/**
 * MCP Access Controller
 *
 * Provides authorization and access control for MCP server operations.
 * Implements policy-based access control with support for role-based
 * permissions, rate limiting, and audit logging.
 *
 * @packageDocumentation
 */
import type { Logger } from '../types';
import type { AccessPolicy, AccessControllerConfig, AuthorizationRequest, AuthorizationResult, Principal, TokenClaims, TokenValidationResult, AudienceVerificationOptions } from './types';
/**
 * MCP Access Controller
 *
 * Handles authorization decisions for MCP server operations.
 * Supports policy-based access control, rate limiting, and audit logging.
 *
 * @example
 * ```typescript
 * const controller = new MCPAccessController({
 *   policy: myPolicy,
 *   enableCache: true,
 *   cacheTtlMs: 60000,
 * });
 *
 * const result = controller.authorize({
 *   principal: { type: 'user', id: 'user-123' },
 *   resourceType: 'tool',
 *   resourceName: 'my-tool',
 *   action: 'invoke',
 * });
 *
 * if (result.allowed) {
 *   // Proceed with operation
 * }
 * ```
 */
export declare class MCPAccessController {
    private readonly policy;
    private readonly cache;
    private readonly rateLimiter;
    private readonly emitEvents;
    private readonly onSecurityEvent?;
    private logger?;
    /**
     * Create a new MCP Access Controller
     *
     * @param config - Controller configuration
     */
    constructor(config: AccessControllerConfig);
    /**
     * Set the logger instance
     *
     * @param logger - Logger to use for access control logging
     */
    setLogger(logger: Logger): void;
    /**
     * Authorize an operation
     *
     * Evaluates the access policy against the authorization request
     * and returns whether the operation is allowed.
     *
     * @param request - Authorization request to evaluate
     * @returns Authorization result indicating whether access is allowed
     */
    authorize(request: AuthorizationRequest): AuthorizationResult;
    /**
     * Verify token audience
     *
     * Validates that a token's audience claim matches expected values.
     *
     * @param claims - Token claims to verify
     * @param options - Audience verification options
     * @returns Whether the audience is valid
     */
    verifyTokenAudience(claims: TokenClaims, options: AudienceVerificationOptions): TokenValidationResult;
    /**
     * Validate a token's temporal claims
     *
     * @param claims - Token claims to validate
     * @param clockSkewMs - Allowed clock skew in milliseconds
     * @returns Validation result
     */
    validateTokenTiming(claims: TokenClaims, clockSkewMs?: number): TokenValidationResult;
    /**
     * Create a principal from token claims
     *
     * @param claims - Token claims
     * @returns Principal object
     */
    createPrincipalFromClaims(claims: TokenClaims): Principal;
    /**
     * Get the current policy
     */
    getPolicy(): AccessPolicy;
    /**
     * Get cache statistics
     */
    getCacheStats(): {
        size: number;
        maxSize: number;
    } | null;
    /**
     * Clear the authorization cache
     */
    clearCache(): void;
    /**
     * Clear rate limit data for a principal
     */
    clearRateLimit(principalId: string): void;
    /**
     * Evaluate policy rules against a request
     */
    private evaluatePolicy;
    /**
     * Check if a rule matches a request
     */
    private ruleMatches;
    /**
     * Match a resource name against a glob pattern
     */
    private matchesGlobPattern;
    /**
     * Evaluate a policy condition
     */
    private evaluateCondition;
    /**
     * Get a field value from the request for condition evaluation
     */
    private getFieldValue;
    /**
     * Check IP restrictions
     */
    private checkIpRestrictions;
    /**
     * Create an authorization result
     */
    private createResult;
    /**
     * Emit a security event
     */
    private emitSecurityEvent;
}
/**
 * Create a default permissive access controller
 *
 * @returns Access controller with permissive default policy
 */
export declare function createPermissiveAccessController(): MCPAccessController;
/**
 * Create a default restrictive access controller
 *
 * @returns Access controller with restrictive default policy
 */
export declare function createRestrictiveAccessController(): MCPAccessController;
//# sourceMappingURL=access-control.d.ts.map