/**
 * Security utilities for rate limiting and audit logging
 * Implements security best practices for MCP servers
 */
import { FastifyRequest, FastifyReply } from 'fastify';
import { SecurityConfig } from '../types.js';
export declare const DEFAULT_DASHBOARD_PORT = 5000;
export declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
export declare const VITE_DEV_PORT = 5173;
/**
 * Generate allowed origins for CORS based on the actual port
 * @param port - The port the dashboard is running on
 * @returns Array of allowed origin URLs
 */
export declare function generateAllowedOrigins(port: number): string[];
/**
 * Check if an IP address is localhost
 * @param address - IP address or hostname to check
 * @returns true if the address is localhost (127.x.x.x, localhost, or ::1)
 */
export declare function isLocalhostAddress(address: string): boolean;
/**
 * Get security configuration with secure defaults
 * Note: Network binding validation (bindAddress/allowExternalAccess) is handled separately at the config layer
 * @param userConfig - Optional user-provided security configuration overrides
 * @param port - The port the dashboard is running on (used to generate dynamic allowedOrigins)
 */
export declare function getSecurityConfig(userConfig?: Partial<SecurityConfig>, port?: number): SecurityConfig;
/**
 * Rate limiting implementation
 */
export declare class RateLimiter {
    private requests;
    private config;
    constructor(config: SecurityConfig);
    /**
     * Check if request should be rate limited
     */
    checkLimit(clientId: string): {
        allowed: boolean;
        retryAfter?: number;
    };
    /**
     * Create rate limiting middleware
     */
    middleware(): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
    /**
     * Clean up old request records
     */
    private cleanup;
}
/**
 * Audit log entry
 */
export interface AuditLogEntry {
    timestamp: string;
    actor: string;
    action: string;
    resource: string;
    result: 'success' | 'failure' | 'denied';
    details?: Record<string, any>;
}
/**
 * Audit logger for security events
 */
export declare class AuditLogger {
    private config;
    private logPath;
    constructor(config: SecurityConfig, workspaceRoot?: string);
    /**
     * Initialize audit log (create directory if needed)
     */
    initialize(): Promise<void>;
    /**
     * Log an audit event
     */
    log(entry: AuditLogEntry): Promise<void>;
    /**
     * Create audit logging middleware
     */
    middleware(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
}
/**
 * Security headers middleware
 * @param port - The port the dashboard is running on (used for CSP connect-src for WebSocket)
 */
export declare function createSecurityHeadersMiddleware(port?: number): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * CORS configuration
 */
export declare function getCorsConfig(config: SecurityConfig): false | {
    origin: (origin: string, callback: (error: Error | null, allow?: boolean) => void) => void;
    credentials: boolean;
    methods: string[];
    allowedHeaders: string[];
};
//# sourceMappingURL=security-utils.d.ts.map