import type { AuditContext } from '@cclabsnz/sf-core';
import type { SecurityCheck, CheckResult } from '../SecurityCheck.js';
/**
 * Detects whether unauthenticated guests can see OTHER USERS — the identity-
 * enumeration surface that the object-level guest checks miss, because `User` is
 * not in their fixed object lists and is rarely surfaced by a guest profile's
 * ObjectPermissions.
 *
 * Three independent paths reach the same outcome, so all three are graded:
 *   - "View All Users" on a guest profile/permission set: total bypass of User
 *     sharing, every User record readable regardless of OWD (CRITICAL).
 *   - A public EXTERNAL org-wide default on `User` (Read/ReadWrite): every User
 *     record is visible to portal and guest users by sharing alone (HIGH).
 *   - An explicit Read grant on `User` in a guest permission set, which combined
 *     with any sharing path turns the roster into a queryable directory (HIGH).
 *
 * The INTERNAL sharing model is reported for context but never graded: `User`
 * ships as Public Read Only in every org, so grading it would fire on every audit.
 *
 * One leg is deliberately not asserted: the "Portal User Visibility" / "Community
 * User Visibility" checkboxes in Setup → Sharing Settings are not exposed to any
 * read API this plugin uses, so a clean result carries an explicit manual-
 * verification note rather than claiming more certainty than the data supports.
 * The Experience Cloud per-site equivalent ("Let guest users see other members")
 * IS API-readable and is covered by `guest-site-options`.
 */
export declare class GuestUserVisibilityCheck implements SecurityCheck {
    readonly id = "guest-user-visibility";
    readonly name = "Guest Visibility of Other Users";
    readonly category = "Access Control";
    readonly description = "Checks whether unauthenticated guests can see other User records \u2014 via View All Users, a public external OWD on User, or a guest Read grant on the User object";
    run(ctx: AuditContext): Promise<CheckResult>;
    private inconclusive;
}
//# sourceMappingURL=GuestUserVisibilityCheck.d.ts.map