import { ITicketAuditedEntity, TicketPropertyValue } from "./Common";
import { TicketConditionOperator } from "./Workflow";
export declare enum TicketSecurityResourceType {
    TICKET = "TICKET",
    CATEGORY = "CATEGORY",
    VIEW = "VIEW",
    FIELD = "FIELD",
    COMMENT = "COMMENT",
    ATTACHMENT = "ATTACHMENT",
    REPORT = "REPORT",
    EXPORT = "EXPORT",
    CONFIGURATION = "CONFIGURATION"
}
export declare enum TicketSecurityOperation {
    CREATE = "CREATE",
    READ = "READ",
    UPDATE = "UPDATE",
    DELETE = "DELETE",
    ASSIGN = "ASSIGN",
    TRANSITION = "TRANSITION",
    COMMENT_PUBLIC = "COMMENT_PUBLIC",
    COMMENT_INTERNAL = "COMMENT_INTERNAL",
    VIEW_INTERNAL_COMMENTS = "VIEW_INTERNAL_COMMENTS",
    VIEW_PII = "VIEW_PII",
    REDACT = "REDACT",
    EXPORT = "EXPORT",
    MANAGE = "MANAGE",
    IMPERSONATE = "IMPERSONATE"
}
export declare enum TicketPolicyEffect {
    ALLOW = "ALLOW",
    DENY = "DENY"
}
export declare enum TicketPolicyConditionGroupOperator {
    AND = "AND",
    OR = "OR"
}
export declare enum TicketSensitivityLevel {
    PUBLIC = "PUBLIC",
    INTERNAL = "INTERNAL",
    CONFIDENTIAL = "CONFIDENTIAL",
    RESTRICTED = "RESTRICTED"
}
export declare enum TicketDataClassification {
    PUBLIC = "PUBLIC",
    INTERNAL = "INTERNAL",
    CONFIDENTIAL = "CONFIDENTIAL",
    PII = "PII",
    SENSITIVE_PII = "SENSITIVE_PII",
    FINANCIAL = "FINANCIAL",
    HEALTH = "HEALTH",
    LEGAL = "LEGAL"
}
export declare enum TicketMaskingStrategy {
    NONE = "NONE",
    FULL = "FULL",
    PARTIAL = "PARTIAL",
    HASH = "HASH",
    TOKENIZE = "TOKENIZE"
}
export declare enum TicketRedactionStatus {
    REQUESTED = "REQUESTED",
    PROCESSING = "PROCESSING",
    COMPLETED = "COMPLETED",
    REJECTED = "REJECTED",
    FAILED = "FAILED"
}
export declare enum TicketRetentionAction {
    ARCHIVE = "ARCHIVE",
    ANONYMIZE = "ANONYMIZE",
    DELETE = "DELETE",
    REVIEW = "REVIEW"
}
export declare enum TicketLegalHoldStatus {
    ACTIVE = "ACTIVE",
    RELEASED = "RELEASED"
}
export declare enum TicketAccessAuditAction {
    READ = "READ",
    SEARCH = "SEARCH",
    DOWNLOAD_ATTACHMENT = "DOWNLOAD_ATTACHMENT",
    EXPORT = "EXPORT",
    VIEW_PII = "VIEW_PII",
    REDACT = "REDACT",
    IMPERSONATE = "IMPERSONATE",
    DELEGATED_ACCESS = "DELEGATED_ACCESS"
}
export declare enum TicketDelegatedAccessStatus {
    PENDING = "PENDING",
    ACTIVE = "ACTIVE",
    REVOKED = "REVOKED",
    EXPIRED = "EXPIRED",
    REJECTED = "REJECTED"
}
export interface ITicketSecuritySubject {
    /** When every selector is false or empty, the subject matches nobody. */
    allAuthenticated?: boolean;
    allAgents?: boolean;
    allCustomers?: boolean;
    userIds?: string[];
    roleIds?: string[];
    groupIds?: string[];
    organizationIds?: string[];
    contactSegmentIds?: string[];
    includeTicketRequester?: boolean;
    includeAssignee?: boolean;
    includeGroupMembers?: boolean;
}
export interface ITicketSecurityScope {
    spaceIds?: string[];
    brandIds?: string[];
    organizationIds?: string[];
    categoryIds?: string[];
    assignedGroupIds?: string[];
    channelIds?: string[];
    sensitivityLevels?: TicketSensitivityLevel[];
}
export interface ITicketSecurityCondition {
    fieldNameKey: string;
    operator: TicketConditionOperator;
    expectedValue?: TicketPropertyValue;
}
export interface ITicketSecurityConditionGroup {
    operator: TicketPolicyConditionGroupOperator;
    conditions?: ITicketSecurityCondition[];
    groups?: ITicketSecurityConditionGroup[];
}
export interface ITicketFieldPermission {
    fieldNameKey: string;
    operations: TicketSecurityOperation[];
    effect: TicketPolicyEffect;
    maskingStrategy?: TicketMaskingStrategy;
}
export interface ITicketSecurityPolicy extends ITicketAuditedEntity {
    name: string;
    description?: string;
    enabled: boolean;
    priority: number;
    effect: TicketPolicyEffect;
    resourceTypes: TicketSecurityResourceType[];
    operations: TicketSecurityOperation[];
    subjects: ITicketSecuritySubject;
    scope?: ITicketSecurityScope;
    conditions?: ITicketSecurityConditionGroup;
    fieldPermissions?: ITicketFieldPermission[];
    validFrom?: Date;
    validUntil?: Date;
}
export interface ITicketFieldSecurityDefinition extends ITicketAuditedEntity {
    fieldNameKey: string;
    classification: TicketDataClassification;
    containsPii: boolean;
    maskingStrategy: TicketMaskingStrategy;
    searchableWhenMasked?: boolean;
    exportable: boolean;
    retentionPolicyId?: string;
}
export interface ITicketSecurityState {
    sensitivity: TicketSensitivityLevel;
    policyIds?: string[];
    organizationId?: string;
    brandId?: string;
    restrictedGroupIds?: string[];
    containsPii: boolean;
    legalHold: boolean;
}
export interface ITicketRedactionRequest {
    id: string;
    spaceId: string;
    ticketId: string;
    fieldNameKeys?: string[];
    messageIds?: string[];
    attachmentIds?: string[];
    reason: string;
    requestedAt: Date;
    requestedBy: string;
    approvedAt?: Date;
    approvedBy?: string;
    status: TicketRedactionStatus;
    completedAt?: Date;
    error?: string;
}
export interface ITicketRetentionPolicy extends ITicketAuditedEntity {
    name: string;
    description?: string;
    retentionDays: number;
    action: TicketRetentionAction;
    categoryIds?: string[];
    dataClassifications?: TicketDataClassification[];
    preserveAuditLog: boolean;
    enabled: boolean;
}
export interface ITicketLegalHold {
    id: string;
    spaceId: string;
    ticketId: string;
    name: string;
    reason: string;
    status: TicketLegalHoldStatus;
    placedAt: Date;
    placedBy: string;
    releasedAt?: Date;
    releasedBy?: string;
    externalMatterId?: string;
}
export interface ITicketAccessAuditEvent {
    id: string;
    spaceId: string;
    ticketId?: string;
    actorId: string;
    effectiveUserId: string;
    action: TicketAccessAuditAction;
    resourceType: TicketSecurityResourceType;
    resourceId?: string;
    fieldNameKeys?: string[];
    purpose?: string;
    ipAddress?: string;
    userAgent?: string;
    correlationId?: string;
    occurredAt: Date;
    allowed: boolean;
    policyIds?: string[];
    denialReason?: string;
}
export interface ITicketImpersonationSession {
    id: string;
    spaceId: string;
    actorId: string;
    impersonatedUserId: string;
    reason: string;
    approvedBy?: string;
    startedAt: Date;
    expiresAt: Date;
    endedAt?: Date;
}
export interface ITicketDelegatedAccess {
    id: string;
    spaceId: string;
    grantorId: string;
    delegateId: string;
    operations: TicketSecurityOperation[];
    scope?: ITicketSecurityScope;
    status: TicketDelegatedAccessStatus;
    reason?: string;
    requestedAt: Date;
    startsAt: Date;
    expiresAt: Date;
    approvedBy?: string;
    revokedAt?: Date;
    revokedBy?: string;
}
export interface ITicketAuthorizationRequest {
    actorId: string;
    effectiveUserId?: string;
    operation: TicketSecurityOperation;
    resourceType: TicketSecurityResourceType;
    resourceId?: string;
    ticketId?: string;
    fieldNameKeys?: string[];
    context?: {
        [key: string]: TicketPropertyValue;
    };
}
export interface ITicketAuthorizationDecision {
    allowed: boolean;
    policyIds: string[];
    deniedFieldNameKeys?: string[];
    maskedFieldNameKeys?: string[];
    reason?: string;
    evaluatedAt: Date;
}
export interface ICreateTicketRedactionRequestDto {
    expectedVersion: number;
    fieldNameKeys?: string[];
    messageIds?: string[];
    attachmentIds?: string[];
    reason: string;
}
export interface ICreateTicketLegalHoldDto {
    expectedVersion: number;
    name: string;
    reason: string;
    externalMatterId?: string;
}
export interface IReleaseTicketLegalHoldDto {
    expectedVersion: number;
    legalHoldId: string;
    reason: string;
}
export interface ICreateTicketDelegatedAccessDto {
    delegateId: string;
    operations: TicketSecurityOperation[];
    scope?: ITicketSecurityScope;
    reason?: string;
    startsAt: Date;
    expiresAt: Date;
}
export interface IStartTicketImpersonationDto {
    impersonatedUserId: string;
    reason: string;
    expiresAt: Date;
}