import { Request, RequestHandler } from 'express';
import { McpAuthConfig, AuthContext } from './types.js';
/**
 * Auth Middleware for Express
 *
 * Protects MCP server routes with OAuth 2.1 Bearer token authentication
 */
declare global {
    namespace Express {
        interface Request {
            auth?: AuthContext;
        }
    }
}
/**
 * Create authentication middleware
 *
 * @param config - Auth configuration
 * @returns Express middleware
 *
 * @example
 * ```typescript
 * const authMiddleware = createAuthMiddleware({
 *   resourceUri: 'https://mcp.example.com',
 *   authorizationServers: ['https://auth.example.com'],
 *   tokenIntrospectionEndpoint: 'https://auth.example.com/oauth/introspect',
 *   tokenIntrospectionClientId: 'mcp-server',
 *   tokenIntrospectionClientSecret: process.env.INTROSPECTION_SECRET,
 *   audience: 'https://mcp.example.com',
 *   scopesSupported: ['mcp:read', 'mcp:write', 'mcp:admin']
 * });
 *
 * app.use('/mcp', authMiddleware);
 * ```
 */
export declare function createAuthMiddleware(config: McpAuthConfig): RequestHandler;
/**
 * Require specific scopes
 *
 * @param requiredScopes - Scopes required to access this route
 * @returns Express middleware
 *
 * @example
 * ```typescript
 * app.post('/mcp/tools/execute',
 *   authMiddleware,
 *   requireScopes('mcp:write'),
 *   (req, res) => {
 *     // Handle tool execution
 *   }
 * );
 * ```
 */
export declare function requireScopes(...requiredScopes: string[]): RequestHandler;
/**
 * Optional authentication
 *
 * Attempts to authenticate but allows request to proceed even without auth.
 * Useful for endpoints that have different behavior for authenticated users.
 *
 * @param config - Auth configuration
 * @returns Express middleware
 */
export declare function optionalAuth(config: McpAuthConfig): RequestHandler;
/**
 * Scope-based access control decorator
 *
 * @example
 * ```typescript
 * class ToolController {
 *   @RequireScopes('mcp:write', 'tools:execute')
 *   async executeTool(req: Request, res: Response) {
 *     // ...
 *   }
 * }
 * ```
 */
export declare function RequireScopes(...scopes: string[]): (target: unknown, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
/**
 * Check if request is authenticated
 */
export declare function isAuthenticated(req: Request): boolean;
/**
 * Check if request has specific scope
 */
export declare function hasScope(req: Request, scope: string): boolean;
/**
 * Check if request has any of the specified scopes
 */
export declare function hasAnyScope(req: Request, scopes: string[]): boolean;
/**
 * Check if request has all of the specified scopes
 */
export declare function hasAllScopes(req: Request, scopes: string[]): boolean;
//# sourceMappingURL=middleware.d.ts.map