import { BaseRouteGuard, GuardContext } from './route-guard';
/**
 * Role matching strategy
 */
export type RoleMatchStrategy = 'any' | 'all' | 'none';
/**
 * Role guard configuration
 */
export interface RoleGuardConfig {
    /** Guard name */
    readonly name?: string;
    /** Required roles */
    readonly requiredRoles: readonly string[];
    /** How to match roles */
    readonly matchStrategy?: RoleMatchStrategy;
    /** Path to redirect unauthorized users */
    readonly unauthorizedPath?: string;
    /** Custom unauthorized message */
    readonly unauthorizedMessage?: string;
    /** Role hierarchy (role -> parent roles) */
    readonly roleHierarchy?: Record<string, readonly string[]>;
    /** Custom role check function */
    readonly checkRoles?: (userRoles: readonly string[], requiredRoles: readonly string[], strategy: RoleMatchStrategy) => boolean;
    /** Get user roles from context */
    readonly getUserRoles?: (context: GuardContext) => readonly string[];
    /** Routes this guard applies to */
    readonly routes?: readonly string[];
    /** Routes to exclude */
    readonly exclude?: readonly string[];
    /** Guard priority */
    readonly priority?: number;
    /** Feature flag */
    readonly featureFlag?: string;
}
/**
 * Role check result
 */
export interface RoleCheckResult {
    /** Whether user has required roles */
    readonly hasAccess: boolean;
    /** User's roles */
    readonly userRoles: readonly string[];
    /** Required roles */
    readonly requiredRoles: readonly string[];
    /** Missing roles (for 'all' strategy) */
    readonly missingRoles: readonly string[];
    /** Matched roles (for 'any' strategy) */
    readonly matchedRoles: readonly string[];
    /** Strategy used */
    readonly strategy: RoleMatchStrategy;
}
/**
 * Default role guard configuration
 */
export declare const DEFAULT_ROLE_CONFIG: Partial<RoleGuardConfig>;
/**
 * Role-based route guard
 *
 * @example
 * ```typescript
 * const guard = new RoleGuard({
 *   requiredRoles: ['admin', 'super-admin'],
 *   matchStrategy: 'any',
 *   roleHierarchy: {
 *     'super-admin': ['admin'],
 *   },
 * });
 *
 * const result = await guard.execute('canActivate', context);
 * ```
 */
export declare class RoleGuard extends BaseRouteGuard {
    private readonly roleConfig;
    private readonly _expandedRoles;
    constructor(config: RoleGuardConfig);
    /**
     * Get required roles
     */
    getRequiredRoles(): readonly string[];
    /**
     * Get match strategy
     */
    getMatchStrategy(): RoleMatchStrategy;
    /**
     * Check roles without full guard execution
     */
    checkRoles(userRoles: readonly string[]): RoleCheckResult;
    /**
     * Expand roles with hierarchy (include parent roles)
     */
    private expandRolesWithHierarchy;
    /**
     * Check if user has required role access
     */
    private checkRoleAccess;
    /**
     * Get user roles from context
     */
    private getUserRoles;
    /**
     * Perform role check based on strategy
     */
    private performRoleCheck;
    /**
     * Expand user roles with hierarchy
     */
    private expandUserRolesWithHierarchy;
    /**
     * Handle unauthorized access
     */
    private handleUnauthorized;
}
/**
 * Create a role guard
 *
 * @param config - Guard configuration
 * @returns RoleGuard instance
 */
export declare function createRoleGuard(config: RoleGuardConfig): RoleGuard;
/**
 * Create a guard requiring a single role
 *
 * @param role - Required role
 * @param options - Additional options
 * @returns RoleGuard instance
 */
export declare function requireRole(role: string, options?: Partial<Omit<RoleGuardConfig, 'requiredRoles'>>): RoleGuard;
/**
 * Create a guard requiring any of the specified roles
 *
 * @param roles - Roles (any one required)
 * @param options - Additional options
 * @returns RoleGuard instance
 */
export declare function requireAnyRole(roles: readonly string[], options?: Partial<Omit<RoleGuardConfig, 'requiredRoles' | 'matchStrategy'>>): RoleGuard;
/**
 * Create a guard requiring all specified roles
 *
 * @param roles - Roles (all required)
 * @param options - Additional options
 * @returns RoleGuard instance
 */
export declare function requireAllRoles(roles: readonly string[], options?: Partial<Omit<RoleGuardConfig, 'requiredRoles' | 'matchStrategy'>>): RoleGuard;
/**
 * Create a guard excluding users with specified roles
 *
 * @param roles - Roles to exclude
 * @param options - Additional options
 * @returns RoleGuard instance
 */
export declare function excludeRoles(roles: readonly string[], options?: Partial<Omit<RoleGuardConfig, 'requiredRoles' | 'matchStrategy'>>): RoleGuard;
/**
 * Create an admin guard
 *
 * @param options - Additional options
 * @returns RoleGuard for admin access
 */
export declare function createAdminGuard(options?: Partial<Omit<RoleGuardConfig, 'requiredRoles'>>): RoleGuard;
/**
 * Check if user has a specific role
 *
 * @param userRoles - User's roles
 * @param role - Role to check
 * @param hierarchy - Optional role hierarchy
 * @returns True if user has role
 */
export declare function hasRole(userRoles: readonly string[], role: string, hierarchy?: Record<string, readonly string[]>): boolean;
/**
 * Check if user has any of the specified roles
 *
 * @param userRoles - User's roles
 * @param roles - Roles to check
 * @param hierarchy - Optional role hierarchy
 * @returns True if user has any role
 */
export declare function hasAnyRole(userRoles: readonly string[], roles: readonly string[], hierarchy?: Record<string, readonly string[]>): boolean;
/**
 * Check if user has all specified roles
 *
 * @param userRoles - User's roles
 * @param roles - Roles to check
 * @param hierarchy - Optional role hierarchy
 * @returns True if user has all roles
 */
export declare function hasAllRoles(userRoles: readonly string[], roles: readonly string[], hierarchy?: Record<string, readonly string[]>): boolean;
/**
 * Get missing roles for a user
 *
 * @param userRoles - User's roles
 * @param requiredRoles - Required roles
 * @param hierarchy - Optional role hierarchy
 * @returns Array of missing roles
 */
export declare function getMissingRoles(userRoles: readonly string[], requiredRoles: readonly string[], hierarchy?: Record<string, readonly string[]>): string[];
/**
 * Type guard for RoleGuard
 */
export declare function isRoleGuard(value: unknown): value is RoleGuard;
/**
 * Type guard for RoleCheckResult
 */
export declare function isRoleCheckResult(value: unknown): value is RoleCheckResult;