import type { Constructor } from '@atlex/core';
import type { Authenticatable } from '../contracts/Authenticatable.js';
import { AuthorizationResponse } from './AuthorizationResponse.js';
import { type Policy } from './Policy.js';
export type AbilityCallback = (user: Authenticatable | null, ...args: unknown[]) => boolean | AuthorizationResponse | Promise<boolean | AuthorizationResponse>;
export type BeforeCallback = (user: Authenticatable | null, ability: string, ...args: unknown[]) => boolean | null | undefined | Promise<boolean | null | undefined>;
export type AfterCallback = (user: Authenticatable | null, ability: string, result: boolean, ...args: unknown[]) => boolean | undefined | Promise<boolean | undefined>;
/**
 * Authorization gate: closures, policies, and global hooks.
 */
export declare class Gate {
    private readonly abilitiesMap;
    private readonly policiesMap;
    private readonly resourcePolicies;
    private readonly beforeHooks;
    private readonly afterHooks;
    private readonly currentUser;
    private readonly resolvePolicy;
    /**
     * @param currentUser - Returns the authenticated user (or null).
     * @param resolvePolicy - Instantiates a policy class (usually via IoC).
     */
    constructor(currentUser: () => Promise<Authenticatable | null>, resolvePolicy: <T extends Policy>(c: Constructor<T>) => T);
    /**
     * Registers a closure ability.
     */
    define(ability: string, callback: AbilityCallback): this;
    /**
     * Registers a resource policy mapping (`post.view`, `post.update`, ...).
     */
    resource(name: string, policyClass: Constructor<Policy>, abilities?: string[]): this;
    /**
     * Maps a model constructor to a policy class.
     */
    policy(model: Constructor<object>, policyClass: Constructor<Policy>): this;
    /**
     * Resolves a policy for an arbitrary model instance.
     */
    getPolicyFor(model: object): Policy | null;
    /**
     * Global pre-authorization hook.
     */
    before(callback: BeforeCallback): this;
    /**
     * Global post-authorization hook.
     */
    after(callback: AfterCallback): this;
    /**
     * @returns True when the ability passes for the current user.
     */
    allows(ability: string, ...args: unknown[]): Promise<boolean>;
    /**
     * @returns Inverse of {@link Gate.allows}.
     */
    denies(ability: string, ...args: unknown[]): Promise<boolean>;
    /**
     * @returns True when every ability passes.
     */
    check(abilities: string[], args?: unknown[]): Promise<boolean>;
    /**
     * @returns True when any ability passes.
     */
    any(abilities: string[], args?: unknown[]): Promise<boolean>;
    /**
     * Throws {@link AuthorizationError} when denied.
     */
    authorize(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
    /**
     * Returns a structured response without throwing.
     */
    inspect(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
    /**
     * Like {@link Gate.inspect} but uses an explicit user (e.g. {@link Gate.forUser}).
     *
     * @param user - User context (guest checks pass `null`).
     * @param ability - Ability name.
     * @param args - Additional arguments (models, ids, ...).
     */
    inspectForUser(user: Authenticatable | null, ability: string, args: unknown[]): Promise<AuthorizationResponse>;
    /**
     * @returns Gate scoped to a concrete user (ignores the ambient request user).
     */
    forUser(user: Authenticatable): GateForUser;
    /**
     * @returns Registered closure abilities.
     */
    abilities(): Record<string, AbilityCallback>;
    /**
     * @returns Registered explicit policy mappings.
     */
    policies(): Map<Constructor<object>, Constructor<Policy>>;
    /**
     * @returns True when a closure ability exists.
     */
    has(ability: string): boolean;
    private runAbility;
    private invokePolicyMethod;
}
/**
 * Gate scoped to a fixed {@link Authenticatable} instance.
 */
export declare class GateForUser {
    private readonly gate;
    private readonly user;
    /**
     * @param gate - Parent gate.
     * @param user - Fixed user.
     */
    constructor(gate: Gate, user: Authenticatable);
    /**
     * @returns True when the ability passes for the fixed user.
     */
    allows(ability: string, ...args: unknown[]): Promise<boolean>;
    /**
     * @returns Structured inspection for the fixed user.
     */
    inspect(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
    /**
     * Throws when denied for the fixed user.
     */
    authorize(ability: string, ...args: unknown[]): Promise<AuthorizationResponse>;
}
//# sourceMappingURL=Gate.d.ts.map