import { Request as Request$1 } from '@cloudflare/workers-types/experimental';
import { AwsClient } from 'aws4fetch';
import { Buffer } from 'buffer/';

interface KinesisIngestConfigArgs {
    kinesisStreamName: string;
    kinesisAccessKey?: string;
    kinesisSecretKey?: string;
    logBatchSize?: number;
    maxLogAgeSeconds?: number;
}

declare enum NetaceaIngestType {
    /**
     * ORIGIN Ingest mode; data to be ingested is set by headers, so it can be forwarded via a seperate mechanism
     */
    ORIGIN = "ORIGIN",
    /**
     * HTTP Ingest mode, this is the standard implementation
     */
    HTTP = "HTTP",
    /**
     * Ingest over Kinesis, Netacea will inform you if this is required
     * and will provide you with kinesis credentials.
     */
    KINESIS = "KINESIS",
    /**
     * Data to be Ingest via some mechanism native to the host/CDN, e.g. log shipping.
     */
    NATIVE = "NATIVE"
}
declare enum NetaceaMitigationType {
    /**
     * Run Netacea with mitigation mode enabled.
     * This will serve Captcha pages and Forbidden pages when instructed to do so
     */
    MITIGATE = "MITIGATE",
    /**
     * Run Netacea with Inject mode enabled.
     * The end-user will only receive a cookie.
     * The origin server will receive 3-4 headers,
     *
     * 'x-netacea-match' indicating what was matched (nothing(0), ua(1), ip(2), etc...)
     *
     * 'x-netacea-mitigate' indicating what action would've be taken (nothing (0), block(1), allow(2), etc...)
     *
     * 'x-netacea-captcha' indicating what captcha action would've been taken
     *
     * 'x-netacea-event-id' event id value that should be injected to the captcha
     * page if using `@netacea/captchafeedback` module on the origin server
     */
    INJECT = "INJECT",
    /**
     * Run Netacea with Ingest only mode
     * No cookies will be set for the end user.
     * No mitigations will be applied.
     *
     * **It's recommended to start in this mode!**
     */
    INGEST = "INGEST"
}
declare enum NetaceaCookieV3IssueReason {
    CAPTCHA_GET = "captcha_get",
    CAPTCHA_POST = "captcha_post",
    EXPIRED_SESSION = "expired_session",
    FORCED_REVALIDATION = "forced_revalidation",
    INVALID_SESSION = "invalid_session",
    IP_CHANGE = "ip_change",
    NO_SESSION = "no_session"
}
interface MakeRequestResponse {
    /**
     * Numerical status code of the response
     */
    status: number;
    /**
     * Key value collection of the response headers
     */
    headers: Record<string, string>;
    /**
     * Response body value
     */
    body?: string;
}
interface NetaceaBaseArgs {
    /**
     * Netacea APIKey
     */
    apiKey: string;
    /**
     * Netacea Secret Key
     */
    secretKey: string;
    /**
     * Google RECaptcha Site Key.
     * This is used for providing your own captcha values without updating these in the Netacea console.
     */
    captchaSiteKey?: string;
    /**
     * Google RECaptcha Secret Key.
     * This is used for providing your own captcha values without updating these in the Netacea console.
     */
    captchaSecretKey?: string;
    /**
     * Request timeout in ms
     */
    timeout?: number;
    /**
     * URL of the Netacea ingest service.
     * DEFAULT: https://ingest.netacea.net
     */
    ingestServiceUrl?: string;
    /**
     * URL of the Netacea mitigation service.
     * DEFAULT: https://mitigations.netacea.net
     */
    mitigationServiceUrl?: string;
    /**
     * Type of mitigation applied, see the `NetaceaMitigationType` ENUM
     *  - INGEST - Ingest only mode, no mitigations applied
     *  - MITIGATION - Mitigation mode, active blocking/captcha rules will be applied.
     *  - INJECT - Inject mode, headers will be sent to your origin server
     *             indicating what actions Netacea would have taken.
     * DEFAULT: NetaceaMitigationType.INGEST
     */
    mitigationType?: NetaceaMitigationType;
    /**
     * Type of ingest, see the `NetaceaIngestType` ENUM
     *  - HTTP - Ingest via HTTP.
     *  - KINESIS - Ingest via KINESIS
     * DEFAULT: NetaceaIngestType.HTTP
    */
    ingestType?: NetaceaIngestType;
    /**
     * Kinesis ingest definition, see the `KinesisIngestConfigArgs` type.
     * Only to be provided if ingestType is set to KINESIS.
     * Netacea will provide you with the details for this stream.
    */
    kinesis?: KinesisIngestConfigArgs;
    /**
     * Deprecated: alias for netaceaCookieExpirySeconds.
     * If both are set, netaceaCookieExpirySeconds is prefered.
     * Seconds for the netacea cookie to be revalidated after.
     */
    mitataCookieExpirySeconds?: number;
    /**
     * Seconds for the netacea cookie to be revalidated after.
     */
    netaceaCookieExpirySeconds?: number;
    /**
     * The name of the netacea cookie. Defaults to _mitata.
     */
    netaceaCookieName?: string;
    /**
     * The name of the netacea captcha cookie. Defaults to _mitatacaptcha.
     */
    netaceaCaptchaCookieName?: string;
}
interface InjectHeaders {
    'x-netacea-match': string;
    'x-netacea-mitigate': string;
    'x-netacea-captcha': string;
    'x-netacea-event-id'?: string;
}
interface IngestArgs {
    /**
     * Client IP Address
     */
    ip: string;
    /**
     * Client User-Agent header value
     */
    userAgent: string;
    /**
     * Response status code
     * Should be 403 if Netacea mitigated
     */
    status: string;
    /**
     * Request method
     */
    method: string;
    /**
     * Request path
     */
    path: string;
    /**
     * Request protocol
     */
    protocol: string | null;
    /**
     * Request referer header value
     */
    referer: string;
    /**
     * Request content-length header, or body size
     */
    bytesSent: string | number;
    /**
     * The time the request was started, in unix milliseconds format.
     */
    timeUnixMsUTC?: number;
    /**
     * Time taken to serve request
     */
    requestTime: string | number;
    /**
     * Netacea mitata cookie value.
     * Should be request's cookie value if Netacea was not called.
     */
    mitataCookie?: string;
    /**
     * Session status from `ComposeResultResponse`
     */
    sessionStatus?: string;
    /**
     * Type of the integration, for example "Cloudflare" or "Cloudfront"
     */
    integrationType?: string;
    /**
     * SEMVER string indicating the version of the integration
     * Example: 1.2.3
     */
    integrationVersion?: string;
    /**
     * IP values set by a CDN under "x-forwarded-for" header
     */
    cookieFingerprint?: string;
    headerFingerprint?: string;
    integrationMode?: string;
    ipHeader?: string;
    mitigationLatency?: number;
    mitigationStatus?: number;
    netaceaCookieStatus?: number;
    requestHost?: string;
    requestId?: string;
    workerInstanceId?: string;
    xForwardedFor?: string;
}
interface NetaceaResponseBase {
    /**
     * Cookies that should be set back to the user.
     */
    setCookie?: string[];
    /**
     * Netacea session status string
     */
    sessionStatus: string;
    apiCallLatency?: number;
    apiCallStatus?: number;
    cookieSessionStatus?: string | undefined;
}
interface MitigateResponse<T = any> extends NetaceaResponseBase {
    /**
     * Response value, using Response generic
     */
    response?: T;
}
interface InjectResponse<T = any> extends MitigateResponse<T> {
    /**
     * Headers to be sent to the origin server
     * X-Netacea-Match
     * X-Netacea-Mitigate
     * X-Netacea-Captcha
     * X-Netacea-Event-ID (Only sent when CAPTCHA is served)
     */
    injectHeaders: InjectHeaders | undefined;
    /**
     * Response value, using Response generic
     */
    response?: T | undefined;
}
type NetaceaMitigationResponse<T> = MitigateResponse<T> | InjectResponse<T> | undefined;

interface NetaceaCloudflareResult {
    response: Response;
    sessionStatus: string;
    protectorLatencyMs?: number;
    protectorStatus?: number;
}
interface NetaceaSessionCookieDetails {
    userId: string | undefined;
    requiresReissue: boolean;
    isExpired: boolean;
    shouldExpire: boolean;
    isSameIP: boolean;
    isPrimaryHashValid: boolean;
    protectorCheckCodes: ProtectorCheckCodes;
    issueReason?: NetaceaCookieV3IssueReason;
}
declare enum NetaceaSessionCookieStatus {
    NEW_SESSION = 1,
    EXISTING_SESSION = 2,
    RENEW_SESSION = 3
}
interface ProtectorCheckCodes {
    match: string;
    mitigate: string;
    captcha: string;
}
interface NetaceaSessionDetails {
    captchaToken: string | undefined;
    sessionStatus: string;
    sessionCookieDetails: NetaceaSessionCookieDetails | undefined;
    sessionCookieStatus: NetaceaSessionCookieStatus;
    userId: string;
}
interface NetaceaRequestDetails {
    clientIp: string;
    method: string;
    protocol: string | undefined;
    sessionDetails: NetaceaSessionDetails;
    url: URL;
    userAgent: string;
    contentType: string | undefined;
    requestId: string;
    fingerprints: {
        headerFingerprint: string;
        cookieFingerprint: string;
    };
}

type CloudflareConstructorArgs$1 = NetaceaBaseArgs & {
    cookieEncryptionKey?: string;
    enableDynamicCaptchaContentType?: boolean | string;
    netaceaCaptchaPath?: string;
    captchaHeader?: CustomHeader$1 | undefined;
    netaceaCookieAttributes?: string;
    netaceaCaptchaCookieAttributes?: string;
    netaceaCaptchaVerificationPath?: string;
    mitigationServiceTimeoutMs?: number | string;
    netaceaCheckpointSignalPath?: string;
    netaceaBlockedResponseRedirectLocation?: string;
};
interface CustomHeader$1 {
    name: string;
    value: string;
}
declare class CloudflareConfig {
    readonly mitataCookieExpirySeconds: number;
    readonly apiKey: string;
    readonly secretKey: string;
    readonly mitigationServiceUrl: string;
    readonly ingestServiceUrl: string;
    readonly kinesisConfigArgs?: KinesisIngestConfigArgs;
    readonly timeout: number;
    readonly mitigationServiceTimeoutMs: number;
    readonly captchaSiteKey?: string;
    readonly captchaSecretKey?: string;
    readonly ingestType: NetaceaIngestType;
    readonly mitigationType: NetaceaMitigationType;
    readonly encryptedCookies: string[];
    readonly netaceaCookieName: string;
    readonly netaceaCaptchaCookieName: string;
    readonly cookieEncryptionKey: string | undefined;
    readonly enableDynamicCaptchaContentType: boolean;
    readonly netaceaCaptchaPath: string | undefined;
    readonly netaceaCheckpointSignalPath?: string;
    readonly captchaHeader: CustomHeader$1 | undefined;
    readonly netaceaCookieAttributes: string;
    readonly netaceaCaptchaCookieAttributes: string;
    readonly netaceaCaptchaVerificationPath: string;
    readonly netaceaBlockedResponseRedirectLocation?: string;
    constructor(args: CloudflareConstructorArgs$1);
}

interface KinesisIngestWebLog {
    apiKey: string;
}
interface KinesisIngestArgs {
    kinesisStreamName: string;
    kinesisAccessKey?: string;
    kinesisSecretKey?: string;
    logBatchSize?: number;
    maxLogAgeSeconds?: number;
    apiKey: string;
    rampUpBatchSize?: boolean;
    maxAwaitTimePerIngestCallMs?: number;
}
type KinesisMakeRequest = (args: {
    headers: Record<string, string>;
    method: 'POST' | 'GET';
    host: string;
    path: string;
    body?: any;
}) => Promise<any>;

interface WebStandardKinesisDependencies {
    AwsClient: typeof AwsClient;
    Buffer: typeof Buffer;
    makeRequest: KinesisMakeRequest;
}
declare class WebStandardKinesis {
    private readonly deps;
    protected readonly kinesisStreamName: string;
    protected readonly kinesisAccessKey: string;
    protected readonly kinesisSecretKey: string;
    protected readonly maxLogBatchSize: number;
    protected readonly maxLogAgeSeconds: number;
    protected logBatchSize: number;
    protected maxAwaitTimePerIngestCallMs: undefined | number;
    protected logCache: KinesisIngestWebLog[];
    private intervalSet;
    constructor({ deps, kinesisIngestArgs: args }: {
        deps: WebStandardKinesisDependencies;
        kinesisIngestArgs: KinesisIngestArgs;
    });
    putToKinesis(): Promise<void>;
    ingest<LogFormat extends KinesisIngestWebLog>(log: LogFormat): Promise<void>;
    private signRequest;
}

type CloudflareConstructorArgs = NetaceaBaseArgs & {
    cookieEncryptionKey?: string;
    enableDynamicCaptchaContentType?: boolean | string;
    netaceaCaptchaPath?: string;
    captchaHeader?: CustomHeader | undefined;
    netaceaCookieAttributes?: string;
    netaceaCaptchaCookieAttributes?: string;
};
interface CustomHeader {
    name: string;
    value: string;
}
interface ComposeResultResponse {
    body?: string | ReadableStream<Uint8Array>;
    apiCallStatus?: number;
    apiCallLatency?: number;
    setCookie: string[];
    sessionStatus: string;
    mitigation: string;
    mitigated: boolean;
    injectHeaders?: InjectHeaders;
}
type MakeRequestBody = Record<string, any> | string | ReadableStream<Uint8Array> | undefined | null;
interface MakeRequestArgs {
    host: string;
    path: string;
    headers: Record<string, string>;
    method: 'GET' | 'POST' | 'PUT' | 'DELETE';
    body?: MakeRequestBody;
    timeout?: number;
}
declare class Cloudflare {
    protected readonly config: CloudflareConfig;
    protected readonly kinesis?: WebStandardKinesis;
    private readonly requestAnalyser;
    private workerInstanceId;
    constructor(args: CloudflareConstructorArgs);
    /**
     *
     * @param event Cloudflare's FetchEvent
     * @param responsePredicate Promise that takes a request, and returns a response using the Fetch API
     *
     * Runs Netacea. Calling the correct services depending on the mitigationType passed in the constructor
     */
    run(event: FetchEvent, responsePredicate: (request: Request) => Promise<Response>): Promise<NetaceaCloudflareResult>;
    inject(request: Request, requestDetails: NetaceaRequestDetails): Promise<InjectResponse>;
    protected mitigate(request: Request, requestDetails: NetaceaRequestDetails): Promise<NetaceaMitigationResponse<Response>>;
    getNetaceaSession(request: Request | Request$1, response?: Response | NetaceaMitigationResponse<Response>): Promise<{
        userId: string;
        sessionStatus: string;
        netaceaCookie: string | undefined;
    }>;
    private getResponseDetails;
    ingest(request: Request | Request$1, responseOrResult: Response | NetaceaCloudflareResult): Promise<void>;
    protected handleGetCaptchaRequest(requestDetails: NetaceaRequestDetails, captchaPageContentType: string, trackingId: string | null): Promise<ComposeResultResponse>;
    protected makeRequest({ host, method, path, headers, body }: MakeRequestArgs): Promise<MakeRequestResponse>;
    private handleResponse;
    private getMitigationResponse;
    runMitigation(request: Request, requestDetails: NetaceaRequestDetails): Promise<NetaceaMitigationResponse<Response>>;
    /**
     * Returns the value of the cookie with the given name from a string or list of cookies.
     * If the cookie name is included in the encryptedCookies class property,
     * then the cookie value will be decrypted automatically.
     * The method may operate of either the HTTP Cookie or Set-Cookie headers.
     * @param cookieName the name of the cookie to find.
     * @param cookies the full list of cookies, either as a string or an array of strings.
     * @returns the value of the cookie, if found.
     */
    protected readCookie(cookieName: string, cookies: string | string[] | null | undefined): Promise<string | undefined>;
    private getNetaceaCookieFromResponse;
    private getNetaceaCookieFromRequest;
    protected callIngest(args: IngestArgs): Promise<void>;
    private makeIngestApiCall;
    protected check(requestDetails: NetaceaRequestDetails, captchaPageContentType: string): Promise<ComposeResultResponse>;
    protected createMitata(clientIP: string, userId: string, match: string, mitigate: string, captcha: string, maxAge?: number, expiry?: number | undefined): Promise<string>;
    private processCaptcha;
    private getMitataCaptchaFromHeaders;
    private makeCaptchaAPICall;
    private getApiCallResponseFromResponse;
    private makeMitigateAPICall;
    private composeResult;
    protected processMitigateRequest(args: {
        captchaPageContentType: string;
        getBodyFn: () => Promise<string | ReadableStream<Uint8Array> | undefined>;
        requestDetails: NetaceaRequestDetails;
        body?: MakeRequestBody;
    }): Promise<ComposeResultResponse>;
    protected setIngestOnlyMitataCookie(userId: string): Promise<NetaceaResponseBase>;
    protected processIngest(requestDetails: NetaceaRequestDetails): Promise<NetaceaResponseBase>;
}

export { type CloudflareConstructorArgs, type NetaceaCloudflareResult, NetaceaMitigationType, Cloudflare as default };