import { ExcludePattern } from "@astroscope/excludes";
import { APIContext, AstroIntegration, MiddlewareHandler } from "astro";

//#region src/types.d.ts
/**
 * Options for the CSRF integration and middleware.
 *
 * Origin validation compares the request's Origin header against context.url.origin.
 * Configure `security.allowedDomains` in your Astro config to ensure context.url is correct.
 */
type CsrfOptions = {
  /**
   * Whether CSRF protection is enabled.
   * @default true
   * @example
   * ```ts
   * // disable in development
   * csrf({ enabled: import.meta.env.PROD })
   * ```
   */
  enabled?: boolean | undefined;
  /**
   * Paths to exclude from CSRF protection.
   * Can be an array of patterns or a function that returns true to exclude.
   */
  exclude?: ExcludePattern[] | ((context: APIContext) => boolean) | undefined;
};
//#endregion
//#region src/integration.d.ts
/**
 * Astro integration for CSRF protection.
 *
 * Automatically:
 * - Adds CSRF protection middleware
 * - Disables Astro's built-in `security.checkOrigin`
 *
 * Origin validation compares the request's Origin header against context.url.origin.
 * Configure `security.allowedDomains` in your Astro config to ensure context.url is correct.
 *
 * @example
 * ```ts
 * // astro.config.ts
 * import { defineConfig } from "astro/config";
 * import csrf from "@astroscope/csrf";
 *
 * export default defineConfig({
 *   security: {
 *     allowedDomains: [{}], // trust all domains (e.g. behind a proxy)
 *   },
 *   integrations: [
 *     csrf(),
 *   ],
 * });
 * ```
 *
 * @example
 * ```ts
 * // with exclusions
 * csrf({
 *   exclude: [{ prefix: '/webhook/' }, { exact: '/api/health' }],
 * })
 * ```
 *
 * @example
 * ```ts
 * // disable in development
 * csrf({ enabled: import.meta.env.PROD })
 * ```
 */
declare function csrf(options?: CsrfOptions): AstroIntegration;
//#endregion
//#region src/middleware.d.ts
/**
 * Creates a CSRF protection middleware with the given options.
 *
 * Compares the request's Origin header against context.url.origin.
 * Configure `security.allowedDomains` in your Astro config to ensure context.url is correct.
 *
 * @example
 * ```ts
 * // src/middleware.ts
 * import { sequence } from 'astro:middleware';
 * import { createCsrfMiddleware } from '@astroscope/csrf';
 *
 * export const onRequest = sequence(
 *   createCsrfMiddleware({
 *     exclude: [{ prefix: '/auth/' }],
 *   }),
 * );
 * ```
 */
declare function createCsrfMiddleware(options?: CsrfOptions): MiddlewareHandler;
//#endregion
export { type CsrfOptions, createCsrfMiddleware, csrf as default };
//# sourceMappingURL=index.d.ts.map