import type { AuthContext } from '../../authorization/auth-basics.js';
import { AccessOperation } from '../../authorization/auth-basics.js';
import type { PermissionAccessKind, PermissionConfig, PermissionProfileConfig, PermissionRestrictionConfig } from '../config/permissions.js';
import type { MessageLocation } from '../validation/location.js';
import type { ModelComponent, ValidationContext } from '../validation/validation-context.js';
export declare class PermissionProfile implements ModelComponent {
    readonly name: string;
    readonly namespacePath: ReadonlyArray<string>;
    readonly permissions: ReadonlyArray<Permission>;
    readonly loc: MessageLocation | undefined;
    constructor(name: string, namespacePath: ReadonlyArray<string>, config: PermissionProfileConfig);
    validate(context: ValidationContext): void;
}
export declare class Permission implements ModelComponent {
    readonly roles: RoleSpecifier;
    readonly access: ReadonlyArray<PermissionAccessKind>;
    readonly restrictToAccessGroups?: ReadonlyArray<string>;
    readonly hasDynamicAccessGroups: boolean;
    readonly restrictions: ReadonlyArray<PermissionRestriction>;
    readonly loc: MessageLocation | undefined;
    readonly restrictToAccessGroupsLocs: ReadonlyArray<MessageLocation | undefined> | undefined;
    constructor(config: PermissionConfig);
    appliesToAuthContext(authContext: AuthContext): boolean | undefined;
    allowsOperation(operation: AccessOperation): boolean;
    getAllowedAccessGroups(authContext: AuthContext): ReadonlyArray<string>;
    /**
     * Replaces placeholders like $1 with the capture groups of the roles regex
     */
    evaluateTemplate(template: string, authContext: AuthContext): ReadonlyArray<string>;
    validate(context: ValidationContext): void;
}
export declare class RoleSpecifier {
    readonly entries: ReadonlyArray<RoleSpecifierEntry>;
    constructor(roles: ReadonlyArray<string>);
    includesRole(role: string): boolean;
}
export declare function createRoleSpecifierEntry(specifier: string): RegexRoleSpecifierEntry | WildcardRoleSpecifierEntry | LiteralRoleSpecifierEntry;
export declare class InvalidRoleSpecifierError extends Error {
    constructor(message: string);
}
export interface RoleSpecifierEntry {
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
    readonly mayHaveCapturingGroups: boolean;
    /**
     * The number of capturing groups that can be referenced with placeholders like $1
     */
    readonly capturingGroupCount: number;
}
export declare class RegexRoleSpecifierEntry implements RoleSpecifierEntry {
    readonly mayHaveCapturingGroups: boolean;
    readonly capturingGroupCount: number;
    /**
     * The flags of the expression that are ignored (g and y)
     */
    readonly ignoredFlags: string;
    /**
     * If the expression does not need to match the whole role, a description of the unmatched part and suggested
     * expressions that make this explicit
     *
     * An expression matches the whole role if it starts with ^ (or .*) and ends with $ (or .*).
     */
    readonly anchoringProblem: {
        readonly unmatchedPart: 'beginning' | 'end' | 'beginning and end';
        readonly wholeRoleSuggestion: string;
        readonly trailingCharactersSuggestion: string | undefined;
    } | undefined;
    private readonly regexp;
    constructor(expression: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class WildcardRoleSpecifierEntry implements RoleSpecifierEntry {
    readonly mayHaveCapturingGroups = false;
    readonly capturingGroupCount = 0;
    private readonly regexp;
    constructor(pattern: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class LiteralRoleSpecifierEntry implements RoleSpecifierEntry {
    private readonly role;
    readonly mayHaveCapturingGroups = false;
    readonly capturingGroupCount = 0;
    constructor(role: string);
    matchesRole(role: string): boolean;
    getReplacementForRole(role: string, replacementExpression: string): string | undefined;
}
export declare class PermissionRestriction implements ModelComponent {
    readonly field: string;
    readonly value?: unknown;
    readonly valueTemplate?: string;
    readonly claim?: string;
    readonly loc?: MessageLocation;
    readonly fieldValueLoc?: MessageLocation;
    readonly valueLoc?: MessageLocation;
    constructor(config: PermissionRestrictionConfig);
    validate(context: ValidationContext): void;
}