import { Prisma, PrismaClient } from "@prisma/client";
import { Expression, RuntimeDataModel } from "./expressions";
declare const VALID_OPERATIONS: readonly ["SELECT", "UPDATE", "INSERT", "DELETE"];
type Operation = (typeof VALID_OPERATIONS)[number];
export type Models = Prisma.ModelName;
type PrismaExecutor = Pick<PrismaClient, "$executeRawUnsafe" | "$queryRawUnsafe" | "$queryRaw">;
interface ResolvedSetupAbilityExpression {
    abilityExpression: string;
    policyExpression: string;
}
export interface SetupMetadata {
    appName?: string;
    appRevision?: string;
    appVersion?: string;
}
export interface SetupValidationResult {
    actualHash: string;
    expectedHash: string;
    manifestId: string;
}
export interface SetupManifestAbility {
    expression: string | null;
    model: string;
    operation: Operation;
    policyName: string;
    slug: string;
}
export interface SetupManifestRole {
    grants: string[] | "*";
    roleName: string;
}
export interface SetupManifest {
    abilities: SetupManifestAbility[];
    databaseScope: string;
    roles: SetupManifestRole[];
}
interface ClientOptions {
    /** The maximum amount of time Yates will wait to acquire a transaction from the database. The default value is 30 seconds. */
    txMaxWait?: number;
    /** The maximum amount of time the Yates query transaction can run before being canceled and rolled back. The default value is 30 seconds. */
    txTimeout?: number;
}
export interface Ability<ContextKeys extends string, M extends Models> {
    description?: string;
    expression?: Expression<ContextKeys, M>;
    operation: Operation;
    model?: M;
    slug?: string;
}
export type AllAbilities<ContextKeys extends string, YModels extends Models> = {
    [model in YModels]: Ability<ContextKeys, model>;
}[YModels];
type CRUDOperations = "read" | "create" | "update" | "delete";
export type DefaultAbilities<ContextKeys extends string = string, YModels extends Models = Models> = {
    [Model in YModels]: {
        [op in CRUDOperations]: Ability<ContextKeys, Model>;
    };
};
export type CustomAbilities<ContextKeys extends string = string, YModels extends Models = Models> = {
    [model in YModels]?: {
        [op in string]?: Ability<ContextKeys, model>;
    };
};
export type GetContextFn<ContextKeys extends string = string> = () => {
    role: string;
    transactionId?: string;
    context?: {
        [key in ContextKeys]: string | number | string[];
    };
} | null;
declare module "@prisma/client" {
    interface PrismaClient {
        _executeRequest: (params: any) => Promise<any>;
    }
}
export interface SetupParams<ContextKeys extends string = string, YModels extends Models = Models, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>> {
    /**
     * The Prisma client instance. Used for database queries and model introspection.
     */
    prisma: PrismaClient;
    /**
     * Custom abilities to add to the default abilities.
     */
    customAbilities?: K;
    /**
     * A function that returns the roles for your application.
     * This is parameterised by the abilities, so you can use it to create roles that are a combination of abilities.
     */
    getRoles: (abilities: DefaultAbilities<ContextKeys, YModels> & K) => {
        [role: string]: AllAbilities<ContextKeys, YModels>[] | "*";
    };
    /**
     * A function that returns the context for the current request.
     * This is called on every prisma query, and is needed to determine the current user's role.
     * You can also provide additional context here, which will be available in any RLS expressions you've defined.
     * Returning `null` will result in the permissions being skipped entirely.
     */
    getContext: GetContextFn<ContextKeys>;
    metadata?: SetupMetadata;
    options?: ClientOptions;
}
export type SetupMigrationParams<ContextKeys extends string = string, YModels extends Models = Models, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>> = Omit<SetupParams<ContextKeys, YModels, K>, "getContext">;
export declare class YatesSetupManifestMismatchError extends Error {
    readonly manifestId: string;
    readonly expectedHash: string;
    readonly actualHash: string | null;
    constructor(manifestId: string, expectedHash: string, actualHash: string | null);
}
export declare const sanitizeSlug: (slug: string) => string;
export declare class Yates {
    private prisma;
    private databaseScope;
    constructor(prisma: PrismaClient);
    init: () => Promise<void>;
    createDatabaseScope: (databaseName: string) => string;
    getDatabaseScope: () => string;
    ensureDatabaseScope: () => Promise<string>;
    setupAbilityTable: () => Promise<[number, number, number, number, number]>;
    createAbilityName: (model: string, ability: string) => string;
    createRoleName: (name: string) => string;
    quoteIdentifier: (identifier: string) => string;
    enableRowLevelSecurityIfNeeded: (prisma: Pick<PrismaClient, "$executeRawUnsafe" | "$queryRawUnsafe">, table: string) => Promise<void>;
    createSetupManifestHash: (manifest: SetupManifest) => string;
    createSetupManifest: (abilities: Partial<DefaultAbilities>, roles: {
        [role: string]: "*" | AllAbilities<string, Prisma.ModelName>[];
    }) => {
        abilities: SetupManifestAbility[];
        databaseScope: string;
        roles: {
            grants: string[] | "*";
            roleName: string;
        }[];
    };
    getSetupManifestId: () => string;
    getStoredSetupManifestHash: (manifestId: string, prisma?: PrismaExecutor) => Promise<string | null>;
    upsertSetupManifestHash: (manifestId: string, manifestHash: string, prisma?: PrismaExecutor, metadata?: SetupMetadata) => Prisma.PrismaPromise<number>;
    getDefaultAbilities: (models: Models[]) => Partial<DefaultAbilities<string, Prisma.ModelName>>;
    createClient: (getContext: GetContextFn, options?: ClientOptions) => import("@prisma/client/runtime/client").DynamicClientExtensionThis<Prisma.TypeMap<import("@prisma/client/runtime/client").InternalArgs & {
        result: {};
        model: {};
        query: {};
        client: {};
    }, {}>, Prisma.TypeMapCb<Prisma.PrismaClientOptions>, {
        result: {};
        model: {};
        query: {};
        client: {};
    }>;
    setRLS: <ContextKeys extends string, YModel extends Prisma.ModelName>(prisma: PrismaExecutor, table: string, roleName: string, slug: string, ability: Ability<ContextKeys, YModel>, resolvedExpression: ResolvedSetupAbilityExpression) => Promise<void>;
    prepareSetup: <ContextKeys extends string, YModels extends Prisma.ModelName, K extends CustomAbilities<string, Prisma.ModelName> = CustomAbilities<string, Prisma.ModelName>, T = DefaultAbilities<ContextKeys, YModels> & K>({ customAbilities, getRoles, }: {
        customAbilities?: Partial<K> | undefined;
        getRoles: (abilities: T) => {
            [role: string]: "*" | AllAbilities<ContextKeys, YModels>[];
        };
    }) => Promise<{
        abilities: Partial<DefaultAbilities<string, Prisma.ModelName>>;
        defaultAbilities: Partial<DefaultAbilities<string, Prisma.ModelName>>;
        roles: {
            [role: string]: "*" | AllAbilities<ContextKeys, YModels>[];
        };
        setupManifest: {
            abilities: SetupManifestAbility[];
            databaseScope: string;
            roles: {
                grants: string[] | "*";
                roleName: string;
            }[];
        };
        setupManifestHash: string;
        setupManifestId: string;
    }>;
    validateSetup: <ContextKeys extends string, YModels extends Prisma.ModelName, K extends CustomAbilities<string, Prisma.ModelName> = CustomAbilities<string, Prisma.ModelName>, T = DefaultAbilities<ContextKeys, YModels> & K>({ customAbilities, getRoles, }: {
        customAbilities?: Partial<K> | undefined;
        getRoles: (abilities: T) => {
            [role: string]: "*" | AllAbilities<ContextKeys, YModels>[];
        };
    }) => Promise<SetupValidationResult>;
    resolveSetupAbilityExpressions: (abilities: Partial<DefaultAbilities>) => Promise<Record<string, ResolvedSetupAbilityExpression>>;
    createRoles: <ContextKeys extends string, YModels extends Prisma.ModelName, K extends CustomAbilities<string, Prisma.ModelName> = CustomAbilities<string, Prisma.ModelName>, T = DefaultAbilities<ContextKeys, YModels> & K>({ customAbilities, getRoles, metadata, options, }: {
        customAbilities?: Partial<K> | undefined;
        getRoles: (abilities: T) => {
            [role: string]: "*" | AllAbilities<ContextKeys, YModels>[];
        };
        metadata?: SetupMetadata | undefined;
        options?: ClientOptions | undefined;
    }) => Promise<void>;
    reconcileRoles: <ContextKeys extends string, YModels extends Prisma.ModelName>({ abilities, defaultAbilities, prisma, resolvedSetupAbilityExpressions, roles, }: {
        abilities: Partial<DefaultAbilities>;
        defaultAbilities: Partial<DefaultAbilities>;
        prisma: PrismaExecutor;
        resolvedSetupAbilityExpressions: Record<string, ResolvedSetupAbilityExpression>;
        roles: {
            [role: string]: "*" | AllAbilities<ContextKeys, YModels>[];
        };
    }) => Promise<void>;
    inspectDBRoles: (role: string) => Promise<{
        tablename: string;
        policyname: string;
        cmd: string;
        policy_roles: string[];
        matched_role: string[];
    }[]>;
    inspectRunTimeDataModel: () => RuntimeDataModel;
}
/**
 * Applies Yates roles, grants and row-level security policies. Run this from
 * an explicit deployment/migration step, not from normal application startup.
 **/
export declare const migrateYates: <ContextKeys extends string = string, YModels extends Prisma.ModelName = Prisma.ModelName, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>>(params: SetupMigrationParams<ContextKeys, YModels, K>) => Promise<void>;
/**
 * Validates that the database has already had the current Yates manifest
 * applied. This is safe for runtime startup because it does not create,
 * alter, grant, revoke or drop database authorization state.
 **/
export declare const validateYatesSetup: <ContextKeys extends string = string, YModels extends Prisma.ModelName = Prisma.ModelName, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>>(params: SetupMigrationParams<ContextKeys, YModels, K>) => Promise<SetupValidationResult>;
/**
 * Creates an extended client that sets contextual parameters and user role on
 * every query. Unlike setup(), this validates that migration already happened
 * instead of mutating database authorization state during app startup.
 **/
export declare const createYatesClient: <ContextKeys extends string = string, YModels extends Prisma.ModelName = Prisma.ModelName, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>>(params: SetupParams<ContextKeys, YModels, K>) => Promise<import("@prisma/client/runtime/client").DynamicClientExtensionThis<Prisma.TypeMap<import("@prisma/client/runtime/client").InternalArgs & {
    result: {};
    model: {};
    query: {};
    client: {};
}, {}>, Prisma.TypeMapCb<Prisma.PrismaClientOptions>, {
    result: {};
    model: {};
    query: {};
    client: {};
}>>;
/**
 * Creates an extended client that sets contextual parameters and user role on every query.
 *
 * This remains backwards compatible: it applies/migrates Yates database state
 * before returning the runtime client. For application startup, prefer running
 * migrateYates() in an explicit deploy step and createYatesClient() at runtime.
 **/
export declare const setup: <ContextKeys extends string = string, YModels extends Prisma.ModelName = Prisma.ModelName, K extends CustomAbilities<ContextKeys, YModels> = CustomAbilities<ContextKeys, YModels>>(params: SetupParams<ContextKeys, YModels, K>) => Promise<import("@prisma/client/runtime/client").DynamicClientExtensionThis<Prisma.TypeMap<import("@prisma/client/runtime/client").InternalArgs & {
    result: {};
    model: {};
    query: {};
    client: {};
}, {}>, Prisma.TypeMapCb<Prisma.PrismaClientOptions>, {
    result: {};
    model: {};
    query: {};
    client: {};
}>>;
export {};