/**
 * @fileoverview Gateway authentication provider for API Gateway authentication.
 *
 * This provider parses authentication information from HTTP headers set by an API gateway
 * (such as Apache APISIX or KrakenD) after validating JWT tokens with an identity provider.
 *
 * Expected headers:
 * - `x-user-id`: User identifier (UUID from Keycloak)
 * - `x-user-roles`: Comma-separated list of user roles
 */
import type { AuthProvider, AuthRequest } from '../auth_provider.js';
import type { AuthenticatedUser } from '@cepseudo/shared';
/**
 * Authentication provider for API Gateway authentication.
 *
 * This is the default authentication mode for Digital Twin applications deployed
 * behind an API gateway like Apache APISIX or KrakenD.
 *
 * @example
 * ```typescript
 * const provider = new GatewayAuthProvider('admin')
 *
 * // In a handler
 * const user = provider.parseRequest(req)
 * if (!user) {
 *     return { status: 401, content: 'Authentication required' }
 * }
 *
 * if (provider.isAdmin(req)) {
 *     // Admin-only logic
 * }
 * ```
 */
export declare class GatewayAuthProvider implements AuthProvider {
    #private;
    /**
     * Creates a new GatewayAuthProvider.
     *
     * @param adminRoleName - Name of the admin role (default: 'admin')
     */
    constructor(adminRoleName?: string);
    /**
     * Parse the request headers and return the authenticated user.
     *
     * @param req - Request object with headers
     * @returns Authenticated user, or null if x-user-id header is missing
     */
    parseRequest(req: AuthRequest): AuthenticatedUser | null;
    /**
     * Check if the request has the x-user-id header.
     *
     * @param req - Request object with headers
     * @returns true if x-user-id header is present
     */
    hasValidAuth(req: AuthRequest): boolean;
    /**
     * Check if the user has the admin role.
     *
     * @param req - Request object with headers
     * @returns true if x-user-roles contains the admin role
     */
    isAdmin(req: AuthRequest): boolean;
    /**
     * Get the user ID from the x-user-id header.
     *
     * @param req - Request object with headers
     * @returns User ID, or null if header is missing
     */
    getUserId(req: AuthRequest): string | null;
    /**
     * Get the user roles from the x-user-roles header.
     *
     * @param req - Request object with headers
     * @returns Array of role names, empty array if header is missing
     */
    getUserRoles(req: AuthRequest): string[];
}
//# sourceMappingURL=gateway_auth_provider.d.ts.map