import { type CanActivate, type ExecutionContext } from '@nestjs/common';
import type { Reflector } from '@nestjs/core';
import type { AuthzContext } from '../context/authz-context';
export type EnforceMode = 'off' | 'shadow' | 'enforce';
export declare const AUTHZ_REQUIREMENT_KEY = "skillera:authz:requirement";
export declare const PUBLIC_KEY = "skillera:authz:public";
/** @Authenticated(): require login but NO ability check (any authenticated user). */
export declare const AUTHENTICATED_KEY = "skillera:authz:authenticated";
export interface AuthzRequirement {
    action: string;
    subject: string;
}
/** Resolves the ability + context for an HTTP request (gateway-specific impl supplies it). */
export interface AbilityResolver {
    resolve(req: unknown): Promise<AuthzContext | null>;
}
export interface GlobalAuthzGuardOptions {
    mode?: EnforceMode;
    /**
     * Fallback requirement source, consulted when a route has no @Authorize.
     * Lets a host reuse pre-existing route metadata (e.g. the gateway's legacy
     * @CheckPolicies) instead of re-decorating every endpoint. Returns null when
     * the route genuinely has no requirement (→ default-deny still applies).
     */
    requirementResolver?: (context: ExecutionContext, reflector: Reflector) => AuthzRequirement | null;
}
export declare class GlobalAuthzGuard implements CanActivate {
    private readonly reflector;
    private readonly resolver;
    private readonly logger;
    private readonly mode;
    private readonly requirementResolver?;
    constructor(reflector: Reflector, resolver: AbilityResolver, opts?: GlobalAuthzGuardOptions | EnforceMode);
    canActivate(context: ExecutionContext): Promise<boolean>;
}
//# sourceMappingURL=global-authz.guard.d.ts.map