/**
 * Authentication validation for skills HTTP endpoints.
 *
 * Supports multiple authentication modes:
 * - public: No authentication required
 * - api-key: API key in X-API-Key header or Authorization: ApiKey <key>
 * - bearer: JWT token validated against configured issuer using JWKS
 *
 * @module skill/auth/skill-http-auth
 */
import type { FrontMcpLogger } from '../../common';
import type { SkillsConfigOptions } from '../../common/types/options/skills-http';
/**
 * Request context for auth validation.
 */
export interface SkillHttpAuthContext {
    /** Request headers (lowercase keys) */
    headers: Record<string, string | string[] | undefined>;
}
/**
 * Result of auth validation.
 */
export interface SkillHttpAuthResult {
    /** Whether the request is authorized */
    authorized: boolean;
    /** Error message if not authorized */
    error?: string;
    /** HTTP status code for the error response */
    statusCode?: number;
}
/**
 * Options for creating SkillHttpAuthValidator.
 */
export interface SkillHttpAuthValidatorOptions {
    /** Skills configuration with auth settings */
    skillsConfig: SkillsConfigOptions;
    /** Optional logger for debugging */
    logger?: FrontMcpLogger;
}
/**
 * Validator for skills HTTP endpoint authentication.
 *
 * Implements authentication validation based on SkillsConfigAuthMode:
 * - public: No validation, all requests pass
 * - api-key: Validates API key from X-API-Key header or Authorization: ApiKey <key>
 * - bearer: Validates JWT token using JWKS from configured issuer
 *
 * @example
 * ```typescript
 * const validator = new SkillHttpAuthValidator({
 *   skillsConfig: { auth: 'api-key', apiKeys: ['sk-xxx'] },
 *   logger,
 * });
 *
 * const result = await validator.validate({ headers: req.headers });
 * if (!result.authorized) {
 *   res.status(result.statusCode ?? 401).json({ error: result.error });
 *   return;
 * }
 * ```
 */
export declare class SkillHttpAuthValidator {
    private readonly skillsConfig;
    private readonly logger?;
    constructor(options: SkillHttpAuthValidatorOptions);
    /**
     * Validate auth for a request.
     *
     * @param ctx - Request context with headers
     * @returns Auth result with authorized flag and optional error
     */
    validate(ctx: SkillHttpAuthContext): Promise<SkillHttpAuthResult>;
    /**
     * Validate API key authentication.
     *
     * Accepts API key in:
     * - X-API-Key header
     * - Authorization header as `ApiKey <key>`
     *
     * Uses timing-safe comparison to prevent timing attacks.
     */
    private validateApiKey;
    /**
     * Check if any key in the list matches the candidate using timing-safe comparison.
     * This prevents timing attacks that could reveal information about valid API keys.
     */
    private timingSafeIncludes;
    /**
     * Validate Bearer token (JWT) authentication.
     *
     * Uses JWKS from the configured issuer to validate the JWT.
     * Validates issuer and optionally audience claims.
     */
    private validateBearer;
    /**
     * Get a header value from the headers object.
     * Performs case-insensitive header name lookup per HTTP spec.
     * Handles both string and string[] values.
     */
    private getHeader;
}
/**
 * Create a skill HTTP auth validator from config.
 *
 * Returns null if no validation is needed (public or inherit mode).
 *
 * @param skillsConfig - Skills configuration
 * @param logger - Optional logger
 * @returns Validator instance or null
 */
export declare function createSkillHttpAuthValidator(skillsConfig: SkillsConfigOptions | undefined, logger?: FrontMcpLogger): SkillHttpAuthValidator | null;
//# sourceMappingURL=skill-http-auth.d.ts.map