import type { z, ZodError } from 'zod';
import { CrudFailureReason } from '../../../constants';
import { CrudContract, DbClientContract, EnhancementContext, PolicyCrudKind, PolicyOperationKind } from '../../../types';
import type { InternalEnhancementOptions } from '../create-enhancement';
import { QueryUtils } from '../query-utils';
import type { EntityChecker, PermissionCheckerFunc } from '../types';
/**
 * Access policy enforcement utilities
 */
export declare class PolicyUtil extends QueryUtils {
    private readonly db;
    private readonly shouldLogQuery;
    private readonly modelMeta;
    private readonly policy;
    private readonly zodSchemas?;
    private readonly prismaModule;
    private readonly user?;
    constructor(db: DbClientContract, options: InternalEnhancementOptions, context?: EnhancementContext, shouldLogQuery?: boolean);
    /**
     * Creates a conjunction of a list of query conditions.
     */
    and(...conditions: (boolean | object | undefined)[]): object;
    /**
     * Creates a disjunction of a list of query conditions.
     */
    or(...conditions: (boolean | object | undefined)[]): object;
    /**
     * Creates a negation of a query condition.
     */
    not(condition: object | boolean | undefined): object;
    private singleKey;
    isTrue(condition: object | null | undefined): boolean;
    isFalse(condition: object | null | undefined): boolean;
    private makeTrue;
    private makeFalse;
    private reduce;
    private readonly FULL_OPEN_MODEL_POLICY;
    private getModelPolicyDef;
    private getModelGuardForOperation;
    /**
     * Gets pregenerated authorization guard object for a given model and operation.
     *
     * @returns true if operation is unconditionally allowed, false if unconditionally denied,
     * otherwise returns a guard object
     */
    getAuthGuard(db: CrudContract, model: string, operation: PolicyOperationKind, preValue?: any): object;
    /**
     * Get field-level read auth guard
     */
    getFieldReadAuthGuard(db: CrudContract, model: string, field: string): object;
    /**
     * Get field-level read auth guard that overrides the model-level
     */
    getFieldOverrideReadAuthGuard(db: CrudContract, model: string, field: string): object;
    /**
     * Get field-level update auth guard
     */
    getFieldUpdateAuthGuard(db: CrudContract, model: string, field: string): object;
    /**
     * Get field-level update auth guard that overrides the model-level
     */
    getFieldOverrideUpdateAuthGuard(db: CrudContract, model: string, field: string): object;
    /**
     * Checks if the given model has a policy guard for the given operation.
     */
    hasAuthGuard(model: string, operation: PolicyOperationKind): boolean;
    /**
     * Checks if the given model has any field-level override policy guard for the given operation.
     */
    hasOverrideAuthGuard(model: string, operation: PolicyOperationKind): boolean;
    /**
     * Checks model creation policy based on static analysis to the input args.
     *
     * @returns boolean if static analysis is enough to determine the result, undefined if not
     */
    checkInputGuard(model: string, args: any, operation: 'create'): boolean | undefined;
    /**
     * Injects model auth guard as where clause.
     */
    injectAuthGuardAsWhere(db: CrudContract, args: any, model: string, operation: PolicyOperationKind): boolean;
    private buildReadGuardForFields;
    private injectReadGuardForToManyField;
    private injectReadGuardForToOneField;
    /**
     * Injects auth guard for read operations.
     */
    injectForRead(db: CrudContract, model: string, args: any): boolean;
    /**
     * Gets checker constraints for the given model and operation.
     */
    getCheckerConstraint(model: string, operation: PolicyCrudKind): ReturnType<PermissionCheckerFunc> | boolean;
    /**
     * Gets unique constraints for the given model.
     */
    getUniqueConstraints(model: string): Record<string, import("../../../cross").UniqueConstraint>;
    private injectNestedReadConditions;
    /**
     * Given a model and a unique filter, checks the operation is allowed by policies and field validations.
     * Rejects with an error if not allowed.
     *
     * This method is only called by mutation operations.
     */
    checkPolicyForUnique(model: string, uniqueFilter: any, operation: PolicyOperationKind, db: CrudContract, fieldsToUpdate: string[], preValue?: any): Promise<void>;
    getEntityChecker(model: string, operation: PolicyOperationKind, field?: string): EntityChecker | undefined;
    getUpdateOverrideEntityCheckerForField(model: string, field: string): EntityChecker | undefined;
    private getCombinedFieldOverrideReadGuards;
    private getFieldUpdateGuards;
    private combineEntityChecker;
    /**
     * Tries rejecting a request based on static "false" policy.
     */
    tryReject(db: CrudContract, model: string, operation: PolicyOperationKind): void;
    /**
     * Checks if a model exists given a unique filter.
     */
    checkExistence(db: CrudContract, model: string, uniqueFilter: any, throwIfNotFound?: boolean): Promise<any>;
    /**
     * Returns an entity given a unique filter with read policy checked. Reject if not readable.
     */
    readBack(db: CrudContract, model: string, operation: PolicyOperationKind, selectInclude: {
        select?: any;
        include?: any;
    }, uniqueFilter: any): Promise<{
        result: unknown;
        error?: Error;
    }>;
    /**
     * Injects field selection needed for checking field-level read policy check and evaluating
     * entity checker into query args.
     */
    injectReadCheckSelect(model: string, args: any): void;
    private doInjectReadCheckSelect;
    private makeAllScalarFieldSelect;
    deniedByPolicy(model: string, operation: PolicyOperationKind, extra?: string, reason?: CrudFailureReason, zodErrors?: ZodError): Error;
    notFound(model: string): Error;
    /**
     * Gets field selection for fetching pre-update entity values for the given model.
     */
    getPreValueSelect(model: string): object | undefined;
    private getFieldReadCheckSelector;
    private checkReadField;
    private hasFieldValidation;
    private hasFieldLevelPolicy;
    /**
     * Gets Zod schema for the given model and access kind.
     *
     * @param kind kind of Zod schema to get for. If undefined, returns the full schema.
     */
    getZodSchema(model: string, excludePasswordFields?: boolean, kind?: 'create' | 'update' | undefined): z.ZodType<any, z.ZodTypeDef, any> | undefined;
    /**
     * Validates the given data against the Zod schema for the given model and kind.
     *
     * @param model model
     * @param kind validation kind. Pass undefined to validate against the full schema.
     * @param data input data
     * @param excludePasswordFields whether exclude schema validation for `@password` fields
     * @param onError error callback
     * @returns Zod-validated data
     */
    validateZodSchema(model: string, kind: 'create' | 'update' | undefined, data: object, excludePasswordFields: boolean, onError: (error: ZodError) => void): any;
    /**
     * Post processing checks and clean-up for read model entities.
     */
    postProcessForRead(data: any, model: string, queryArgs: any): any;
    private doPostProcessForRead;
    /**
     * Replace content of `target` object with `withObject` in-place.
     */
    replace(target: any, withObject: any): void;
    /**
     * Picks properties from an object.
     */
    pick<T>(value: T, ...props: (keyof T)[]): Pick<T, (typeof props)[number]>;
    private mergeWhereClause;
    /**
     * Given an entity data, returns an object only containing id fields.
     */
    getIdFieldValues(model: string, data: any): {
        [k: string]: any;
    } | undefined;
}