/**
 * memory-journal-mcp — HTTP Transport Security
 *
 * Security utilities: rate limiting, headers, CORS, client IP extraction.
 */
import type { Request, Response } from 'express';
import type { HttpTransportConfig, RateLimitEntry } from './types.js';
/**
 * Extract the client IP address from the request.
 * Note: req.ip correctly respects proxy boundaries because
 * `this.app.set('trust proxy', 'loopback')` is configured globally in the HTTP server
 * when `trustProxy` is enabled. This prevents client IP spoofing while supporting reverse proxies.
 * Falls back to req.socket.remoteAddress if req.ip is not available.
 */
export declare function getClientIp(req: Request): string;
/**
 * Check rate limit for a request.
 * Returns object with `allowed` flag and optional `retryAfterSeconds`.
 */
export declare function checkRateLimit(req: Request, config: HttpTransportConfig, rateLimitMap: Map<string, RateLimitEntry>): {
    allowed: boolean;
    retryAfterSeconds?: number;
};
/**
 * Set security headers for all responses.
 *
 * Headers: X-Content-Type-Options, X-Frame-Options, Cache-Control,
 * Content-Security-Policy, Permissions-Policy, Referrer-Policy, HSTS (opt-in).
 */
export declare function setSecurityHeaders(res: Response, config: HttpTransportConfig): void;
/**
 * Set CORS headers based on configuration.
 *
 * Uses the `origin in whitelist` pattern from CodeQL's documented safe example
 * for js/cors-misconfiguration-for-credentials. CodeQL only recognizes specific
 * sanitizer expressions (object property lookup via `in`, `Set.has()`, etc.) —
 * `Array.some()` with a callback is NOT recognized as a sanitizer.
 *
 * Wildcard subdomain patterns (`*.example.com`) are not supported when
 * `corsAllowCredentials` is true. For credentialed CORS, list explicit origins.
 */
export declare function setCorsHeaders(req: Request, res: Response, config: HttpTransportConfig): boolean;
//# sourceMappingURL=security.d.ts.map