@vorionsys/platform-core 0.1.0

package/dist/security/pam/break-glass.d.ts

@@ -0,0 +1,776 @@
+/**
+ * Break-Glass Emergency Access System
+ *
+ * Provides emergency privileged access for critical situations when normal
+ * authorization cannot be obtained in time. Implements strict controls including:
+ * - Multi-factor authentication verification
+ * - Real-time notifications to all security admins
+ * - SMS/phone alerts to CISO
+ * - Comprehensive audit trail
+ * - Automatic expiration and post-incident review requirements
+ * - Usage limits to prevent abuse
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+import type { FastifyRequest, preHandlerHookHandler } from 'fastify';
+/**
+ * Scope of break-glass access
+ */
+export declare const BreakGlassScope: {
+    readonly FULL: "full";
+    readonly LIMITED: "limited";
+};
+export type BreakGlassScope = (typeof BreakGlassScope)[keyof typeof BreakGlassScope];
+export declare const breakGlassScopeSchema: z.ZodNativeEnum<{
+    readonly FULL: "full";
+    readonly LIMITED: "limited";
+}>;
+/**
+ * Status of a break-glass session
+ */
+export declare const BreakGlassStatus: {
+    readonly PENDING_VERIFICATION: "pending_verification";
+    readonly ACTIVE: "active";
+    readonly EXPIRED: "expired";
+    readonly REVOKED: "revoked";
+    readonly REVIEW_PENDING: "review_pending";
+    readonly REVIEWED: "reviewed";
+};
+export type BreakGlassStatus = (typeof BreakGlassStatus)[keyof typeof BreakGlassStatus];
+export declare const breakGlassStatusSchema: z.ZodNativeEnum<{
+    readonly PENDING_VERIFICATION: "pending_verification";
+    readonly ACTIVE: "active";
+    readonly EXPIRED: "expired";
+    readonly REVOKED: "revoked";
+    readonly REVIEW_PENDING: "review_pending";
+    readonly REVIEWED: "reviewed";
+}>;
+/**
+ * Verification method used for break-glass
+ */
+export declare const VerificationMethod: {
+    readonly MFA_TOTP: "mfa_totp";
+    readonly MFA_BACKUP_CODE: "mfa_backup_code";
+    readonly PHONE_CALLBACK: "phone_callback";
+    readonly HARDWARE_TOKEN: "hardware_token";
+};
+export type VerificationMethod = (typeof VerificationMethod)[keyof typeof VerificationMethod];
+export declare const verificationMethodSchema: z.ZodNativeEnum<{
+    readonly MFA_TOTP: "mfa_totp";
+    readonly MFA_BACKUP_CODE: "mfa_backup_code";
+    readonly PHONE_CALLBACK: "phone_callback";
+    readonly HARDWARE_TOKEN: "hardware_token";
+}>;
+/**
+ * Break-glass request input
+ */
+export interface BreakGlassRequest {
+    /** User ID of the requester */
+    userId: string;
+    /** Mandatory justification for the emergency access */
+    reason: string;
+    /** Optional linked incident ID */
+    incidentId?: string;
+    /** Scope of access requested */
+    scope: BreakGlassScope;
+    /** Specific resources if scope is 'limited' */
+    resources?: string[];
+    /** IP address of the requester */
+    ipAddress?: string;
+    /** Device fingerprint for verification */
+    deviceFingerprint?: string;
+    /** User agent string */
+    userAgent?: string;
+}
+export declare const breakGlassRequestSchema: z.ZodEffects<z.ZodObject<{
+    userId: z.ZodString;
+    reason: z.ZodString;
+    incidentId: z.ZodOptional<z.ZodString>;
+    scope: z.ZodNativeEnum<{
+        readonly FULL: "full";
+        readonly LIMITED: "limited";
+    }>;
+    resources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    userAgent?: string;
+    userId?: string;
+    ipAddress?: string;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    incidentId?: string;
+}, {
+    reason?: string;
+    userAgent?: string;
+    userId?: string;
+    ipAddress?: string;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    incidentId?: string;
+}>, {
+    reason?: string;
+    userAgent?: string;
+    userId?: string;
+    ipAddress?: string;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    incidentId?: string;
+}, {
+    reason?: string;
+    userAgent?: string;
+    userId?: string;
+    ipAddress?: string;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    incidentId?: string;
+}>;
+/**
+ * Action performed during a break-glass session
+ */
+export interface BreakGlassAction {
+    /** Unique action ID */
+    id: string;
+    /** Timestamp of the action */
+    timestamp: Date;
+    /** Type of action */
+    type: string;
+    /** HTTP method if applicable */
+    method?: string;
+    /** Resource path */
+    path?: string;
+    /** Resource ID */
+    resourceId?: string;
+    /** IP address */
+    ipAddress?: string;
+    /** User agent */
+    userAgent?: string;
+    /** Request body hash (for audit, not actual content) */
+    requestBodyHash?: string;
+    /** Response status code */
+    responseStatus?: number;
+    /** Duration of the action in milliseconds */
+    durationMs?: number;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+export declare const breakGlassActionSchema: z.ZodObject<{
+    id: z.ZodString;
+    timestamp: z.ZodDate;
+    type: z.ZodString;
+    method: z.ZodOptional<z.ZodString>;
+    path: z.ZodOptional<z.ZodString>;
+    resourceId: z.ZodOptional<z.ZodString>;
+    ipAddress: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    requestBodyHash: z.ZodOptional<z.ZodString>;
+    responseStatus: z.ZodOptional<z.ZodNumber>;
+    durationMs: z.ZodOptional<z.ZodNumber>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    path?: string;
+    durationMs?: number;
+    id?: string;
+    type?: string;
+    metadata?: Record<string, unknown>;
+    userAgent?: string;
+    method?: string;
+    ipAddress?: string;
+    resourceId?: string;
+    timestamp?: Date;
+    responseStatus?: number;
+    requestBodyHash?: string;
+}, {
+    path?: string;
+    durationMs?: number;
+    id?: string;
+    type?: string;
+    metadata?: Record<string, unknown>;
+    userAgent?: string;
+    method?: string;
+    ipAddress?: string;
+    resourceId?: string;
+    timestamp?: Date;
+    responseStatus?: number;
+    requestBodyHash?: string;
+}>;
+/**
+ * Break-glass session
+ */
+export interface BreakGlassSession {
+    /** Unique session ID */
+    id: string;
+    /** User ID of the requester */
+    userId: string;
+    /** Justification reason */
+    reason: string;
+    /** Linked incident ID */
+    incidentId?: string;
+    /** Access scope */
+    scope: BreakGlassScope;
+    /** Specific resources if limited scope */
+    resources?: string[];
+    /** Session status */
+    status: BreakGlassStatus;
+    /** When the session started */
+    startedAt: Date;
+    /** When the session expires */
+    expiresAt: Date;
+    /** When the session ended (revoked or expired) */
+    endedAt?: Date;
+    /** Who revoked the session */
+    revokedBy?: string;
+    /** Reason for revocation */
+    revocationReason?: string;
+    /** Whether the session has been renewed */
+    renewed: boolean;
+    /** Actions performed during the session */
+    actions: BreakGlassAction[];
+    /** Always requires post-incident review */
+    requiresPostReview: true;
+    /** Verification methods used */
+    verificationMethods: VerificationMethod[];
+    /** IP address at activation */
+    activationIp?: string;
+    /** Device fingerprint at activation */
+    deviceFingerprint?: string;
+    /** Notifications sent */
+    notificationsSent: BreakGlassNotification[];
+    /** Post-incident review details */
+    review?: BreakGlassReview;
+}
+export declare const breakGlassSessionSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    reason: z.ZodString;
+    incidentId: z.ZodOptional<z.ZodString>;
+    scope: z.ZodNativeEnum<{
+        readonly FULL: "full";
+        readonly LIMITED: "limited";
+    }>;
+    resources: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    status: z.ZodNativeEnum<{
+        readonly PENDING_VERIFICATION: "pending_verification";
+        readonly ACTIVE: "active";
+        readonly EXPIRED: "expired";
+        readonly REVOKED: "revoked";
+        readonly REVIEW_PENDING: "review_pending";
+        readonly REVIEWED: "reviewed";
+    }>;
+    startedAt: z.ZodDate;
+    expiresAt: z.ZodDate;
+    endedAt: z.ZodOptional<z.ZodDate>;
+    revokedBy: z.ZodOptional<z.ZodString>;
+    revocationReason: z.ZodOptional<z.ZodString>;
+    renewed: z.ZodBoolean;
+    actions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodDate;
+        type: z.ZodString;
+        method: z.ZodOptional<z.ZodString>;
+        path: z.ZodOptional<z.ZodString>;
+        resourceId: z.ZodOptional<z.ZodString>;
+        ipAddress: z.ZodOptional<z.ZodString>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        requestBodyHash: z.ZodOptional<z.ZodString>;
+        responseStatus: z.ZodOptional<z.ZodNumber>;
+        durationMs: z.ZodOptional<z.ZodNumber>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        path?: string;
+        durationMs?: number;
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        method?: string;
+        ipAddress?: string;
+        resourceId?: string;
+        timestamp?: Date;
+        responseStatus?: number;
+        requestBodyHash?: string;
+    }, {
+        path?: string;
+        durationMs?: number;
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        method?: string;
+        ipAddress?: string;
+        resourceId?: string;
+        timestamp?: Date;
+        responseStatus?: number;
+        requestBodyHash?: string;
+    }>, "many">;
+    requiresPostReview: z.ZodLiteral<true>;
+    verificationMethods: z.ZodArray<z.ZodNativeEnum<{
+        readonly MFA_TOTP: "mfa_totp";
+        readonly MFA_BACKUP_CODE: "mfa_backup_code";
+        readonly PHONE_CALLBACK: "phone_callback";
+        readonly HARDWARE_TOKEN: "hardware_token";
+    }>, "many">;
+    activationIp: z.ZodOptional<z.ZodString>;
+    deviceFingerprint: z.ZodOptional<z.ZodString>;
+    notificationsSent: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        channel: z.ZodString;
+        target: z.ZodString;
+        sentAt: z.ZodDate;
+        success: z.ZodBoolean;
+        error: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        error?: string;
+        target?: string;
+        id?: string;
+        success?: boolean;
+        channel?: string;
+        sentAt?: Date;
+    }, {
+        error?: string;
+        target?: string;
+        id?: string;
+        success?: boolean;
+        channel?: string;
+        sentAt?: Date;
+    }>, "many">;
+    review: z.ZodOptional<z.ZodObject<{
+        reviewedAt: z.ZodDate;
+        reviewedBy: z.ZodString;
+        approved: z.ZodBoolean;
+        findings: z.ZodString;
+        recommendedActions: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        approved?: boolean;
+        findings?: string;
+        reviewedAt?: Date;
+        reviewedBy?: string;
+        recommendedActions?: string[];
+    }, {
+        approved?: boolean;
+        findings?: string;
+        reviewedAt?: Date;
+        reviewedBy?: string;
+        recommendedActions?: string[];
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    id?: string;
+    status?: "active" | "expired" | "revoked" | "pending_verification" | "review_pending" | "reviewed";
+    userId?: string;
+    expiresAt?: Date;
+    actions?: {
+        path?: string;
+        durationMs?: number;
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        method?: string;
+        ipAddress?: string;
+        resourceId?: string;
+        timestamp?: Date;
+        responseStatus?: number;
+        requestBodyHash?: string;
+    }[];
+    startedAt?: Date;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    revokedBy?: string;
+    revocationReason?: string;
+    incidentId?: string;
+    endedAt?: Date;
+    renewed?: boolean;
+    requiresPostReview?: true;
+    verificationMethods?: ("mfa_totp" | "mfa_backup_code" | "phone_callback" | "hardware_token")[];
+    activationIp?: string;
+    notificationsSent?: {
+        error?: string;
+        target?: string;
+        id?: string;
+        success?: boolean;
+        channel?: string;
+        sentAt?: Date;
+    }[];
+    review?: {
+        approved?: boolean;
+        findings?: string;
+        reviewedAt?: Date;
+        reviewedBy?: string;
+        recommendedActions?: string[];
+    };
+}, {
+    reason?: string;
+    id?: string;
+    status?: "active" | "expired" | "revoked" | "pending_verification" | "review_pending" | "reviewed";
+    userId?: string;
+    expiresAt?: Date;
+    actions?: {
+        path?: string;
+        durationMs?: number;
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+        userAgent?: string;
+        method?: string;
+        ipAddress?: string;
+        resourceId?: string;
+        timestamp?: Date;
+        responseStatus?: number;
+        requestBodyHash?: string;
+    }[];
+    startedAt?: Date;
+    resources?: string[];
+    scope?: "full" | "limited";
+    deviceFingerprint?: string;
+    revokedBy?: string;
+    revocationReason?: string;
+    incidentId?: string;
+    endedAt?: Date;
+    renewed?: boolean;
+    requiresPostReview?: true;
+    verificationMethods?: ("mfa_totp" | "mfa_backup_code" | "phone_callback" | "hardware_token")[];
+    activationIp?: string;
+    notificationsSent?: {
+        error?: string;
+        target?: string;
+        id?: string;
+        success?: boolean;
+        channel?: string;
+        sentAt?: Date;
+    }[];
+    review?: {
+        approved?: boolean;
+        findings?: string;
+        reviewedAt?: Date;
+        reviewedBy?: string;
+        recommendedActions?: string[];
+    };
+}>;
+/**
+ * Notification record
+ */
+export interface BreakGlassNotification {
+    id: string;
+    channel: 'email' | 'slack' | 'sms' | 'phone' | 'pagerduty';
+    target: string;
+    sentAt: Date;
+    success: boolean;
+    error?: string;
+}
+/**
+ * Post-incident review
+ */
+export interface BreakGlassReview {
+    reviewedAt: Date;
+    reviewedBy: string;
+    approved: boolean;
+    findings: string;
+    recommendedActions: string[];
+}
+/**
+ * Full audit trail for a break-glass session
+ */
+export interface BreakGlassAudit {
+    /** The session details */
+    session: BreakGlassSession;
+    /** User's break-glass usage this month */
+    monthlyUsageCount: number;
+    /** Timeline of all events */
+    timeline: BreakGlassAuditEvent[];
+    /** Compliance export data */
+    complianceExport: BreakGlassComplianceExport;
+}
+/**
+ * Audit event
+ */
+export interface BreakGlassAuditEvent {
+    timestamp: Date;
+    eventType: string;
+    actor: string;
+    details: Record<string, unknown>;
+}
+/**
+ * Compliance export format
+ */
+export interface BreakGlassComplianceExport {
+    exportedAt: Date;
+    sessionId: string;
+    userId: string;
+    reason: string;
+    scope: BreakGlassScope;
+    startTime: string;
+    endTime: string;
+    duration: number;
+    actionsCount: number;
+    resourcesAccessed: string[];
+    incidentId?: string;
+    reviewStatus: string;
+    reviewFindings?: string;
+    hashChain: string;
+}
+/**
+ * MFA verification input
+ */
+export interface MfaVerificationInput {
+    method: VerificationMethod;
+    code?: string;
+    challengeId?: string;
+}
+/**
+ * Phone callback verification
+ */
+export interface PhoneCallbackInput {
+    phoneNumber: string;
+    callbackCode: string;
+}
+/**
+ * Service dependencies
+ */
+export interface BreakGlassServiceDependencies {
+    /** Notification service for alerts */
+    notificationService?: NotificationServiceInterface;
+    /** MFA service for verification */
+    mfaService?: MfaServiceInterface;
+    /** Incident management service */
+    incidentService?: IncidentServiceInterface;
+    /** Audit logger */
+    auditLogger?: AuditLoggerInterface;
+    /** Compliance export service */
+    complianceExporter?: ComplianceExporterInterface;
+}
+/**
+ * Service configuration
+ */
+export interface BreakGlassServiceConfig {
+    /** Maximum session duration in milliseconds */
+    maxSessionDurationMs?: number;
+    /** Maximum uses per user per month */
+    maxUsesPerMonth?: number;
+    /** Review deadline in milliseconds */
+    reviewDeadlineMs?: number;
+    /** Require phone callback for full scope */
+    requirePhoneCallbackForFullScope?: boolean;
+    /** Security admin user IDs for notifications */
+    securityAdminIds?: string[];
+    /** CISO contact for SMS/phone alerts */
+    cisoContact?: {
+        userId: string;
+        phone: string;
+        email: string;
+    };
+    /** Slack webhook for alerts */
+    slackWebhookUrl?: string;
+    /** PagerDuty routing key */
+    pagerDutyRoutingKey?: string;
+}
+interface NotificationServiceInterface {
+    sendSlack(webhookUrl: string, message: Record<string, unknown>): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    sendEmail(to: string, subject: string, body: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    sendSms(phone: string, message: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    sendPagerDuty(routingKey: string, payload: Record<string, unknown>): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    initiatePhoneCallback(phone: string, code: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+}
+interface MfaServiceInterface {
+    verifyTotp(userId: string, code: string): Promise<boolean>;
+    verifyBackupCode(userId: string, code: string): Promise<boolean>;
+    verifyHardwareToken(userId: string, assertion: string): Promise<boolean>;
+}
+interface IncidentServiceInterface {
+    createIncident(input: {
+        title: string;
+        description: string;
+        severity: string;
+        type: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<{
+        id: string;
+    }>;
+    linkToIncident(incidentId: string, sessionId: string): Promise<void>;
+}
+interface AuditLoggerInterface {
+    log(event: {
+        eventType: string;
+        actor: {
+            type: string;
+            id: string;
+            ip?: string;
+        };
+        action: string;
+        resource: {
+            type: string;
+            id: string;
+        };
+        outcome: 'success' | 'failure' | 'blocked';
+        reason?: string;
+        metadata?: Record<string, unknown>;
+    }): Promise<void>;
+}
+interface ComplianceExporterInterface {
+    export(data: BreakGlassComplianceExport): Promise<void>;
+}
+/**
+ * Break-Glass Emergency Access Service
+ *
+ * Provides controlled emergency access for critical situations with
+ * comprehensive auditing and safety controls.
+ */
+export declare class BreakGlassService {
+    private sessions;
+    private userMonthlyUsage;
+    private pendingVerifications;
+    private expirationTimers;
+    private readonly config;
+    private readonly notificationService?;
+    private readonly mfaService?;
+    private readonly incidentService?;
+    private readonly auditLogger?;
+    private readonly complianceExporter?;
+    constructor(config?: BreakGlassServiceConfig, deps?: BreakGlassServiceDependencies);
+    /**
+     * Initiate a break-glass emergency access request
+     *
+     * This creates a pending session that requires verification before activation.
+     * All security admins are immediately notified.
+     */
+    initiateBreakGlass(request: BreakGlassRequest): Promise<BreakGlassSession>;
+    /**
+     * Verify MFA for break-glass activation
+     */
+    verifyMfa(sessionId: string, verification: MfaVerificationInput): Promise<boolean>;
+    /**
+     * Activate a break-glass session after verification
+     */
+    activateSession(sessionId: string): Promise<BreakGlassSession>;
+    /**
+     * Validate if a break-glass session is currently valid
+     */
+    validateBreakGlass(sessionId: string): Promise<boolean>;
+    /**
+     * Revoke a break-glass session
+     */
+    revokeBreakGlass(sessionId: string, revokedBy: string, reason?: string): Promise<void>;
+    /**
+     * Get all currently active break-glass sessions
+     */
+    getActiveBreakGlass(): Promise<BreakGlassSession[]>;
+    /**
+     * Get full audit trail for a break-glass session
+     */
+    auditBreakGlass(sessionId: string): Promise<BreakGlassAudit>;
+    /**
+     * Record an action performed during a break-glass session
+     */
+    recordAction(sessionId: string, action: Omit<BreakGlassAction, 'id' | 'timestamp'>): Promise<void>;
+    /**
+     * Renew a break-glass session (can only be done once)
+     */
+    renewSession(sessionId: string, reason: string): Promise<BreakGlassSession>;
+    /**
+     * Submit post-incident review for a break-glass session
+     */
+    submitReview(sessionId: string, reviewedBy: string, review: Omit<BreakGlassReview, 'reviewedAt' | 'reviewedBy'>): Promise<BreakGlassSession>;
+    /**
+     * Get session by ID
+     */
+    getSession(sessionId: string): BreakGlassSession | undefined;
+    /**
+     * Get sessions pending review
+     */
+    getPendingReviews(): BreakGlassSession[];
+    /**
+     * Check if a resource is accessible under a break-glass session
+     */
+    isResourceAccessible(sessionId: string, resourceId: string): boolean;
+    private expireSession;
+    private setExpirationTimer;
+    private clearExpirationTimer;
+    private getMonthlyUsage;
+    private incrementMonthlyUsage;
+    private generateCallbackCode;
+    private notifyAllSecurityAdmins;
+    private alertCiso;
+    private auditLog;
+    private buildComplianceExport;
+    private computeHashChain;
+    private exportToCompliance;
+    /**
+     * Clean up resources
+     */
+    destroy(): void;
+}
+/**
+ * Break-glass specific error
+ */
+export declare class BreakGlassError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/**
+ * Middleware options for break-glass route protection
+ */
+export interface AllowBreakGlassOptions {
+    /** Break-glass service instance */
+    service: BreakGlassService;
+    /** Header name for session ID (default: 'x-break-glass-session') */
+    sessionHeader?: string;
+    /** Require specific scope for this route */
+    requiredScope?: BreakGlassScope;
+    /** Specific resource ID for limited scope validation */
+    resourceId?: string | ((request: FastifyRequest) => string);
+}
+/**
+ * Create middleware that allows break-glass sessions to override normal authorization
+ *
+ * This middleware should be added to protected routes that need to support
+ * emergency access. It checks for a valid break-glass session and records
+ * all actions performed during the session.
+ *
+ * @example
+ * ```typescript
+ * fastify.route({
+ *   method: 'POST',
+ *   url: '/admin/critical-action',
+ *   preHandler: [
+ *     normalAuthMiddleware,
+ *     allowBreakGlass({ service: breakGlassService }),
+ *   ],
+ *   handler: handleCriticalAction,
+ * });
+ * ```
+ */
+export declare function allowBreakGlass(options: AllowBreakGlassOptions): preHandlerHookHandler;
+/**
+ * Create a new break-glass service instance
+ */
+export declare function createBreakGlassService(config?: BreakGlassServiceConfig, deps?: BreakGlassServiceDependencies): BreakGlassService;
+declare module 'fastify' {
+    interface FastifyRequest {
+        breakGlassSession?: BreakGlassSession;
+    }
+}
+export {};
+//# sourceMappingURL=break-glass.d.ts.map