import { RBACConfig, RoleDefinition, PermissionAction, PermissionScope, AccessRequest, EvaluationResult, RBACAuditHandler } from './types';
/**
 * Timeout for pattern matching operations in milliseconds.
 *
 * SECURITY: Limits execution time for regex operations to prevent DoS.
 */
/**
 * RBAC Engine for permission evaluation.
 *
 * Provides comprehensive RBAC functionality including role inheritance,
 * permission resolution, and caching.
 *
 * @example
 * ```typescript
 * const engine = new RBACEngine({
 *   roles: [
 *     {
 *       id: 'admin',
 *       name: 'Administrator',
 *       permissions: ['*'],
 *       priority: 100,
 *     },
 *     {
 *       id: 'user',
 *       name: 'User',
 *       permissions: ['users:read:own', 'documents:*:own'],
 *       priority: 10,
 *     },
 *   ],
 *   defaultDecision: 'deny',
 * });
 *
 * // Initialize with user context
 * engine.setUserContext(['user'], { id: 'user-123' });
 *
 * // Check permissions
 * engine.hasPermission('users:read'); // true
 * engine.canAccess('documents', 'create'); // true
 * ```
 */
export declare class RBACEngine {
    private config;
    private roleMap;
    private permissionCache;
    private evaluationCache;
    private cacheExpiry;
    private userRoles;
    private userAttributes;
    private resolvedPermissions;
    private auditHandlers;
    private readonly debug;
    /**
     * Create a new RBAC engine.
     *
     * @param config - RBAC configuration
     */
    constructor(config: RBACConfig);
    /**
     * Set the current user context.
     *
     * @param roles - User's assigned roles
     * @param attributes - User attributes for ABAC
     */
    setUserContext(roles: string[], attributes?: Record<string, unknown>): void;
    /**
     * Get the current user's roles.
     */
    getUserRoles(): string[];
    /**
     * Get the resolved permissions for current user.
     */
    getResolvedPermissions(): string[];
    /**
     * Update configuration.
     *
     * @param config - Partial configuration update
     */
    updateConfig(config: Partial<RBACConfig>): void;
    /**
     * Add a role definition.
     *
     * @param role - Role definition to add
     */
    addRole(role: RoleDefinition): void;
    /**
     * Remove a role definition.
     *
     * @param roleId - Role ID to remove
     */
    removeRole(roleId: string): void;
    /**
     * Check if user has a specific permission.
     *
     * @param permission - Permission string to check
     * @returns Whether user has the permission
     */
    hasPermission(permission: string): boolean;
    /**
     * Check if user has any of the given permissions.
     *
     * @param permissions - Permissions to check
     * @returns Whether user has any permission
     */
    hasAnyPermission(permissions: string[]): boolean;
    /**
     * Check if user has all of the given permissions.
     *
     * @param permissions - Permissions to check
     * @returns Whether user has all permissions
     */
    hasAllPermissions(permissions: string[]): boolean;
    /**
     * Check if user has a specific role.
     *
     * @param roleId - Role ID to check
     * @returns Whether user has the role
     */
    hasRole(roleId: string): boolean;
    /**
     * Check if user has any of the given roles.
     *
     * @param roleIds - Role IDs to check
     * @returns Whether user has any role
     */
    hasAnyRole(roleIds: string[]): boolean;
    /**
     * Check if user has all of the given roles.
     *
     * @param roleIds - Role IDs to check
     * @returns Whether user has all roles
     */
    hasAllRoles(roleIds: string[]): boolean;
    /**
     * Check if user can access a resource with an action.
     *
     * @param resource - Resource type
     * @param action - Action to perform
     * @param scope - Permission scope
     * @returns Whether access is allowed
     */
    canAccess(resource: string, action: PermissionAction, scope?: PermissionScope): boolean;
    /**
     * Check resource-level permission.
     *
     * @param resourceType - Resource type
     * @param _resourceId
     * @param action - Action to perform
     * @param context - Additional context
     * @returns Whether access is allowed
     */
    checkResourcePermission(resourceType: string, _resourceId: string, action: PermissionAction, context?: Record<string, unknown>): boolean;
    /**
     * Evaluate an access request using full ABAC evaluation.
     *
     * @param request - Access request to evaluate
     * @returns Evaluation result
     */
    evaluate(request: AccessRequest): EvaluationResult;
    /**
     * Clear all caches.
     */
    clearCache(): void;
    /**
     * Register an audit handler.
     */
    onAudit(handler: RBACAuditHandler): () => void;
    /**
     * Evaluate policies for a request.
     */
    private evaluatePolicies;
    /**
     * Evaluate a single policy.
     */
    private evaluatePolicy;
    /**
     * Check if request matches policy target.
     */
    private matchesPolicyTarget;
    /**
     * Check if request matches policy subject.
     */
    private matchesPolicySubject;
    /**
     * Check if request matches policy resource.
     */
    private matchesPolicyResource;
    /**
     * Match identifier with support for wildcards and patterns.
     *
     * SECURITY: Implements multiple protections against ReDoS attacks:
     * 1. Maximum pattern length limit (MAX_PATTERN_LENGTH)
     * 2. Escaping of regex metacharacters before pattern conversion
     * 3. Use of non-greedy quantifiers where possible
     * 4. Simple string matching for exact matches (no regex)
     * 5. For complex patterns, uses linear-time matching algorithm
     */
    private matchIdentifier;
    /**
     * Safely matches a glob-like pattern against a value.
     *
     * SECURITY: Implements ReDoS-safe pattern matching:
     * - Validates pattern length before processing
     * - Escapes regex metacharacters to prevent injection
     * - Uses non-greedy quantifiers (.*? instead of .*)
     * - Falls back to simple string matching for overly complex patterns
     *
     * @param pattern - Glob-like pattern (supports * and ?)
     * @param value - Value to match against
     * @returns Whether the value matches the pattern
     */
    private safePatternMatch;
    /**
     * Linear-time glob matching algorithm.
     *
     * SECURITY: This implementation uses a non-regex approach that runs
     * in O(n*m) worst case where n = pattern length and m = value length.
     * This prevents the exponential backtracking that causes ReDoS.
     *
     * Supports:
     * - * matches any sequence of characters (including empty)
     * - ? matches exactly one character
     *
     * @param pattern - Glob pattern with * and ? wildcards
     * @param value - String to match
     * @returns Whether the pattern matches the value
     */
    private globMatch;
    /**
     * Evaluate a policy condition.
     */
    private evaluatePolicyCondition;
    /**
     * Evaluate time-based condition.
     */
    private evaluateTimeCondition;
    /**
     * Evaluate IP-based condition.
     */
    private evaluateIPCondition;
    /**
     * Evaluate attribute-based condition.
     */
    private evaluateAttributeCondition;
    /**
     * Evaluate context-based condition.
     */
    private evaluateContextCondition;
    /**
     * Evaluate using permission matrix.
     */
    private evaluatePermissionMatrix;
    /**
     * Index roles for quick lookup.
     */
    private indexRoles;
    /**
     * Resolve all permissions for current user.
     */
    private resolvePermissions;
    /**
     * Resolve permissions for a role including inheritance.
     */
    private resolveRolePermissions;
    /**
     * Check if user has a role through inheritance.
     */
    private hasInheritedRole;
    /**
     * Match permission against patterns.
     */
    private matchPermissionPattern;
    /**
     * Check if current user is a super admin.
     */
    private isSuperAdmin;
    /**
     * Create an evaluation result.
     */
    private createResult;
    /**
     * Generate cache key for evaluation.
     */
    private getEvaluationCacheKey;
    /**
     * Check if cache is still valid.
     */
    private isCacheValid;
    /**
     * Cache a permission check result.
     */
    private cachePermission;
    /**
     * Cache an evaluation result.
     */
    private cacheEvaluation;
    /**
     * Emit an audit event.
     */
    private auditCheck;
    /**
     * Log debug message.
     */
    private log;
}
/**
 * Create a new RBAC engine.
 *
 * @param config - RBAC configuration
 * @returns Configured RBAC engine
 */
export declare function createRBACEngine(config: RBACConfig): RBACEngine;