import type { TConstValue } from '@venizia/ignis-helpers/common';
import { AuthorizationRole } from '../../models/authorization-role.model.js';
export declare class Authorization {
    static readonly RULES = "authorization.rules";
    static readonly SKIP_AUTHORIZATION = "authorization.skip";
    static readonly ENFORCER = "authorization.enforcer";
    static readonly DOMAIN = "authorization.domain";
}
export declare class AuthorizationActions {
    static readonly CREATE = "create";
    static readonly UPDATE = "update";
    static readonly DELETE = "delete";
    static readonly EXECUTE = "execute";
    static readonly READ = "read";
    static readonly WRITE = "write";
    static readonly MANAGE = "manage";
    /** Grant-mode marker for a subset grant carrying `metadata.ops`; never a member of LATTICE. */
    static readonly CUSTOM = "custom";
    static readonly SCHEME_SET: Set<string>;
    static readonly LATTICE: ReadonlyArray<{
        child: TAuthorizationAction;
        parent: TAuthorizationAction;
    }>;
    static isValid(input: string): boolean;
}
export type TAuthorizationAction = TConstValue<typeof AuthorizationActions>;
export declare class AuthorizationDecisions {
    static readonly ALLOW = "allow";
    static readonly DENY = "deny";
    static readonly ABSTAIN = "abstain";
    static readonly SCHEME_SET: Set<string>;
    static isValid(input: string): boolean;
    static isAllow(input: string | number): boolean;
    static isDeny(input: string | number): boolean;
    static isAbstain(input: string | number): boolean;
}
export type TAuthorizationDecision = TConstValue<typeof AuthorizationDecisions>;
export declare class AuthorizationRoles {
    static readonly SUPER_ADMIN: AuthorizationRole;
    static readonly ADMIN: AuthorizationRole;
    static readonly USER: AuthorizationRole;
    static readonly GUEST: AuthorizationRole;
    static readonly UNKNOWN_USER: AuthorizationRole;
    static readonly SCHEME_SET: Set<string>;
    static isValid(input: string): boolean;
}
export declare class AuthorizationDomainScopes {
    /** Grant applies in EVERY domain the subject is a member of (checked via join_domain / g2). */
    static readonly ANY_MEMBER = "ANY_MEMBER";
    /** Grant applies system-wide, bypassing membership - super-admin only. */
    static readonly SYSTEM_WIDE = "SYSTEM_WIDE";
    static readonly SCHEME_SET: Set<string>;
    static isValid(input: string): boolean;
}
export type TAuthorizationDomainScope = TConstValue<typeof AuthorizationDomainScopes>;
/** Edge kinds in the `PolicyDefinition` table (each row: subject -> target, `variant` = kind), carrying `action` (DB `variant` value) + `rule` (casbin prefix emitted per edge). Per-USER edges: GRANT, ASSIGN_ROLE, JOIN_DOMAIN; shared org-structure edges: the *_INHERITS ones. */
export declare class AuthorizationPolicyVariants {
    /** Give a Permission to a User/Role (row also carries action / effect / domain). casbin `p`: `p, <Role|User>_<id>, <domain>, <permissionCode>, <action>, <allow|deny>` */
    static readonly GRANT: {
        readonly action: "grant";
        readonly rule: "p";
    };
    /** Give a User a Role (optionally domain-scoped; no domain -> `*` = every domain). casbin `g`: `g, User_<id>, Role_<id>, <domain|*>` */
    static readonly ASSIGN_ROLE: {
        readonly action: "assign_role";
        readonly rule: "g";
    };
    /** A Role inherits another Role (DAG). Shares `g` with ASSIGN_ROLE so user -> role -> parent-role resolves in one lookup. Emitted with domain `*`: `g, Role_<child>, Role_<parent>, *` */
    static readonly ROLE_INHERITS: {
        readonly action: "role_inherits";
        readonly rule: "g";
    };
    /** User is a member of a Domain; powers the `ANY_MEMBER` grant scope via `g2(r.sub, r.dom)`. casbin `g2`: `g2, User_<id>, <Type>_<domainId>` */
    static readonly JOIN_DOMAIN: {
        readonly action: "join_domain";
        readonly rule: "g2";
    };
    /** DOMAIN axis (`dom`): domain nesting. Matcher: `g3(r.dom, p.dom)` + self-link so an exact domain always matches itself. casbin `g3`: `g3, <Type>_<childId>, <Type>_<parentId>` */
    static readonly DOMAIN_INHERITS: {
        readonly action: "domain_inherits";
        readonly rule: "g3";
    };
    /** RESOURCE axis (`obj`), NON-standard nesting only - dotted nesting (`Order.findById ⊂ Order`) is handled by `objectMatch` WITHOUT an edge. Matcher: `objectMatch(r.obj, p.obj) || g4(r.obj, p.obj)`, casbin `g4`: `g4, <childCode>, <parentCode>` */
    static readonly RESOURCE_INHERITS: {
        readonly action: "resource_inherits";
        readonly rule: "g4";
    };
    /** ACTION axis (`act`): a narrow action covered by a broader one; no dotted shortcut, so it needs an explicit edge. Matcher: `g5(r.act, p.act)`, casbin `g5`: `g5, <childAction>, <parentAction>`. g4 + g5 combine multiplicatively: `manage Order` covers a `read OrderItem` request. */
    static readonly ACTION_INHERITS: {
        readonly action: "action_inherits";
        readonly rule: "g5";
    };
    /** Every edge kind, in declaration order - the one place the scheme sets and the `variant` column's literal type both derive from. */
    static readonly ALL: readonly [{
        readonly action: "grant";
        readonly rule: "p";
    }, {
        readonly action: "assign_role";
        readonly rule: "g";
    }, {
        readonly action: "role_inherits";
        readonly rule: "g";
    }, {
        readonly action: "join_domain";
        readonly rule: "g2";
    }, {
        readonly action: "domain_inherits";
        readonly rule: "g3";
    }, {
        readonly action: "resource_inherits";
        readonly rule: "g4";
    }, {
        readonly action: "action_inherits";
        readonly rule: "g5";
    }];
    static readonly ACTION_SCHEME_SET: Set<string>;
    static readonly RULE_SCHEME_SET: Set<string>;
    static isValidAction(input: string): boolean;
    static isValidRule(input: string): boolean;
}
/** The `variant` column's full value set, derived from {@link AuthorizationPolicyVariants.ALL} - never hand-list the seven strings again. */
export type TAuthorizationPolicyVariant = (typeof AuthorizationPolicyVariants.ALL)[number]['action'];
/** Where an `IAuthorizationDomainSource` reads the request domain from. */
export declare class AuthorizationDomainSources {
    static readonly PARAM = "param";
    static readonly HEADER = "header";
    static readonly QUERY = "query";
    static readonly CONTEXT = "context";
    static readonly SCHEME_SET: Set<string>;
    static isValid(value: string): boolean;
}
/** Valid authorization domain source values. */
export type TAuthorizationDomainSource = TConstValue<typeof AuthorizationDomainSources>;
//# sourceMappingURL=authorization.d.ts.map