import { type IContextOptions } from './context-utils.js';
/**
 * Authentication Decorators for NestJS
 *
 * This module provides base authentication decorators that work across different
 * NestJS contexts (HTTP, GraphQL, WebSockets). These decorators use standardized
 * metadata keys and can be extended by context-specific packages.
 *
 * @packageDocumentation
 */
/**
 * Metadata key for public access routes/resolvers.
 *
 * Set by `@Public()` and `@Auth()` decorators. Read by `JwtAuthGuard` to determine if authentication is required.
 *
 * @returns String constant `'isPublic'`
 *
 * @example
 * ```ts
 * const isPublic = Reflect.getMetadata(IS_PUBLIC_KEY, targetClass, methodName);
 * ```
 */
export declare const IS_PUBLIC_KEY = "isPublic";
/**
 * Metadata key for role-based access control.
 *
 * Set by `@Roles(...roles)` decorator. Read by `RoleGuard` to enforce role requirements.
 *
 * @returns String constant `'roles'`
 *
 * @example
 * ```ts
 * const roles = Reflect.getMetadata(ROLES_KEY, targetClass, methodName);
 * ```
 */
export declare const ROLES_KEY = "roles";
/**
 * Metadata key for permission-based access control.
 *
 * Set by `@Permissions(...permissions)` decorator. Read by `PermissionGuard` to enforce permission requirements.
 *
 * @returns String constant `'permissions'`
 *
 * @example
 * ```ts
 * const permissions = Reflect.getMetadata(PERMISSIONS_KEY, targetClass, methodName);
 * ```
 */
export declare const PERMISSIONS_KEY = "permissions";
/**
 * Metadata key for AND-logic role-based access control.
 *
 * Set by `@RequireAllRoles(...roles)` decorator. Read by `RoleGuard` to enforce that the user must have ALL specified roles.
 *
 * @returns String constant `'requireAllRoles'`
 *
 * @example
 * ```ts
 * const roles = Reflect.getMetadata(REQUIRE_ALL_ROLES_KEY, targetClass, methodName);
 * ```
 */
export declare const REQUIRE_ALL_ROLES_KEY = "requireAllRoles";
/**
 * Metadata key for AND-logic permission-based access control.
 *
 * Set by `@RequireAllPermissions(...permissions)` decorator. Read by `PermissionGuard` to enforce that the user must have ALL specified permissions.
 *
 * @returns String constant `'requireAllPermissions'`
 *
 * @example
 * ```ts
 * const permissions = Reflect.getMetadata(REQUIRE_ALL_PERMISSIONS_KEY, targetClass, methodName);
 * ```
 */
export declare const REQUIRE_ALL_PERMISSIONS_KEY = "requireAllPermissions";
/**
 * Decorator to mark routes/resolvers as public (no authentication required)
 *
 * This decorator sets the IS_PUBLIC_KEY metadata to true, signaling to
 * authentication guards that the decorated endpoint should be accessible
 * without authentication.
 *
 * @returns Method decorator that marks the endpoint as public
 *
 * @example
 * ```ts
 * @Public()
 * @Get('health')
 * checkHealth() {
 *   return { status: 'ok' };
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @Public()
 * @Query(() => String, { name: 'GetHealth' })
 * async getHealth(): Promise<string> {
 *   return 'OK';
 * }
 * ```
 */
export declare const Public: () => MethodDecorator;
/**
 * Decorator to mark routes/resolvers as requiring authentication
 *
 * This decorator sets the IS_PUBLIC_KEY metadata to false, ensuring that
 * authentication guards will require valid credentials for the decorated endpoint.
 *
 * @returns Method decorator that marks the endpoint as requiring authentication
 *
 * @example
 * ```ts
 * @Auth()
 * @Get('profile')
 * getProfile() {
 *   // This endpoint requires authentication
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @Auth()
 * @Query(() => IUser, { name: 'GetCurrentUser' })
 * async getCurrentUser(@CurrentUser() user: IUser): Promise<IUser> {
 *   return user;
 * }
 * ```
 */
export declare const Auth: () => MethodDecorator;
/**
 * Decorator to specify required roles for routes/resolvers
 *
 * This decorator sets the ROLES_KEY metadata with an array of required roles.
 * Role guards will check that the authenticated user has at least one of the
 * specified roles before allowing access.
 *
 * @param roles - Array of role names required for access
 * @returns Method decorator that specifies role requirements
 *
 * @example
 * ```ts
 * @Roles('admin', 'moderator')
 * @Post('admin-action')
 * adminAction() {
 *   // Only users with 'admin' or 'moderator' roles can access
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @Roles('admin')
 * @Mutation(() => IUser, { name: 'UpdateUser' })
 * async updateUser(@Args('input') input: UpdateUserInput): Promise<IUser> {
 *   // Only admin users can update other users
 * }
 * ```
 */
export declare const Roles: (...roles: string[]) => MethodDecorator;
/**
 * Decorator to specify required permissions for routes/resolvers
 *
 * This decorator sets the PERMISSIONS_KEY metadata with an array of required permissions.
 * Permission guards check that the authenticated user has at least one of the specified
 * permissions (OR logic). Uses roles-as-permissions semantics — permission strings are
 * matched against user role names.
 *
 * @param permissions - Array of permission names required for access
 * @returns Method decorator that specifies permission requirements
 *
 * @example
 * ```ts
 * @Permissions('user.create', 'user.update')
 * @Post('users')
 * createUser(@Body() data: CreateUserDto) {
 *   // Only users with 'user.create' OR 'user.update' role can access (roles-as-permissions)
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @Permissions('user.delete')
 * @Mutation(() => Boolean, { name: 'DeleteUser' })
 * async deleteUser(@Args('id') id: string): Promise<boolean> {
 *   // Only users with 'user.delete' role can delete users
 * }
 * ```
 */
export declare const Permissions: (...permissions: string[]) => MethodDecorator;
/**
 * Decorator to specify required roles for routes/resolvers with AND logic
 *
 * This decorator sets the REQUIRE_ALL_ROLES_KEY metadata with an array of required roles.
 * Unlike `@Roles()` which uses OR logic (any role matches), this decorator enforces AND logic:
 * the authenticated user must have ALL of the specified roles to gain access.
 *
 * @param roles - Array of role names required for access (user must have ALL)
 * @returns Method decorator that specifies AND-logic role requirements
 *
 * @example
 * ```ts
 * @RequireAllRoles('admin', 'auditor')
 * @Get('audit-logs')
 * getAuditLogs() {
 *   // Only users with BOTH 'admin' AND 'auditor' roles can access
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @RequireAllRoles('moderator', 'content-reviewer')
 * @Mutation(() => Boolean, { name: 'ApproveContent' })
 * async approveContent(@Args('id') id: string): Promise<boolean> {
 *   // Only users with BOTH 'moderator' AND 'content-reviewer' roles can approve
 * }
 * ```
 */
export declare const RequireAllRoles: (...roles: string[]) => MethodDecorator;
/**
 * Decorator to specify required permissions for routes/resolvers with AND logic
 *
 * This decorator sets the REQUIRE_ALL_PERMISSIONS_KEY metadata with an array of required permissions.
 * Unlike `@Permissions()` which uses OR logic (any permission matches), this decorator enforces AND logic:
 * the authenticated user must have ALL of the specified permissions to gain access.
 * Uses roles-as-permissions semantics — permission strings are matched against user role names.
 *
 * @param permissions - Array of permission names required for access (user must have ALL)
 * @returns Method decorator that specifies AND-logic permission requirements
 *
 * @example
 * ```ts
 * @RequireAllPermissions('user.create', 'user.approve')
 * @Post('users/create-approved')
 * createApprovedUser(@Body() data: CreateUserDto) {
 *   // Only users with BOTH 'user.create' AND 'user.approve' roles can access (roles-as-permissions)
 * }
 * ```
 *
 * @example GraphQL
 * ```ts
 * @RequireAllPermissions('data.read', 'data.export')
 * @Query(() => [IData], { name: 'ExportData' })
 * async exportData(): Promise<IData[]> {
 *   // Only users with BOTH 'data.read' AND 'data.export' roles can export
 * }
 * ```
 */
export declare const RequireAllPermissions: (...permissions: string[]) => MethodDecorator;
export type { IContextOptions } from './context-utils.js';
export { DetectContextType, ExtractRequestFromContext, ExtractUserFromContext, ExtractAuthTokenFromContext } from './context-utils.js';
/**
 * Parameter decorator to extract the current authenticated user
 *
 * This decorator injects the authenticated user object from the request context
 * into method parameters. The user object is typically populated by authentication
 * guards during the request processing pipeline.
 *
 * Supports both HTTP and GraphQL contexts with automatic detection or explicit specification.
 *
 * @param property - Optional property path to extract from the user object (e.g., 'id', 'profile.name')
 * @param options - Context options for controlling extraction behavior
 * @returns Parameter decorator that injects the current user or user property
 *
 * @example HTTP context (auto-detected)
 * ```ts
 * @Get('profile')
 * getProfile(@CurrentUser() user: IUser) {
 *   return user;
 * }
 * ```
 *
 * @example With property access
 * ```ts
 * @Get('profile')
 * getProfile(@CurrentUser('id') userId: string) {
 *   return this.userService.findById(userId);
 * }
 * ```
 *
 * @example GraphQL context (explicit)
 * ```ts
 * @Query(() => IUser, { name: 'GetCurrentUser' })
 * async getCurrentUser(@CurrentUser(undefined, { contextType: 'graphql' }) user: IUser): Promise<IUser> {
 *   return user;
 * }
 * ```
 *
 * @example Auto-detect context
 * ```ts
 * @UseGuards(AuthGuard)
 * getData(@CurrentUser() user: IUser) {
 *   // Works in both HTTP and GraphQL contexts
 * }
 * ```
 */
export declare function CurrentUser(property?: string, options?: IContextOptions): ParameterDecorator;
/**
 * Parameter decorator to extract the authorization token from request headers
 *
 * This decorator injects the raw authorization token from the request headers
 * into method parameters. Useful for custom token validation or when you need
 * access to the raw token string.
 *
 * Supports both HTTP and GraphQL contexts with automatic detection or explicit specification.
 *
 * @param options - Context options for controlling extraction behavior
 * @returns Parameter decorator that injects the authorization token
 *
 * @example HTTP context (auto-detected)
 * ```ts
 * @Get('validate-token')
 * validateToken(@AuthToken() token: string) {
 *   return this.authService.validateToken(token);
 * }
 * ```
 *
 * @example GraphQL context (explicit)
 * ```ts
 * @Query(() => Boolean, { name: 'ValidateToken' })
 * async validateToken(@AuthToken({ contextType: 'graphql' }) token: string): Promise<boolean> {
 *   return this.authService.validateToken(token);
 * }
 * ```
 */
export declare function AuthToken(options?: IContextOptions): ParameterDecorator;
/**
 * Parameter decorator to extract Keycloak token claims from the request
 *
 * This decorator injects the raw token claims from the request context
 * into method parameters. The claims object contains the decoded JWT payload
 * with standard OIDC claims and Keycloak-specific fields. Useful for accessing
 * fine-grained claim information beyond the normalized `IKeycloakUser` object.
 *
 * Supports both HTTP and GraphQL contexts with automatic detection or explicit specification.
 *
 * @param options - Context options for controlling extraction behavior
 * @returns Parameter decorator that injects the Keycloak token claims
 *
 * @example HTTP context (auto-detected)
 * ```ts
 * @Get('claims')
 * getClaims(@KeycloakClaims() claims: IKeycloakTokenClaims) {
 *   return { issuer: claims.iss, expiry: claims.exp };
 * }
 * ```
 *
 * @example GraphQL context (explicit)
 * ```ts
 * @Query(() => Object, { name: 'GetClaims' })
 * async getClaims(@KeycloakClaims({ contextType: 'graphql' }) claims: IKeycloakTokenClaims): Promise<Record<string, unknown>> {
 *   return { sessionState: claims.session_state, scope: claims.scope };
 * }
 * ```
 */
export declare function KeycloakClaims(options?: IContextOptions): ParameterDecorator;
//# sourceMappingURL=auth-decorators.d.ts.map