import { CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { KeycloakTokenValidationService } from '../keycloak/services/keycloak-token-validation.service.js';
/**
 * JWT Authentication Guard
 *
 * Validates Keycloak-issued JWT tokens on every request using KeycloakTokenValidationService.
 * Extracts the token from the Authorization header (Bearer scheme), validates it,
 * and attaches the authenticated user and claims to the request object.
 *
 * On successful validation, attaches:
 * - `request.user` — IKeycloakUser object with identity and roles
 * - `request.keycloakClaims` — Raw token claims for advanced use cases
 *
 * Respects the `@Public()` decorator — routes marked as public bypass authentication entirely.
 *
 * @example
 * ```ts
 * @UseGuards(JwtAuthGuard)
 * @Controller('api')
 * export class MyController {
 *   @Get('profile')
 *   getProfile(@CurrentUser() user: IKeycloakUser) {
 *     // user.id, user.roles, etc.
 *     return user;
 *   }
 *
 *   @Public()
 *   @Get('health')
 *   health() {
 *     // No authentication required
 *     return { status: 'ok' };
 *   }
 * }
 * ```
 */
export declare class JwtAuthGuard implements CanActivate {
    private readonly Reflector;
    private readonly TokenValidation;
    constructor(reflector: Reflector, tokenValidation: KeycloakTokenValidationService);
    /**
     * Activates JWT authentication for the current request.
     *
     * Validates Keycloak-issued JWT tokens using KeycloakTokenValidationService.
     * Attaches authenticated user and claims to the request object.
     * Respects @Public() decorator to skip authentication on public routes.
     *
     * @param context - NestJS execution context (HTTP, GraphQL, WebSocket)
     * @returns `true` if authentication is valid or route is public; otherwise throws UnauthorizedException
     * @throws {UnauthorizedException} If no token provided, token is invalid, or claims are missing
     *
     * @example
     * ```ts
     * @UseGuards(JwtAuthGuard)
     * @Get('profile')
     * getProfile(@CurrentUser() user: IKeycloakUser) {
     *   return user;
     * }
     * ```
     */
    canActivate(context: ExecutionContext): Promise<boolean>;
}
//# sourceMappingURL=jwt-auth.guard.d.ts.map