/**
 * memory-journal-mcp — OAuth Middleware
 *
 * Express middleware for OAuth 2.0 authentication and authorization.
 * Extracts Bearer tokens, validates them, and enforces scope requirements.
 */
import type { Request, Response, NextFunction, RequestHandler } from 'express';
import type { TokenClaims } from './types.js';
import type { AuthInfo } from '@modelcontextprotocol/server';
import type { TokenValidator } from './token-validator.js';
import type { OAuthResourceServer } from './oauth-resource-server.js';
import { extractBearerToken } from './transport-agnostic.js';
export { extractBearerToken };
/**
 * Extended Express Request with auth context
 */
export interface AuthRequest extends Request {
    /** MCP standard auth info */
    auth?: AuthInfo;
    /** Original Token claims */
    tokenClaims?: TokenClaims;
    /** Raw access token */
    accessToken?: string;
    /** Request ID for tracing */
    requestId?: string;
}
/**
 * Auth middleware configuration
 */
export interface AuthMiddlewareConfig {
    /** Token validator instance */
    tokenValidator: TokenValidator;
    /** Resource server instance (for WWW-Authenticate header) */
    resourceServer: OAuthResourceServer;
    /** Paths that bypass authentication (e.g., '/.well-known/*', '/health') */
    publicPaths?: string[];
}
/**
 * Create the main authentication middleware
 *
 * This middleware:
 * 1. Skips authentication for public paths (e.g., /.well-known/*)
 * 2. Extracts Bearer token from Authorization header
 * 3. Validates the token using the TokenValidator
 * 4. Attaches validated claims to req.auth
 * 5. Returns 401 with WWW-Authenticate header on failure
 */
export declare function createAuthMiddleware(config: AuthMiddlewareConfig): RequestHandler;
/**
 * Middleware factory that requires a specific scope
 *
 * @param scope - Required scope
 * @returns Express middleware
 */
export declare function requireScope(scope: string): RequestHandler;
/**
 * Middleware factory that requires any of the specified scopes
 *
 * @param scopes - Array of acceptable scopes (user must have at least one)
 * @returns Express middleware
 */
export declare function requireAnyScope(scopes: string[]): RequestHandler;
/**
 * Middleware factory that requires scope for a specific tool
 *
 * @param toolName - Name of the tool being accessed
 * @returns Express middleware
 */
export declare function requireToolScope(toolName: string): RequestHandler;
/**
 * Error handler middleware for OAuth errors
 *
 * Should be added after all routes to catch OAuth-related errors
 */
export declare function oauthErrorHandler(error: Error, _req: Request, res: Response, next: NextFunction): void;
export { createAuthenticatedContext, validateAuth, formatOAuthError, type AuthenticatedContext, } from './transport-agnostic.js';
//# sourceMappingURL=middleware.d.ts.map