import { ADGroup, ADUser, ADGroupRoleMapping, ADGroupMappingConfig } from '../types';
import { Role, Permission } from '../../types';
/**
 * Result of group mapping evaluation.
 */
export interface GroupMappingResult {
    /** Resolved role (highest priority) */
    role: Role | undefined;
    /** Combined permissions from all matched mappings */
    permissions: Permission[];
    /** Groups that matched mappings */
    matchedGroups: ADGroup[];
    /** Mappings that were applied */
    appliedMappings: ADGroupRoleMapping[];
}
/**
 * AD Group Mapper for role and permission resolution.
 *
 * Evaluates user group memberships against configured mapping rules
 * to determine appropriate application roles and permissions.
 *
 * @example
 * ```typescript
 * const mapper = new ADGroupMapper({
 *   mappings: [
 *     {
 *       groupIdentifier: 'sg-app-admins',
 *       matchType: 'exact',
 *       role: 'admin',
 *       additionalPermissions: ['manage:users', 'manage:settings'],
 *       priority: 100,
 *     },
 *     {
 *       groupIdentifier: 'sg-app-*',
 *       matchType: 'pattern',
 *       role: 'user',
 *       priority: 10,
 *     },
 *   ],
 *   defaultRole: 'guest',
 *   defaultPermissions: ['read:public'],
 * });
 *
 * const { role, permissions } = mapper.mapUserGroups(user.adGroups);
 * ```
 */
export declare class ADGroupMapper {
    private readonly config;
    private cache;
    private cacheExpiry;
    /**
     * Create a new group mapper.
     *
     * @param config - Group mapping configuration
     */
    constructor(config?: Partial<ADGroupMappingConfig>);
    /**
     * Map user's AD groups to application roles and permissions.
     *
     * @param groups - User's AD group memberships
     * @param user - Optional user for condition evaluation
     * @returns Mapped role and permissions
     */
    mapUserGroups(groups: ADGroup[], user?: ADUser): GroupMappingResult;
    /**
     * Get the highest-priority role for a user based on their groups.
     *
     * @param groups - User's AD group memberships
     * @param user - Optional user for condition evaluation
     * @returns Mapped role (or default role if none matched)
     */
    getRole(groups: ADGroup[], user?: ADUser): Role;
    /**
     * Get all permissions for a user based on their groups.
     *
     * @param groups - User's AD group memberships
     * @param user - Optional user for condition evaluation
     * @returns Array of permissions
     */
    getPermissions(groups: ADGroup[], user?: ADUser): Permission[];
    /**
     * Check if any of the user's groups match a specific mapping.
     *
     * @param groups - User's AD group memberships
     * @param groupIdentifier - Group identifier to check
     * @param matchType - How to match the identifier
     * @returns Whether any group matches
     */
    hasMatchingGroup(groups: ADGroup[], groupIdentifier: string, matchType?: ADGroupRoleMapping['matchType']): boolean;
    /**
     * Get all matched mappings for a set of groups.
     *
     * @param groups - User's AD group memberships
     * @param user - Optional user for condition evaluation
     * @returns Array of matched mappings with their matched groups
     */
    getMatchedMappings(groups: ADGroup[], user?: ADUser): Array<{
        mapping: ADGroupRoleMapping;
        matchedGroups: ADGroup[];
    }>;
    /**
     * Add a new mapping at runtime.
     *
     * @param mapping - Mapping to add
     */
    addMapping(mapping: ADGroupRoleMapping): void;
    /**
     * Remove a mapping by group identifier.
     *
     * @param groupIdentifier - Identifier of the mapping to remove
     */
    removeMapping(groupIdentifier: string): void;
    /**
     * Update an existing mapping.
     *
     * @param groupIdentifier - Identifier of the mapping to update
     * @param updates - Partial updates to apply
     */
    updateMapping(groupIdentifier: string, updates: Partial<ADGroupRoleMapping>): void;
    /**
     * Clear the mapping cache.
     */
    clearCache(): void;
    /**
     * Get the current configuration.
     */
    getConfig(): ADGroupMappingConfig;
    /**
     * Evaluate all mappings against user groups.
     */
    private evaluateMappings;
    /**
     * Check if a group matches the identifier based on match type.
     */
    private matchesGroup;
    /**
     * Match using glob-like pattern (* wildcard).
     */
    private matchPattern;
    /**
     * Generate cache key from groups.
     */
    private getCacheKey;
}