import { CombinedHostRule, HostRule } from "../types/host-rules.js";
import "../types/index.js";
//#region lib/util/host-rules.d.ts
/**
 * A {@link CombinedHostRule} returned by {@link find}, additionally reporting which of its `headers` came from an `admin` tier rule.
 *
 * `trustedHeaderNames` is deliberately not a field of `HostRule`, for the same reason `trustTier` is not: it must never be settable through configuration.
 */
export interface CombinedHostRuleWithTrustedHeaders extends CombinedHostRule {
  /** header names in `headers` that came from an `admin` tier rule (the self-hosted administrator's own config), and so already bypassed `allowedHeaders` at registration - `applyHostRule`'s request-time defence-in-depth must not re-check, and drop, them */
  trustedHeaderNames?: string[];
}
/**
 * Fields within `HostRule`s that must have their value registered for sanitising through `sanitize.addSecretForSanitizing()`.
 *
 * Kept in sync with `redactedFields` through tests.
 */
export declare const confidentialFields: (keyof HostRule)[];
export interface LegacyHostRule {
  hostName?: string;
  domainName?: string;
  baseUrl?: string;
  host?: string;
  endpoint?: string;
}
export declare function migrateRule(rule: LegacyHostRule & HostRule): HostRule;
/**
 * Enforce the `allowedHeaders` allowlist on a set of host rules.
 *
 * Loudly remove anything that's not permitted, logging a WARN. Used by `add()` for an untrusted rule's `headers`; a `trusted` rule's are exempt, so never reach this.
 *
 * Headers that survive this allowlist are still subject to how {@link find} combines them: an admin's headers for a host are applied over those of any repository or preset rule matching the same request, so a repository can neither drop nor substitute them.
 */
export declare function filterAllowedHeaders(rules: HostRule[]): HostRule[];
export interface AddHostRuleOptions {
  /**
   * Whether this rule comes from the self-hosted administrator's own configuration, rather than from repository or preset config.
   *
   * Registers the rule into the `admin` tier - see {@link HostRuleTrustTier}.
   */
  trusted?: boolean;
  /**
   * Whether this rule comes from organization-inherited config which the administrator has opted into trusting, through `inheritConfigTrusted`.
   *
   * Registers the rule into the `inherit` tier - see {@link HostRuleTrustTier}. Ignored when `trusted` is also set.
   */
  inherited?: boolean;
}
export declare function add(params: HostRule, options?: AddHostRuleOptions): void;
/**
 * Whether a request of `url` with any `hostType` falls back to the `github` host rules: a request of the GitHub.com API, or of the host of the GitHub platform endpoint, such as GitHub Enterprise Server or GitHub Enterprise Cloud.
 */
export declare function usesGithubUrlFallback(url: string): boolean;
/**
 * Moves the `user:password@` userinfo of an HTTP(S) URL, or of the HTTP(S) URL of a `sparse+https://` one, into a host rule per host type in `hostTypes` for the path of that URL and every path below it, unless credentials for that host type are already supplied by a rule registered from URL credentials for exactly that path and host type, or by another rule for no host type, that host type or the platform host type it falls back to, which has no `matchHost` or one for that path, a path above or a path below it.
 * The credentials are dropped when no host type is left.
 *
 * @param hostTypes the host types the URL is requested with
 * @returns the URL with only its userinfo removed, or `url` unchanged when it carries none, only a placeholder username, a short username or a username equal to its first path segment
 */
export declare function detachUrlCredentials(url: string, hostTypes: string[]): string;
/**
 * Whether {@link detachUrlCredentials} registered any credentials.
 */
export declare function hasDetachedCredentials(): boolean;
/**
 * Returns the username and password which {@link detachUrlCredentials} registered for `url` requested with `hostType`, those of the longest matching path, or `null` when there are none.
 */
export declare function findDetachedCredentials({ hostType, url }: {
  hostType: string;
  url: string;
}): Pick<HostRule, 'username' | 'password'> | null;
/**
 * Returns the SHA-256 of the credentials which {@link detachUrlCredentials} registered for the URL at the start of `text`, in any spelling of its origin and path and with or without its userinfo, or `null` when there are none.
 */
export declare function getDetachedCredentialsHash(text: string): string | null;
export interface HostRuleSearch {
  hostType?: string;
  url?: string;
  readOnly?: boolean;
}
export interface MatchesHostOptions {
  /** match an HTTP(S) `url` by its prefix only, so that a `matchHost` ending with a slash does not match the URL of that path without the slash */
  prefixOnly?: boolean;
}
export declare function matchesHost(url: string, matchHost: string, { prefixOnly }?: MatchesHostOptions): boolean;
export declare function find(search: HostRuleSearch): CombinedHostRuleWithTrustedHeaders;
export declare function hosts({ hostType }: {
  hostType: string;
}): string[];
export declare function hostType({ url }: {
  url: string;
}): string | null;
export declare function findAll({ hostType }: {
  hostType: string;
}): HostRule[];
/**
 * @returns a deep copy of all host rules other than those registered by {@link detachUrlCredentials}
 */
export declare function getAll(): HostRule[];
export declare function clear(): void;
//#endregion
//# sourceMappingURL=host-rules.d.ts.map