import { RequestConfig, RequestInterceptor } from '../types'; /** * CSRF interceptor configuration */ export interface CsrfInterceptorConfig { /** * Cookie name containing the CSRF token. * @default 'csrf_token' */ cookieName?: string; /** * Header name to send the CSRF token. * @default 'X-CSRF-Token' */ headerName?: string; /** * HTTP methods that require CSRF protection. * Safe methods (GET, HEAD, OPTIONS) are excluded by default. * @default ['POST', 'PUT', 'PATCH', 'DELETE'] */ protectedMethods?: string[]; /** * Custom function to extract CSRF token. * Overrides cookie-based extraction when provided. */ tokenExtractor?: () => string | null; /** * URL patterns to exclude from CSRF protection. * Supports string matching and RegExp patterns. */ excludePatterns?: Array; /** * Callback when CSRF token is missing for a protected request. * Useful for logging or triggering token refresh. */ onMissingToken?: (config: RequestConfig) => void; } /** * Create a CSRF token request interceptor. * * Automatically adds CSRF tokens to mutation requests by reading * from cookies and adding to request headers. * * @param config - Interceptor configuration * @returns Request interceptor function * * @example Basic usage * ```typescript * const csrfInterceptor = createCsrfInterceptor(); * apiClient.addRequestInterceptor(csrfInterceptor); * ``` * * @example With custom cookie name (common with frameworks like Django/Rails) * ```typescript * const csrfInterceptor = createCsrfInterceptor({ * cookieName: 'XSRF-TOKEN', // Angular/Django style * headerName: 'X-XSRF-Token', * }); * ``` * * @example With custom token extractor (e.g., from meta tag) * ```typescript * const csrfInterceptor = createCsrfInterceptor({ * tokenExtractor: () => { * const meta = document.querySelector('meta[name="csrf-token"]'); * return meta?.getAttribute('content') || null; * }, * }); * ``` */ export declare function createCsrfInterceptor(config?: CsrfInterceptorConfig): RequestInterceptor; /** * Manually set CSRF token in cookies. * Useful for testing or when token is received via non-cookie mechanism. * * @param token - CSRF token value * @param cookieName - Cookie name (default: 'csrf_token') * @param options - Cookie options */ export declare function setCsrfToken(token: string, cookieName?: string, options?: { path?: string; secure?: boolean; sameSite?: 'Strict' | 'Lax' | 'None'; maxAge?: number; }): void; /** * Clear CSRF token from cookies. * * @param cookieName - Cookie name (default: 'csrf_token') * @param path - Cookie path (default: '/') */ export declare function clearCsrfToken(cookieName?: string, path?: string): void; /** * Get current CSRF token value. * * @param cookieName - Cookie name (default: 'csrf_token') * @returns Current token or null */ export declare function getCsrfToken(cookieName?: string): string | null; /** * Default CSRF interceptor with standard configuration. * Uses 'csrf_token' cookie and 'X-CSRF-Token' header. */ export declare const defaultCsrfInterceptor: RequestInterceptor; /** * Angular/Django style CSRF interceptor. * Uses 'XSRF-TOKEN' cookie and 'X-XSRF-Token' header. */ export declare const xsrfInterceptor: RequestInterceptor; /** * Rails style CSRF interceptor. * Reads token from meta tag instead of cookie. */ export declare const railsCsrfInterceptor: RequestInterceptor;