/**
 * @fileoverview Authentication and security middleware.
 *
 * Extracted from server.ts setupRoutes() — handles:
 * - HTTP Basic Auth with session cookies
 * - Rate limiting (per-IP failure tracking)
 * - Security headers (CSP, X-Frame-Options, HSTS)
 * - CORS (localhost only)
 */
import type { FastifyInstance } from 'fastify';
import { StaleExpirationMap } from '../../utils/index.js';
import type { AuthSessionRecord } from '../ports/auth-port.js';
import { type HostPolicy } from '../network-auth-policy.js';
export declare const AUTH_COOKIE_NAME = "codeman_session";
/** State returned from registerAuthMiddleware for cleanup in server stop() */
interface AuthState {
    authSessions: StaleExpirationMap<string, AuthSessionRecord> | null;
    authFailures: StaleExpirationMap<string, number> | null;
    qrAuthFailures: StaleExpirationMap<string, number> | null;
    hookSecretFailures: StaleExpirationMap<string, number> | null;
}
/**
 * Register HTTP Basic Auth middleware with session cookies and rate limiting.
 * Only active when CODEMAN_PASSWORD is set.
 *
 * @param getTunnelRunning - returns true while a managed tunnel is active. Used
 *   to gate the `/api/hook-event` localhost bypass: when a tunnel is up, tunneled
 *   internet traffic reaches the loopback origin with `req.ip === 127.0.0.1`, so
 *   the bypass additionally requires the shared hook secret (COD-54). When no
 *   tunnel is running (loopback-only, the normal case) the plain localhost bypass
 *   is kept so already-deployed (pre-secret) hooks + the loop channel keep working.
 *   Optional; defaults to "no tunnel" (unchanged behavior) when omitted.
 * @returns AuthState for lifecycle management (dispose on server stop)
 */
export declare function registerAuthMiddleware(app: FastifyInstance, https: boolean, getTunnelRunning?: () => boolean): AuthState;
/**
 * Register the anti-DNS-rebinding Host allowlist + cross-site (CSRF) Origin guard.
 *
 * This protects the API even on the default no-password install, where there is no
 * cookie/credential to gate on. It must be registered BEFORE the auth middleware so
 * forged cross-site or DNS-rebound requests are rejected up front. `getPolicy` is
 * evaluated per request so a tunnel started at runtime is reflected immediately.
 *
 * - Every request: the `Host` header must be in the allowlist (blocks DNS rebinding,
 *   where a custom domain is rebound to 127.0.0.1 but still sends its own name).
 * - State-changing methods: the `Origin` (when the client sends one — i.e. a browser)
 *   must be same-site (blocks cross-site CSRF, including the text/plain simple-request
 *   trick). Non-browser clients (curl, Claude Code hooks) omit Origin and pass.
 *
 * WebSocket upgrades are validated separately in the ws route handler.
 */
export declare function registerHostGuard(app: FastifyInstance, getPolicy: () => HostPolicy): void;
/**
 * Register security headers and CORS middleware on every response.
 */
export declare function registerSecurityHeaders(app: FastifyInstance, https: boolean): void;
export {};
//# sourceMappingURL=auth.d.ts.map