/**
 * Authorization Service
 *
 * Enforces the consumer-supplied {@link IAuthorizationProvider} for privileged service
 * methods. Privileged services take this as a single optional dependency rather than
 * each growing its own provider parameter, so extending enforcement to a new service is
 * one constructor argument and one call per method.
 *
 * Enforcement lives here — at the service layer — rather than in a route guard, because
 * a guard only protects the routes it is attached to. `AdminAuthService` is public API:
 * a hand-written controller, a script or a queue worker can all reach it, and each must
 * face the same policy.
 */
import { AuthAuditEventType } from '../enums/auth-audit-event-type.enum';
import { AuthAuditEventStatus } from '../entities/auth-audit.entity';
import { NAuthLogger } from '../utils/nauth-logger';
import { AuthAction, IAuthorizationProvider } from '../interfaces/authorization-provider.interface';
/** What a caller knows about the operation, beyond the action itself. */
export interface AuthorizeOptions {
    /** External identifier of the user being acted upon, when there is one. */
    targetSub?: string;
}
/** The slice of the audit service used to record denials. */
export interface AuthorizationAuditRecorder {
    recordEvent(data: {
        sub?: string;
        eventType: AuthAuditEventType;
        eventStatus: AuthAuditEventStatus;
        reason?: string | null;
        description?: string | null;
        metadata?: Record<string, unknown> | null;
    }): Promise<unknown>;
}
/**
 * Applies the configured authorization provider to privileged operations.
 */
export declare class AuthorizationService {
    private readonly provider?;
    private readonly logger?;
    private readonly getAuditRecorder?;
    /**
     * @param provider - The consumer's provider. Absent means authorization is not configured.
     * @param logger - Used to report denials and misbehaving providers
     * @param getAuditRecorder - Resolves the audit service when a denial needs recording.
     *   A thunk rather than the service itself because the audit service is constructed
     *   after this one — it, and every other privileged service, depends on it.
     */
    constructor(provider?: IAuthorizationProvider | undefined, logger?: NAuthLogger | undefined, getAuditRecorder?: (() => AuthorizationAuditRecorder | undefined) | undefined);
    /**
     * Whether a provider is configured.
     *
     * Route mounting uses this to refuse to expose admin endpoints that nothing would
     * guard, failing at startup rather than at the first request.
     *
     * @returns true when privileged operations are being enforced
     */
    isConfigured(): boolean;
    /**
     * Authorize a privileged operation, or throw.
     *
     * Order of decision:
     * 1. **No provider** — permitted. Preserves the behaviour of every release before
     *    authorization existed, so upgrading cannot break a running application.
     * 2. **System context** — permitted without consulting the provider. See `runAsSystem`.
     * 3. **No actor** — denied. Off the request path with no explicit bypass, there is
     *    nobody to authorize; treating that as trusted would wave through any background
     *    job reachable from user input.
     * 4. Otherwise the provider decides. A provider that throws is treated as a denial.
     *
     * @param action - The operation being attempted
     * @param options - The target of the operation, when it has one
     * @throws {NAuthException} `FORBIDDEN` when the operation is not permitted
     */
    authorize(action: AuthAction, options?: AuthorizeOptions): Promise<void>;
    /**
     * Record and raise a denial.
     *
     * Denials are audited because they are more interesting than successes: a run of them
     * against admin actions is what a privilege-escalation attempt looks like.
     *
     * @param context - What was attempted, and by whom
     * @param reason - The provider's reason, surfaced to the caller and stored
     * @throws {NAuthException} Always
     */
    private deny;
}
//# sourceMappingURL=authorization.service.d.ts.map