import type { Handle } from './types.js';
import { type AllowedOrigin } from '../utils/origins.js';
import { type OptionsByPath } from '../utils/paths.js';
/**
 * Defines an `AllowedOrigin` specification to limit the origins from which the form submissions are
 * allowed. If set to `true`, all origins are allowed.
 */
export interface CsrfOptions {
    origin: AllowedOrigin;
}
/**
 * Creates a handler which blocks cross-site form submissions not explicitly enabled by the given
 * options. The logic is ported from the native SvelteKit CSRF prevention logic, with the addition
 * of the ability to selectively disable this protection for specific routes and (optionally) limit
 * the allowed request origins for cross-site form submissions for those routes. See:
 * https://github.com/sveltejs/kit/blob/008056b6ef33b554f8b03131c2635cc14b677ff1/packages/kit/src/runtime/server/respond.js#L63
 *
 * If a form submission request's origin does not match the target URL origin, the request is
 * checked against the provided options. If the request's path matches a path in the options, and
 * the request origin is allowed by the {@link AllowedOrigin} in the matching {@link CsrfOptions}
 * for said path, the request is allowed to proceed.
 *
 * Any cross-site form submission requests not matching a `path` in the options, or for which the
 * request origin is not allowed, are blocked with status 403.
 *
 * The logic for detecting which requests should be subject to CSRF protection is also ported from
 * SvelteKit. A request is subject to CSRF protection if:
 * - the request origin does not match the target URL origin (i.e. the app origin)
 * - the method is POST, PUT, PATCH, or DELETE
 * - the content type is application/x-www-form-urlencoded, multipart/form-data, or text/plain
 */
export declare function handleCsrf(options: OptionsByPath<CsrfOptions>): Handle;