import type ACDFTupleExtended from "../types/ACDFTupleExtended.mjs";
import type ProtectedItem from "../types/ProtectedItem.mjs";
import type { EvaluateFilterSettings } from "../utils/evaluateFilter.mjs";
import type { NameAndOptionalUID } from "../modules/SelectedAttributeTypes/NameAndOptionalUID.ta.mjs";
export declare const PERMISSION_CATEGORY_ADD: number;
export declare const PERMISSION_CATEGORY_DISCLOSE_ON_ERROR: number;
export declare const PERMISSION_CATEGORY_READ: number;
export declare const PERMISSION_CATEGORY_REMOVE: number;
export declare const PERMISSION_CATEGORY_BROWSE: number;
export declare const PERMISSION_CATEGORY_EXPORT: number;
export declare const PERMISSION_CATEGORY_IMPORT: number;
export declare const PERMISSION_CATEGORY_MODIFY: number;
export declare const PERMISSION_CATEGORY_RENAME: number;
export declare const PERMISSION_CATEGORY_RETURN_DN: number;
export declare const PERMISSION_CATEGORY_COMPARE: number;
export declare const PERMISSION_CATEGORY_FILTER_MATCH: number;
export declare const PERMISSION_CATEGORY_INVOKE: number;
export interface ACDFSettings extends EvaluateFilterSettings {
}
/**
 * The return type of an Access Control Decision Function (ACDF).
 */
export interface ACDFReturn {
    /**
     * Whether the ACDF authorized the request.
     */
    readonly authorized: boolean;
}
/**
 * The return type of the Basic Access Control (BAC) / Simplified Access Control
 * (SAC) ACDF.
 */
export interface BACACDFReturn extends ACDFReturn {
    /**
     * The ACDF tuples that were determined by the function to be relevant.
     */
    readonly relevantTuples: ACDFTupleExtended[];
    /**
     * The subset of ACDF tuples selected by being of the highest precedence.
     */
    readonly precedentTuples?: ACDFTupleExtended[];
    /**
     * The subset of ACDF tuples selected by targeting the most specific user
     * class.
     */
    readonly mostUserSpecificTuples?: ACDFTupleExtended[];
    /**
     * The subset of ACDF tuples selected by targeting the most specific items.
     */
    readonly mostItemSpecificTuples?: ACDFTupleExtended[];
}
/**
 * @summary The Access Control Decision Function for X.501 Basic Access Control.
 * @description
 *
 * This function is an implementation of the Access Control Decision Function
 * (ACDF) defined in the International Telecommunication Union's (ITU)
 * Recommendation X.501 (2016 version), Section 18.8. This function can be used
 * to implement both Basic Access Control and Simplified Access Control.
 *
 * ### Performance
 *
 * Because this function may be called dozens of times for a single request to
 * an entry and all of its attributes, it is important for it to be performant.
 * For this reason, this function does not accept ACI items directly, but the
 * pre-processed ACDF tuples that are trivially produced from ACI items to avoid
 * recomputing these tuples. In addition, these tuples are expected to be
 * pre-filtered by their applicability to the current user, and extended by a
 * sixth element, which is a `number` indicating the specificity with which the
 * user matched the corresponding `UserClasses`. The former is implemented
 * so that the tuples can be filtered by their applicability to the current user
 * one time and re-used between calls to this function; the latter is
 * implemented so that this function can does not have to evaluate the user
 * classes applicability again just to determine how specific the match was.
 *
 * Outsourcing the user-class matching from this function also allows the
 * user-class matching function to be `async` without requiring this function
 * to be `async`. This is important, because group matching requires
 * reading an entry, which would probably be from a database or remote DSA. So
 * within an `async` function, you can pre-filter the ACDF tuples and annotate
 * them with their specificity, then you can call this function like normal.
 *
 * **Performance Tip: Ensure that all precedence values for all ACI items are
 * unique to avoid the more computationally-expensive code paths.**
 *
 * ### Compliance
 *
 * This function deviates from the specification in these ways:
 *
 * - The function `discardNonRelevantACDFTuples()`, which is called by this
 *   function, does not observe the `restrictedBy` or `contexts` constraints.
 *
 * ### Parameters
 *
 * @param {ACDFTupleExtended[]} tuples The tuples of inputs to the ACDF as described in
 *  ITU Recommendation X.501, Section 18.8.2. An array of five items:
 *  `( userClasses, authenticationLevel, protectedItems, grantsAndDenials, precedence )`
 *  with the addition of a user class specificity `number` tacked on the end.
 *  The tuples that are irrelevant according to ITU Recommendation X.501 (2016),
 *  Section 18.8.3, bullet point #1 are expected to be discarded from this
 *  array **BEFORE** calling this function.
 * @param {ProtectedItem} request The thing that is being requested, which can
 *  be an entry, attribute type, or attribute value.
 * @param {number[]} operations The bit indices of the permissions that are
 *  being requested, divided by two. The permissions come from the definition of
 *  `GrantsAndDenials`. For clarification, an operation of 3 indicates a request
 *  for the remove permission.
 * @param {Object} settings The same settings that evaluateFilter() takes.
 * @returns An object whose `authorized` property is a `boolean` that indicates
 *  whether the request was authorized by this ACDF. All other properties of
 *  this object are for diagnostic purposes.
 *
 * @function
 */
export declare function bacACDF(tuples: ACDFTupleExtended[], requester: NameAndOptionalUID | undefined | null, request: ProtectedItem, operations: number[], // Index of bits in GrantsAndDenials / 2.
settings: EvaluateFilterSettings, tuplesAlreadySplit?: boolean): BACACDFReturn;
export default bacACDF;
//# sourceMappingURL=bacACDF.d.mts.map