import { Permission, PermissionProfile, RootEntityType } from '../model';
import { QueryNode } from '../query-tree';
import { AccessOperation, AuthContext } from './auth-basics';
export declare enum ConditionExplanationContext {
    BEFORE_WRITE = 0,
    SET = 1
}
/**
 * Determines whether a user can access information, possibly dependent on the instance containing the information
 */
export declare abstract class PermissionDescriptor {
    /**
     * Gets the condition which determines if a user has access
     * @param authContext
     * @param operation
     * @param instanceNode a QueryNode which evaluates to the instance
     * @returns a QueryNode that evaluates to TRUE if the user has access or FALSE if they don't
     */
    abstract getAccessCondition(authContext: AuthContext, operation: AccessOperation, instanceNode: QueryNode): QueryNode;
    /**
     * Determines if a user has access or if it depends on the instance
     */
    canAccess(authContext: AuthContext, operation: AccessOperation): PermissionResult;
    /**
     * Gets a human-readable explanation fragment that explains why some instance could not be accessed
     */
    getExplanationForCondition(authContext: AuthContext, operation: AccessOperation, context: ConditionExplanationContext): string | undefined;
}
export declare enum PermissionResult {
    /**
     * Access is granted for all instances
     */
    GRANTED = 0,
    /**
     * Access may be granted or denied, depending on the instance's accessGroup
     */
    CONDITIONAL = 1,
    /**
     * Access is denied for all instances
     */
    DENIED = 2
}
export declare class AlwaysGrantPermissionDescriptor extends PermissionDescriptor {
    getAccessCondition(authContext: AuthContext, operation: AccessOperation): QueryNode;
    canAccess(authContext: AuthContext, operation: AccessOperation): PermissionResult;
    static readonly INSTANCE: AlwaysGrantPermissionDescriptor;
}
export declare class AlwaysDenyPermissionDescriptor extends PermissionDescriptor {
    getAccessCondition(authContext: AuthContext, operation: AccessOperation): QueryNode;
    canAccess(authContext: AuthContext, operation: AccessOperation): PermissionResult;
    static readonly INSTANCE: AlwaysDenyPermissionDescriptor;
}
export declare class ConjunctivePermissionDescriptor extends PermissionDescriptor {
    readonly lhs: PermissionDescriptor;
    readonly rhs: PermissionDescriptor;
    constructor(lhs: PermissionDescriptor, rhs: PermissionDescriptor);
    getAccessCondition(authContext: AuthContext, operation: AccessOperation): QueryNode;
}
export declare class StaticPermissionDescriptor extends PermissionDescriptor {
    readonly readRoles: ReadonlyArray<string>;
    readonly readWriteRoles: ReadonlyArray<string>;
    private readonly allReadRoles;
    constructor(readRoles: ReadonlyArray<string>, readWriteRoles: ReadonlyArray<string>);
    getAccessCondition(authContext: AuthContext, operation: AccessOperation): QueryNode;
}
export declare class ProfileBasedPermissionDescriptor extends PermissionDescriptor {
    private readonly profile;
    private readonly rootEntityType?;
    private readonly accessGroupField;
    constructor(profile: PermissionProfile, rootEntityType?: RootEntityType | undefined);
    getAccessCondition(authContext: AuthContext, operation: AccessOperation, instanceNode: QueryNode): QueryNode;
    getPermissionRestrictionCondition(permission: Permission, authContext: AuthContext, instanceNode: QueryNode): QueryNode;
    private getPureAccessGroupCondition;
    private getAccessGroupConditionNode;
    private getApplicablePermissions;
    private getAllowedAccessGroups;
    getExplanationForCondition(authContext: AuthContext, operation: AccessOperation, context: ConditionExplanationContext): string | undefined;
    getExplanationPrefixForAccessGroups(context: ConditionExplanationContext): string;
    getExplanationForSingleField(context: ConditionExplanationContext, fieldName: string): string;
    getGeneralExplanation(context: ConditionExplanationContext): string;
    getGenericDataDependentExplanation(context: ConditionExplanationContext): string;
}