/**
 * @fileoverview JWT authentication provider for direct token validation.
 *
 * This provider validates JWT tokens from the Authorization header without
 * requiring an API gateway. Useful for standalone deployments or when you
 * want to handle authentication directly in the application.
 *
 * Supports:
 * - HMAC algorithms (HS256, HS384, HS512) with a secret key
 * - RSA algorithms (RS256, RS384, RS512) with a public key
 * - EC algorithms (ES256, ES384, ES512) with a public key
 * - Keycloak token format (realm_access.roles)
 * - Custom claim paths for user ID and roles
 */
import type { AuthProvider, AuthRequest, AuthProviderConfig } from '../auth_provider.js';
import type { AuthenticatedUser } from '@cepseudo/shared';
/**
 * Authentication provider for JWT token validation.
 *
 * This provider validates JWT tokens directly in the application, without
 * requiring an API gateway. It extracts user information from token claims.
 *
 * @example
 * ```typescript
 * // With HMAC secret
 * const provider = new JwtAuthProvider({
 *     mode: 'jwt',
 *     jwt: {
 *         secret: 'your-256-bit-secret',
 *         algorithm: 'HS256'
 *     }
 * })
 *
 * // With RSA public key (Keycloak)
 * const provider = new JwtAuthProvider({
 *     mode: 'jwt',
 *     jwt: {
 *         publicKey: fs.readFileSync('public.pem', 'utf-8'),
 *         algorithm: 'RS256',
 *         issuer: 'https://keycloak.example.com/realms/myrealm',
 *         rolesClaim: 'realm_access.roles'
 *     }
 * })
 * ```
 */
export declare class JwtAuthProvider implements AuthProvider {
    #private;
    /**
     * Creates a new JwtAuthProvider.
     *
     * @param config - Authentication configuration with JWT settings
     * @throws Error if JWT configuration is missing or incomplete
     */
    constructor(config: AuthProviderConfig);
    /**
     * Parse the request and validate the JWT token.
     *
     * @param req - Request object with headers
     * @returns Authenticated user, or null if token is missing/invalid
     */
    parseRequest(req: AuthRequest): AuthenticatedUser | null;
    /**
     * Check if the request has a valid Authorization header with Bearer token.
     *
     * @param req - Request object with headers
     * @returns true if Authorization header is present with Bearer scheme
     */
    hasValidAuth(req: AuthRequest): boolean;
    /**
     * Check if the authenticated user has admin privileges.
     *
     * @param req - Request object with headers
     * @returns true if the user has the admin role
     */
    isAdmin(req: AuthRequest): boolean;
    /**
     * Get the user ID from the JWT token.
     *
     * @param req - Request object with headers
     * @returns User ID, or null if not authenticated
     */
    getUserId(req: AuthRequest): string | null;
    /**
     * Get the user roles from the JWT token.
     *
     * @param req - Request object with headers
     * @returns Array of role names, empty array if not authenticated
     */
    getUserRoles(req: AuthRequest): string[];
}
//# sourceMappingURL=jwt_auth_provider.d.ts.map