import { BaseRouteGuard, GuardContext } from './route-guard';
/**
 * Permission matching strategy
 */
export type PermissionMatchStrategy = 'any' | 'all' | 'none';
/**
 * Permission format: resource:action or custom format
 */
export type Permission = string;
/**
 * Structured permission with resource and action
 */
export interface StructuredPermission {
    /** Resource identifier (e.g., 'posts', 'users') */
    readonly resource: string;
    /** Action identifier (e.g., 'read', 'write', 'delete') */
    readonly action: string;
    /** Optional resource instance ID */
    readonly resourceId?: string;
}
/**
 * Permission guard configuration
 */
export interface PermissionGuardConfig {
    /** Guard name */
    readonly name?: string;
    /** Required permissions */
    readonly requiredPermissions: readonly Permission[];
    /** How to match permissions */
    readonly matchStrategy?: PermissionMatchStrategy;
    /** Path to redirect unauthorized users */
    readonly unauthorizedPath?: string;
    /** Custom unauthorized message */
    readonly unauthorizedMessage?: string;
    /** Get user permissions from context */
    readonly getUserPermissions?: (context: GuardContext) => readonly Permission[];
    /** Custom permission check function */
    readonly checkPermission?: (userPermissions: readonly Permission[], required: Permission, context: GuardContext) => boolean | Promise<boolean>;
    /** Permission aliases (permission -> expanded permissions) */
    readonly aliases?: Record<string, readonly Permission[]>;
    /** Wildcard permission that grants all access */
    readonly wildcardPermission?: Permission;
    /** Separator for resource:action format */
    readonly separator?: string;
    /** Routes this guard applies to */
    readonly routes?: readonly string[];
    /** Routes to exclude */
    readonly exclude?: readonly string[];
    /** Guard priority */
    readonly priority?: number;
    /** Feature flag */
    readonly featureFlag?: string;
}
/**
 * Permission check result
 */
export interface PermissionCheckResult {
    /** Whether user has required permissions */
    readonly hasAccess: boolean;
    /** User's permissions */
    readonly userPermissions: readonly Permission[];
    /** Required permissions */
    readonly requiredPermissions: readonly Permission[];
    /** Missing permissions */
    readonly missingPermissions: readonly Permission[];
    /** Matched permissions */
    readonly matchedPermissions: readonly Permission[];
    /** Strategy used */
    readonly strategy: PermissionMatchStrategy;
}
/**
 * Default permission guard configuration
 */
export declare const DEFAULT_PERMISSION_CONFIG: Partial<PermissionGuardConfig>;
/**
 * Common permission actions
 */
export declare const PermissionActions: {
    readonly READ: "read";
    readonly WRITE: "write";
    readonly CREATE: "create";
    readonly UPDATE: "update";
    readonly DELETE: "delete";
    readonly MANAGE: "manage";
    readonly ADMIN: "admin";
};
/**
 * Permission-based route guard
 *
 * @example
 * ```typescript
 * const guard = new PermissionGuard({
 *   requiredPermissions: ['posts:edit', 'posts:delete'],
 *   matchStrategy: 'any',
 *   aliases: {
 *     'posts:manage': ['posts:read', 'posts:write', 'posts:delete'],
 *   },
 * });
 *
 * const result = await guard.execute('canActivate', context);
 * ```
 */
export declare class PermissionGuard extends BaseRouteGuard {
    private readonly permConfig;
    constructor(config: PermissionGuardConfig);
    /**
     * Get required permissions
     */
    getRequiredPermissions(): readonly Permission[];
    /**
     * Get match strategy
     */
    getMatchStrategy(): PermissionMatchStrategy;
    /**
     * Check permissions without full guard execution
     */
    checkPermissions(userPermissions: readonly Permission[], context: GuardContext): Promise<PermissionCheckResult>;
    /**
     * Expand permissions with aliases
     */
    private expandPermissionsWithAliases;
    /**
     * Check if user has required permission access
     */
    private checkPermissionAccess;
    /**
     * Get user permissions from context
     */
    private getUserPermissions;
    /**
     * Perform permission check based on strategy
     */
    private performPermissionCheck;
    /**
     * Check a single permission
     */
    private checkSinglePermission;
    /**
     * Handle unauthorized access
     */
    private handleUnauthorized;
}
/**
 * Create a permission guard
 *
 * @param config - Guard configuration
 * @returns PermissionGuard instance
 */
export declare function createPermissionGuard(config: PermissionGuardConfig): PermissionGuard;
/**
 * Create a guard requiring a single permission
 *
 * @param permission - Required permission
 * @param options - Additional options
 * @returns PermissionGuard instance
 */
export declare function requirePermission(permission: Permission, options?: Partial<Omit<PermissionGuardConfig, 'requiredPermissions'>>): PermissionGuard;
/**
 * Create a guard requiring any of the specified permissions
 *
 * @param permissions - Permissions (any one required)
 * @param options - Additional options
 * @returns PermissionGuard instance
 */
export declare function requireAnyPermission(permissions: readonly Permission[], options?: Partial<Omit<PermissionGuardConfig, 'requiredPermissions' | 'matchStrategy'>>): PermissionGuard;
/**
 * Create a guard requiring all specified permissions
 *
 * @param permissions - Permissions (all required)
 * @param options - Additional options
 * @returns PermissionGuard instance
 */
export declare function requireAllPermissions(permissions: readonly Permission[], options?: Partial<Omit<PermissionGuardConfig, 'requiredPermissions' | 'matchStrategy'>>): PermissionGuard;
/**
 * Create a resource-action permission guard
 *
 * @param resource - Resource name
 * @param action - Action name
 * @param options - Additional options
 * @returns PermissionGuard instance
 */
export declare function requireResourcePermission(resource: string, action: string, options?: Partial<Omit<PermissionGuardConfig, 'requiredPermissions'>>): PermissionGuard;
/**
 * Parse a permission string into structured format
 *
 * @param permission - Permission string (e.g., 'posts:edit')
 * @param separator - Separator character
 * @returns Structured permission
 */
export declare function parsePermission(permission: Permission, separator?: string): StructuredPermission;
/**
 * Build a permission string from structured format
 *
 * @param structured - Structured permission
 * @param separator - Separator character
 * @returns Permission string
 */
export declare function buildPermission(structured: StructuredPermission, separator?: string): Permission;
/**
 * Check if user has a specific permission
 *
 * @param userPermissions - User's permissions
 * @param permission - Permission to check
 * @param separator - Separator for wildcard matching
 * @returns True if user has permission
 */
export declare function hasPermission(userPermissions: readonly Permission[], permission: Permission, separator?: string): boolean;
/**
 * Check if user has any of the specified permissions
 *
 * @param userPermissions - User's permissions
 * @param permissions - Permissions to check
 * @param separator - Separator for wildcard matching
 * @returns True if user has any permission
 */
export declare function hasAnyPermission(userPermissions: readonly Permission[], permissions: readonly Permission[], separator?: string): boolean;
/**
 * Check if user has all specified permissions
 *
 * @param userPermissions - User's permissions
 * @param permissions - Permissions to check
 * @param separator - Separator for wildcard matching
 * @returns True if user has all permissions
 */
export declare function hasAllPermissions(userPermissions: readonly Permission[], permissions: readonly Permission[], separator?: string): boolean;
/**
 * Get missing permissions for a user
 *
 * @param userPermissions - User's permissions
 * @param requiredPermissions - Required permissions
 * @param separator - Separator for wildcard matching
 * @returns Array of missing permissions
 */
export declare function getMissingPermissions(userPermissions: readonly Permission[], requiredPermissions: readonly Permission[], separator?: string): Permission[];
/**
 * Type guard for PermissionGuard
 */
export declare function isPermissionGuard(value: unknown): value is PermissionGuard;
/**
 * Type guard for PermissionCheckResult
 */
export declare function isPermissionCheckResult(value: unknown): value is PermissionCheckResult;
/**
 * Type guard for StructuredPermission
 */
export declare function isStructuredPermission(value: unknown): value is StructuredPermission;