import { CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
/**
 * Permission-based Authorization Guard
 *
 * Authorizes access based on user permissions specified by the `@Permissions()` decorator.
 * Uses roles-as-permissions semantics: checks that the authenticated user has at least one
 * role whose name matches a required permission string. Permission strings are matched directly
 * against Keycloak role names (both realm-level and client-specific roles are checked).
 *
 * Uses OR logic — access is granted if the user has ANY of the required permissions (i.e., if
 * any user role name matches any required permission string).
 * If no permissions are specified via `@Permissions()`, access is allowed by default.
 *
 * Throws `UnauthorizedException` if the user is not authenticated (missing from request).
 * Throws `ForbiddenException` if the user is authenticated but lacks all required permissions.
 *
 * @example
 * ```ts
 * @UseGuards(JwtAuthGuard, PermissionGuard)
 * @Controller('data')
 * export class DataController {
 *   @Permissions('read:data', 'write:data')
 *   @Get(':id')
 *   getData(@Param('id') id: string) {
 *     // User must have a role named 'read:data' OR 'write:data' (roles-as-permissions)
 *     return {};
 *   }
 * }
 * ```
 */
export declare class PermissionGuard implements CanActivate {
    private readonly Reflector;
    constructor(reflector: Reflector);
    /**
     * Activates permission-based authorization for the current request.
     *
     * Checks both OR-logic `@Permissions()` and AND-logic `@RequireAllPermissions()` metadata.
     * OR-logic permissions require the user to have at least one matching role name.
     * AND-logic permissions require the user to have all matching role names.
     * Checks both realm-level and client-specific roles (union of both).
     *
     * @param context - NestJS execution context (HTTP, GraphQL, WebSocket)
     * @returns `true` if user has required permissions; otherwise throws ForbiddenException
     * @throws {UnauthorizedException} If user is not authenticated
     * @throws {ForbiddenException} If user lacks required permissions (OR-logic or AND-logic)
     *
     * @example
     * ```ts
     * @UseGuards(JwtAuthGuard, PermissionGuard)
     * @Permissions('read:data', 'write:data')
     * @Get(':id')
     * getData(@Param('id') id: string) {
     *   // User must have a role named 'read:data' OR 'write:data'
     *   return {};
     * }
     * ```
     */
    canActivate(context: ExecutionContext): boolean;
}
//# sourceMappingURL=permission.guard.d.ts.map