import type { AuthzToken, TokenService } from "../core/mod.ts";
/**
 * Based on deno std
 * https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/cookie.ts#L254C1-L270C2
 *
 * NOTE: maybe this should be Map based?
 */
export declare function _getCookies(headers: Headers): Record<string, string | undefined>;
/**
 * For a given HTTP Request, find the token value of a bearer-based Authorization header,
 * or null if it is not set
 */
export declare function _getRequestBearer(request: Request): string | null;
/**
 * Get a specific cookie from the HTTP Request, or null if it is not set
 */
export declare function _getRequestCookie(request: Request, cookieName: string): string | null;
/**
 * `a:b:c` -> [`a`, `a:b`, `a:b:c`]
 *
 * Take a scope and expand it into all possible parent scopes that have the same permission.
 *
 * For example `a:b:c` expands to:
 * - `a:b:c`
 * - `a:b`
 * - `a`
 *
 * Then if any of those scopes are present, the request is authorized.
 */
export declare function _expandScopes(scope: string): string[];
export declare function _checkScope(actual: string, expected: string[]): boolean;
/**
 * Check whether a provided scope meets the requirement of the expected scope
 *
 * The idea is that a parent scope contains all children scopes, recursively.
 * So if you find all the parents of a given scope, you can test it against a scope that has been provided by a user.
 *
 * For example `user:books:read` will match against:
 * - `user:books:read`
 * - `user:books`
 * - `user`
 *
 * So if any of those scopes are authorized, access can be granted.
 *
 * ```js
 * includesScope("user:books:read", "user:books:read"); // true
 * includesScope("user:books", "user:books:read");      // true
 * includesScope("user", "user:books:read");            // true
 * includesScope("user", "user:podcasts");              // true
 * includesScope("user:books", "user:podcasts");        // false
 * ```
 */
export declare function includesScope(actual: string, expected: string): boolean;
/**
 * @ignore
 * Options for asserting the authorization on any request
 */
export interface AssertOptions {
    scope?: string;
}
/**
 * @ignore
 *
 * Options for asserting the authorization on a request that originated from a user
 */
export interface AssertUserOptions {
    scope?: string;
}
/**
 * @ignore
 *
 * The result from asserting a request which was authorized for a user
 */
export interface AssertUserResult {
    kind: "user";
    userId: number;
    scope: string;
}
/**
 * @ignore
 *
 * The result from asserting a request which was authorized for a service,
 * i.e. not a user
 */
export interface AssertServiceResult {
    kind: "service";
    scope: string;
}
/**
 * @ignore
 * The possible types of result from asserting a request's authorization
 */
export type AuthorizationResult = AssertUserResult | AssertServiceResult;
/**
 * @group Authorization
 * @unstable
 */
export interface AbstractAuthorizationService {
    /**
     * ...
     */
    getAuthorization(request: Request): string | null;
    /**
     * ...
     */
    assert(request: Request, options?: AssertOptions): Promise<AuthorizationResult>;
    /**
     * ...
     */
    assertUser(request: Request, options?: AssertUserOptions): Promise<AssertUserResult>;
    /**
     * ...
     */
    from(request: Request): Promise<AuthorizationResult | null>;
}
/**
 * @ignore
 * Options for creating an AuthorizationService
 */
export interface AuthorizationServiceOptions {
    cookieName: string;
}
/**
 * @unstable
 * @group Authorization
 */
export declare class AuthorizationService implements AbstractAuthorizationService {
    options: AuthorizationServiceOptions;
    tokens: TokenService;
    constructor(options: AuthorizationServiceOptions, tokens: TokenService);
    getAuthorization(request: Request): string | null;
    _processToken(verified: AuthzToken): AuthorizationResult;
    from(request: Request): Promise<AuthorizationResult | null>;
    assert(request: Request, options?: AssertOptions): Promise<AuthorizationResult>;
    assertUser(request: Request, options?: AssertUserOptions): Promise<AssertUserResult>;
}
//# sourceMappingURL=authorization.d.ts.map