import type { OBJECT_IDENTIFIER } from "@wildboar/asn1";
import type EqualityMatcher from "../types/EqualityMatcher.mjs";
import type { DistinguishedName } from "../modules/InformationFramework/DistinguishedName.ta.mjs";
import type { NameAndOptionalUID } from "../modules/SelectedAttributeTypes/NameAndOptionalUID.ta.mjs";
import type { AuthenticationLevel } from "../modules/BasicAccessControl/AuthenticationLevel.ta.mjs";
import type ACDFTuple from "../types/ACDFTuple.mjs";
/**
 * @summary Determines if a user falls within an ACI item's `UserClasses`.
 * @description
 *
 * Determines if a user is within a user class as specified in
 * ITU Recommendation X.501 (2016), Section 18.4.2.4.b.
 *
 * As ITU Recommendation X.501 (2016), Section 18.8.4 specifies, the order of
 * specificity is as such (in order of ascending specificity):
 *
 * - `allUsers`
 * - `subtree`
 * - `userGroup`
 * - `name` and `thisEntry` (both having equal precedence)
 *
 * ### ASN.1 Definitions:
 *
 * ```asn1
 * UserClasses ::= SEQUENCE {
 *   allUsers   [0]  NULL                                      OPTIONAL,
 *   thisEntry  [1]  NULL                                      OPTIONAL,
 *   name       [2]  SET SIZE (1..MAX) OF NameAndOptionalUID   OPTIONAL,
 *   userGroup  [3]  SET SIZE (1..MAX) OF NameAndOptionalUID   OPTIONAL,
 *                   -- dn component shall be the name of an
 *                   -- entry of GroupOfUniqueNames
 *   subtree    [4]  SET SIZE (1..MAX) OF SubtreeSpecification OPTIONAL,
 *   ... }
 * ```
 *
 * ### Parameters
 *
 * @param {UserClasses} userClass The data structure that identifies which users
 *  an ACI item applies to.
 * @param {NameAndOptionalUID} user The distinguished name and optional unique
 *  identifier of the user whose authorization is determined by the ACDF.
 * @param {AuthenticationLevel} authLevel The authentication level of the user.
 * @param {DistinguishedName} entryDN The entry that is the predicate of the
 *  ACDF, or whose attributes are. The entry to whose entirety or whose
 *  attributes the subject is seeking authorization.
 * @param {function} getEqualityMatcher A function that takes an object
 *  identifier and returns another function (if one can be found) that can be
 *  used to compare two values of the same attribute type.
 * @param {function} isMemberOfGroup A function that takes a user group and user
 *  and resolves a `boolean` indicating whether the user is a member of the
 *  group or `undefined` if it could not be determined.
 * @returns {Promise<number>} A `number` that ascends with increasing specificity
 *  of the match, or `0` if it did not match. This number will be non-integral
 *  if group membership was checked, but group membership could not be determined.
 *
 * @function
 */
export declare function userWithinACIUserClass(tuple: ACDFTuple, user: NameAndOptionalUID | undefined | null, authLevel: AuthenticationLevel, entryDN: DistinguishedName, getEqualityMatcher: (attributeType: OBJECT_IDENTIFIER) => EqualityMatcher | undefined, isMemberOfGroup: (userGroup: NameAndOptionalUID, user: NameAndOptionalUID) => Promise<boolean | undefined>): Promise<number>;
export default userWithinACIUserClass;
//# sourceMappingURL=userWithinACIUserClass.d.mts.map