import { HttpMethod } from '../types';
import { GeneratedEndpoint, UserContext, PermissionScope } from './api-generator';
/**
 * Permission derivation rule
 */
export interface PermissionRule {
    /** Rule name */
    readonly name: string;
    /** URL pattern to match */
    readonly pattern: string | RegExp;
    /** HTTP methods this rule applies to */
    readonly methods?: readonly HttpMethod[];
    /** Derived permission template */
    readonly permission: string | PermissionTemplate;
    /** Rule priority (higher = evaluated first) */
    readonly priority: number;
    /** Whether this rule overrides auto-derivation */
    readonly override: boolean;
}
/**
 * Permission template with placeholders
 */
export interface PermissionTemplate {
    /** Resource name (or placeholder like {resource}) */
    readonly resource: string;
    /** Action name (or placeholder like {action}) */
    readonly action: string;
    /** Scope (optional) */
    readonly scope?: PermissionScope;
}
/**
 * Derived permission result
 */
export interface DerivedPermission {
    /** Full permission string (e.g., users:read) */
    readonly permission: string;
    /** Resource part */
    readonly resource: string;
    /** Action part */
    readonly action: string;
    /** Scope if applicable */
    readonly scope?: PermissionScope;
    /** Source of derivation */
    readonly source: 'path' | 'method' | 'rule' | 'override';
    /** Confidence level */
    readonly confidence: 'high' | 'medium' | 'low';
}
/**
 * RBAC check result
 */
export interface RBACCheckResult {
    /** Whether access is allowed */
    readonly allowed: boolean;
    /** Decision type */
    readonly decision: 'allow' | 'deny' | 'requires_auth' | 'requires_role' | 'requires_permission';
    /** Reason for decision */
    readonly reason: string;
    /** Missing roles (if denied) */
    readonly missingRoles?: readonly string[];
    /** Missing permissions (if denied) */
    readonly missingPermissions?: readonly string[];
    /** Matched roles */
    readonly matchedRoles?: readonly string[];
    /** Matched permissions */
    readonly matchedPermissions?: readonly string[];
    /** Evaluation time (ms) */
    readonly evaluationTimeMs: number;
    /** Cache hit */
    readonly cacheHit: boolean;
}
/**
 * RBAC audit event
 */
export interface RBACAuditEvent {
    /** Event ID */
    readonly id: string;
    /** Event timestamp */
    readonly timestamp: number;
    /** Event type */
    readonly type: 'access_check';
    /** Endpoint ID */
    readonly endpointId: string;
    /** HTTP method */
    readonly method: HttpMethod;
    /** Request path */
    readonly path: string;
    /** User ID (if authenticated) */
    readonly userId?: string;
    /** User roles */
    readonly userRoles?: readonly string[];
    /** Required permissions */
    readonly requiredPermissions: readonly string[];
    /** Check result */
    readonly result: RBACCheckResult;
    /** Request metadata */
    readonly metadata?: Record<string, unknown>;
}
/**
 * RBAC integration configuration
 */
export interface RBACIntegrationConfig {
    /** Permission check function */
    readonly checkPermission: (user: UserContext, permission: string, context?: PermissionCheckContext) => boolean | Promise<boolean>;
    /** Role check function */
    readonly checkRole: (user: UserContext, role: string) => boolean | Promise<boolean>;
    /** Resource ownership check function */
    readonly checkOwnership?: (user: UserContext, resourceType: string, resourceId: string, ownerField: string) => boolean | Promise<boolean>;
    /** Custom permission rules */
    readonly customRules?: readonly PermissionRule[];
    /** Enable permission caching */
    readonly enableCache: boolean;
    /** Cache TTL in milliseconds */
    readonly cacheTtl: number;
    /** Enable audit logging */
    readonly enableAudit: boolean;
    /** Audit event handler */
    readonly onAuditEvent?: (event: RBACAuditEvent) => void;
    /** Super admin roles (bypass all checks) */
    readonly superAdminRoles?: readonly string[];
    /** Default behavior when no rules match */
    readonly defaultDecision: 'allow' | 'deny';
    /** Permission separator */
    readonly separator: string;
}
/**
 * Context for permission checks
 */
export interface PermissionCheckContext {
    /** Path parameters */
    readonly params?: Record<string, string>;
    /** Resource being accessed */
    readonly resource?: {
        type: string;
        id?: string;
    };
    /** Request context */
    readonly request?: {
        path: string;
        method: HttpMethod;
    };
}
/**
 * Default RBAC configuration
 */
export declare const DEFAULT_RBAC_CONFIG: Partial<RBACIntegrationConfig>;
/**
 * Extract resource name from URL path
 */
export declare function extractResourceFromPath(path: string): string;
/**
 * Extract parent resources from URL path
 */
export declare function extractParentResourcesFromPath(path: string): readonly string[];
/**
 * Get permission action from HTTP method
 */
export declare function getActionFromMethod(method: HttpMethod): string;
/**
 * Normalize action name
 */
export declare function normalizeAction(action: string): string;
/**
 * Derive permissions from endpoint path and method
 */
export declare function derivePermissions(path: string, method: HttpMethod, config?: Partial<RBACIntegrationConfig>): DerivedPermission[];
/**
 * Derive permissions from generated endpoint
 */
export declare function deriveEndpointPermissions(endpoint: GeneratedEndpoint, config?: Partial<RBACIntegrationConfig>): DerivedPermission[];
/**
 * RBAC integration for auto-generated APIs
 */
export declare class RBACIntegration {
    private readonly config;
    private readonly cache;
    private auditBuffer;
    constructor(config: Partial<RBACIntegrationConfig> & Pick<RBACIntegrationConfig, 'checkPermission' | 'checkRole'>);
    /**
     * Check if user has access to endpoint
     */
    checkAccess(endpoint: GeneratedEndpoint, user: UserContext | undefined, context?: PermissionCheckContext): Promise<RBACCheckResult>;
    /**
     * Clear permission cache
     */
    clearCache(): void;
    /**
     * Clear cache for specific user
     */
    clearUserCache(userId: string): void;
    /**
     * Clear cache for specific endpoint
     */
    clearEndpointCache(endpointId: string): void;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        hitRate: number;
    };
    /**
     * Get recent audit events
     */
    getAuditEvents(limit?: number): RBACAuditEvent[];
    /**
     * Get audit events for specific user
     */
    getUserAuditEvents(userId: string, limit?: number): RBACAuditEvent[];
    /**
     * Get audit events for specific endpoint
     */
    getEndpointAuditEvents(endpointId: string, limit?: number): RBACAuditEvent[];
    /**
     * Clear audit buffer
     */
    clearAuditBuffer(): void;
    /**
     * Check role requirements
     */
    private checkRoles;
    /**
     * Check permission requirements
     */
    private checkPermissions;
    /**
     * Check resource ownership
     */
    private checkResourceOwnership;
    /**
     * Check if user is super admin
     */
    private isSuperAdmin;
    /**
     * Create RBAC check result
     */
    private createResult;
    /**
     * Get cache key for permission check
     */
    private getCacheKey;
    /**
     * Cache permission check result
     */
    private cacheResult;
    /**
     * Emit audit event
     */
    private emitAuditEvent;
}
/**
 * Create RBAC integration instance
 */
export declare function createRBACIntegration(config: Partial<RBACIntegrationConfig> & Pick<RBACIntegrationConfig, 'checkPermission' | 'checkRole'>): RBACIntegration;
/**
 * Create simple permission checker from permission list
 */
export declare function createSimplePermissionChecker(getUserPermissions: (userId: string) => readonly string[] | Promise<readonly string[]>): RBACIntegrationConfig['checkPermission'];
/**
 * Create simple role checker from role list
 */
export declare function createSimpleRoleChecker(getUserRoles: (userId: string) => readonly string[] | Promise<readonly string[]>, roleHierarchy?: Record<string, readonly string[]>): RBACIntegrationConfig['checkRole'];
/**
 * Common permission rules for typical REST APIs
 */
export declare const COMMON_PERMISSION_RULES: readonly PermissionRule[];
/**
 * Build permission string from parts
 */
export declare function buildPermission(resource: string, action: string, scope?: PermissionScope, separator?: string): string;
/**
 * Parse permission string into parts
 */
export declare function parsePermission(permission: string, separator?: string): {
    resource: string;
    action: string;
    scope?: PermissionScope;
};
/**
 * Check if permission matches pattern
 */
export declare function permissionMatches(userPermission: string, requiredPermission: string, separator?: string): boolean;
/**
 * Type guard for RBACCheckResult
 */
export declare function isRBACCheckResult(value: unknown): value is RBACCheckResult;
/**
 * Type guard for DerivedPermission
 */
export declare function isDerivedPermission(value: unknown): value is DerivedPermission;