import { CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
/**
 * Role-based Authorization Guard
 *
 * Authorizes access based on user roles specified by the `@Roles()` decorator.
 * Checks both realm-level roles (`user.realmRoles`) and client-specific roles (`user.clientRoles`).
 *
 * Uses OR logic — access is granted if the user has ANY of the required roles.
 * If no roles are specified via `@Roles()`, access is allowed by default.
 *
 * Throws `ForbiddenException` if the user lacks all required roles.
 *
 * @example
 * ```ts
 * @UseGuards(JwtAuthGuard, RoleGuard)
 * @Controller('admin')
 * export class AdminController {
 *   @Roles('admin', 'moderator')
 *   @Get('users')
 *   listUsers() {
 *     // User must have 'admin' OR 'moderator' role
 *     return [];
 *   }
 * }
 * ```
 */
export declare class RoleGuard implements CanActivate {
    private readonly Reflector;
    constructor(reflector: Reflector);
    /**
     * Activates role-based authorization for the current request.
     *
     * Checks both OR-logic `@Roles()` and AND-logic `@RequireAllRoles()` metadata.
     * OR-logic roles require the user to have at least one of the specified roles.
     * AND-logic roles require the user to have all of the specified roles.
     * Checks both realm-level and client-specific roles (union of both).
     *
     * @param context - NestJS execution context (HTTP, GraphQL, WebSocket)
     * @returns `true` if user has required roles; otherwise throws ForbiddenException
     * @throws {UnauthorizedException} If user is not authenticated
     * @throws {ForbiddenException} If user lacks required roles (OR-logic or AND-logic)
     *
     * @example
     * ```ts
     * @UseGuards(JwtAuthGuard, RoleGuard)
     * @Roles('admin', 'moderator')
     * @Get('users')
     * listUsers() {
     *   // User must have 'admin' OR 'moderator' role
     *   return [];
     * }
     *
     * @RequireAllRoles('admin', 'auditor')
     * @Get('audit-logs')
     * auditLogs() {
     *   // User must have BOTH 'admin' AND 'auditor' roles
     *   return [];
     * }
     * ```
     */
    canActivate(context: ExecutionContext): boolean;
}
//# sourceMappingURL=role.guard.d.ts.map