ```
 */
export declare function generateSafeMessage(error: Error): string;
/**
 * Options for the Fastify error handler plugin
 */
export interface ErrorHandlerOptions {
    /** Error sanitizer configuration */
    sanitizerConfig?: Partial<ErrorSanitizerConfig>;
    /** Custom error sanitizer instance */
    sanitizer?: ErrorSanitizer;
    /** Whether to log all errors */
    logErrors?: boolean;
    /** Paths to exclude from error handling */
    excludePaths?: string[];
}
/**
 * Create a Fastify error handler that sanitizes errors
 *
 * @param options - Error handler options
 * @returns Fastify error handler function
 *
 * @example
 * ```typescript
 * fastify.setErrorHandler(createErrorHandler({
 *   logErrors: true,
 *   sanitizerConfig: { isProduction: true },
 * }));
 * ```
 */
export declare function createErrorHandler(options?: ErrorHandlerOptions): (error: FastifyError, request: FastifyRequest, reply: FastifyReply) => void;
/**
 * Fastify plugin that registers the sanitizing error handler
 *
 * @example
 * ```typescript
 * await fastify.register(errorSanitizerPlugin, {
 *   sanitizerConfig: { isProduction: true },
 *   logErrors: true,
 * });
 * ```
 */
export declare const errorSanitizerPlugin: (fastify: FastifyInstance, options: ErrorHandlerOptions) => Promise<void>;
/**
 * Get or create the singleton ErrorSanitizer instance
 *
 * @param config - Optional configuration (only used on first call)
 * @returns The singleton ErrorSanitizer instance
 *
 * @example
 * ```typescript
 * // Initialize with config
 * const sanitizer = getErrorSanitizer({ isProduction: true });
 *
 * // Later, get the same instance
 * const sameSanitizer = getErrorSanitizer();
 * ```
 */
export declare function getErrorSanitizer(config?: Partial<ErrorSanitizerConfig>): ErrorSanitizer;
/**
 * Reset the singleton instance (for testing)
 *
 * @internal
 */
export declare function resetErrorSanitizer(): void;
/**
 * Create a new ErrorSanitizer instance with custom configuration
 *
 * Use this when you need a non-singleton instance with specific configuration.
 *
 * @param config - Configuration options
 * @returns New ErrorSanitizer instance
 *
 * @example
 * ```typescript
 * const customSanitizer = createErrorSanitizer({
 *   isProduction: false,
 *   additionalPatterns: [/my-secret-pattern/gi],
 * });
 * ```
 */
export declare function createErrorSanitizer(config?: Partial<ErrorSanitizerConfig>): ErrorSanitizer;
//# sourceMappingURL=error-sanitizer.d.ts.map