/**
 * postgres-mcp - HTTP Transport Security Utilities
 *
 * Standalone security functions extracted from the HttpTransport class.
 * These handle security headers, CORS headers, rate limiting, DNS rebinding
 * protection, and body parsing.
 */
import type { IncomingMessage, ServerResponse } from "node:http";
import type { HttpTransportConfig } from "./types.js";
/**
 * Validate the Host header to prevent DNS rebinding attacks.
 *
 * DNS rebinding attacks bypass same-origin policy by manipulating DNS to
 * point attacker-controlled domains to localhost, allowing malicious
 * websites to access local MCP servers.
 *
 * Equivalent to the MCP SDK's `localhostHostValidation()` middleware,
 * adapted for raw Node.js HTTP (non-Express).
 *
 * @returns true if the request should proceed, false if it was rejected
 */
export declare function validateHostHeader(req: IncomingMessage, res: ServerResponse): boolean;
/**
 * Rate limit entry for tracking request counts per IP
 */
export interface RateLimitEntry {
    count: number;
    resetTime: number;
}
/** Default configuration values */
export declare const DEFAULTS: {
    readonly RATE_LIMIT_WINDOW_MS: 60000;
    readonly RATE_LIMIT_MAX_REQUESTS: 100;
    readonly MAX_BODY_SIZE: 1048576;
    readonly HSTS_MAX_AGE: 31536000;
};
/**
 * Extract the client IP address from the request.
 * When trustProxy is enabled, uses the leftmost IP from X-Forwarded-For.
 * Falls back to req.socket.remoteAddress.
 */
export declare function getClientIp(req: IncomingMessage, trustProxy: boolean): string;
/**
 * Check rate limit for a request.
 * @returns Object with `allowed` flag and optional `retryAfterSeconds`.
 */
export declare function checkRateLimit(req: IncomingMessage, config: HttpTransportConfig, rateLimitMap: Map<string, RateLimitEntry>): {
    allowed: boolean;
    retryAfterSeconds?: number;
};
/**
 * Set security headers for all responses
 */
export declare function setSecurityHeaders(res: ServerResponse, config: HttpTransportConfig): void;
/**
 * Set CORS headers based on configuration.
 *
 * Two distinct paths:
 *
 * 1. CREDENTIAL PATH (corsAllowCredentials=true): only exact allowlist matches
 *    are accepted. The ACAO header is set to the value from the allowlist array
 *    (config-sourced, not user-input-sourced), satisfying CodeQL's taint analysis.
 *
 * 2. NO-CREDENTIAL PATH: wildcards and subdomain patterns are permitted.
 *    Reflecting the request origin is safe here because ACAC is never set.
 */
export declare function setCorsHeaders(req: IncomingMessage, res: ServerResponse, config: HttpTransportConfig): void;
/**
 * Read and parse JSON body from an incoming request.
 * Returns undefined for GET/DELETE/OPTIONS (no body expected).
 * Enforces maxBodySize limit while streaming to prevent memory exhaustion.
 */
export declare function readBody(req: IncomingMessage, res: ServerResponse, maxBodySize: number): Promise<unknown>;
//# sourceMappingURL=security.d.ts.map