import { AccessOperation, AuthContext } from '../../authorization/auth-basics';
import { MessageLocation, PermissionAccessKind, PermissionConfig, PermissionProfileConfig, PermissionRestrictionConfig } from '../index';
import { ModelComponent, ValidationContext } from '../validation/validation-context';
export declare class PermissionProfile implements ModelComponent {
    readonly name: string;
    readonly namespacePath: ReadonlyArray<string>;
    readonly permissions: ReadonlyArray<Permission>;
    readonly loc: MessageLocation | undefined;
    constructor(name: string, namespacePath: ReadonlyArray<string>, config: PermissionProfileConfig);
    validate(context: ValidationContext): void;
}
export declare class Permission implements ModelComponent {
    readonly roles: RoleSpecifier;
    readonly access: ReadonlyArray<PermissionAccessKind>;
    readonly restrictToAccessGroups?: ReadonlyArray<string>;
    readonly hasDynamicAccessGroups: boolean;
    readonly restrictions: ReadonlyArray<PermissionRestriction>;
    constructor(config: PermissionConfig);
    appliesToAuthContext(authContext: AuthContext): boolean | undefined;
    allowsOperation(operation: AccessOperation): boolean;
    getAllowedAccessGroups(authContext: AuthContext): ReadonlyArray<string>;
    /**
     * Replaces placeholders like $1 with the capture groups of the roles regex
     */
    evaluateTemplate(template: string, authContext: AuthContext): ReadonlyArray<string>;
    validate(context: ValidationContext): void;
}
export declare class RoleSpecifier {
    readonly entries: ReadonlyArray<RoleSpecifierEntry>;
    constructor(roles: ReadonlyArray<string>);
    includesRole(role: string): boolean;
}
export declare function createRoleSpecifierEntry(specifier: string): RegexRoleSpecifierEntry | WildcardRoleSpecifierEntry | LiteralRoleSpecifierEntry;
export declare class InvalidRoleSpecifierError extends Error {
    constructor(message: string);
}
export interface RoleSpecifierEntry {
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
    readonly mayHaveCapturingGroups: boolean;
}
export declare class RegexRoleSpecifierEntry implements RoleSpecifierEntry {
    readonly mayHaveCapturingGroups: boolean;
    private readonly regexp;
    constructor(expression: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class WildcardRoleSpecifierEntry implements RoleSpecifierEntry {
    readonly mayHaveCapturingGroups = false;
    private readonly regexp;
    constructor(pattern: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class LiteralRoleSpecifierEntry implements RoleSpecifierEntry {
    private readonly role;
    readonly mayHaveCapturingGroups = false;
    constructor(role: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class PermissionRestriction implements ModelComponent {
    readonly field: string;
    readonly value?: unknown;
    readonly valueTemplate?: string;
    readonly claim?: string;
    readonly loc?: MessageLocation;
    readonly fieldValueLoc?: MessageLocation;
    constructor(config: PermissionRestrictionConfig);
    validate(context: ValidationContext): void;
}