import { EncryptedEntityWithType } from '../utils';
import { ExchangeKeysManager } from './ExchangeKeysManager';
import { CryptoPrimitives } from './CryptoPrimitives';
import { ExchangeDataManager } from './ExchangeDataManager';
import { ExchangeDataMapManager } from './ExchangeDataMapManager';
import { SecureDelegationsEncryption } from './SecureDelegationsEncryption';
import { IccDataOwnerXApi } from '../icc-data-owner-x-api';
import { EncryptedEntity, EncryptedEntityStub, SecureDelegation } from '../../icc-api/model/models';
import AccessLevelEnum = SecureDelegation.AccessLevelEnum;
export type DelegationMembersDetails = {
    delegator: string | undefined;
    delegate: string | undefined;
    fullyExplicit: boolean;
    accessControlSecret: string | undefined;
    accessLevel: AccessLevelEnum;
};
export declare enum SecurityMetadataType {
    SecretId = 1,// Start from 1, avoids issues with SecretId being falsy
    EncryptionKey = 2,
    OwningEntityId = 3
}
export declare class SecurityMetadataDecryptor {
    private readonly exchangeKeysManager;
    private readonly primitives;
    private readonly exchangeData;
    private readonly exchangeDataMap;
    private readonly secureDelegationsEncryption;
    private readonly dataOwnerApi;
    constructor(exchangeKeysManager: ExchangeKeysManager, primitives: CryptoPrimitives, exchangeData: ExchangeDataManager, exchangeDataMap: ExchangeDataMapManager, secureDelegationsEncryption: SecureDelegationsEncryption, dataOwnerApi: IccDataOwnerXApi);
    decryptLegacyDelegations(entities: (EncryptedEntityStub | EncryptedEntity)[], dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        [entityId: string]: string[];
    }>;
    private extractFromLegacyDelegations;
    private populateLegacyDelegationDelegate;
    private tryDecryptLegacyDelegation;
    decryptSecureDelegationsUsingCache(entities: (EncryptedEntityStub | EncryptedEntity)[], dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        [entityId: string]: string[];
    }>;
    hasSecurityMetadataOfType(delegation: SecureDelegation, metadataType: SecurityMetadataType): boolean;
    decryptSecureDelegationsUsingKnownExchangeData(entities: (EncryptedEntityStub | EncryptedEntity)[], dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        [entityId: string]: string[];
    }>;
    decryptSecureDelegationsUsingExchangeDataMap(entities: (EncryptedEntityStub | EncryptedEntity)[], dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        [entityId: string]: string[];
    }>;
    decryptAll(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        ownerId: string;
        extracted: string[];
    }[]>;
    decryptAllLegacyDelegations(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        decrypted: string;
        dataOwnersWithAccess: string[];
    }[]>;
    /**
     * For every value (secret id / encryption key / owning entity id, depending on metadataType) decryptable by the
     * given hierarchy, returns which data owners have DIRECT access to it: i.e. are explicitly named as either party
     * (delegator/delegate, owner/delegatedTo) of the specific delegation edge that carries that value - never a data
     * owner merely reachable by inference through a parent/child hierarchy relationship. Both parties of an edge get
     * equal credit for its content because they have equal decrypt access to it by construction (the edge's exchange
     * key can be unwrapped by either party's private key).
     *
     * Used to check whether sharing a value with a delegate would be redundant because some other, already-decryptable
     * delegation on the entity already grants that delegate the exact same value directly.
     */
    directlyAccessibleValuesByDataOwner(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        [dataOwnerId: string]: Set<string>;
    }>;
    decryptAllSecureDelegations(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[], metadataType: SecurityMetadataType): Promise<{
        decrypted: string;
        dataOwnersWithAccess: string[];
    }[]>;
    getDelegationMemberDetails(typedEntity: EncryptedEntityWithType): Promise<{
        [delegationKey: string]: DelegationMembersDetails;
    }>;
    decryptSecureDelegationMetadata(delegation: SecureDelegation, metadataType: SecurityMetadataType, key: CryptoKey): Promise<string[]>;
    getEntityLegacyDelegationAccessLevel(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[]): Promise<AccessLevelEnum | undefined>;
    getEntitySecureDelegationAccessLevel(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[]): Promise<AccessLevelEnum | undefined>;
    getEntityAccessLevel(entity: EncryptedEntityStub | EncryptedEntity, dataOwnersHierarchySubset: string[]): Promise<AccessLevelEnum | undefined>;
    hasAnyEncryptionKeys(entity: EncryptedEntityStub | EncryptedEntity): boolean;
}