/**
 * AUTHENTICATION & AUTHORIZATION
 * API keys, JWT tokens, OAuth2, RBAC, policy-based access control
 */
export declare enum AuthMethod {
    API_KEY = "api_key",
    JWT = "jwt",
    OAUTH2 = "oauth2",
    BASIC = "basic"
}
export declare enum Role {
    ADMIN = "admin",
    USER = "user",
    READ_ONLY = "read_only",
    API = "api",
    SERVICE = "service"
}
export declare enum Permission {
    READ_MODELS = "read:models",
    WRITE_MODELS = "write:models",
    EXECUTE_MODELS = "execute:models",
    ADMIN_TENANTS = "admin:tenants",
    ADMIN_USERS = "admin:users",
    MANAGE_KEYS = "manage:keys",
    VIEW_ANALYTICS = "view:analytics",
    MANAGE_COSTS = "manage:costs"
}
export interface ApiKey {
    id: string;
    key: string;
    name: string;
    tenant_id: string;
    user_id?: string;
    permissions: Permission[];
    rate_limit?: number;
    expires_at?: Date;
    last_used?: Date;
    created_at: Date;
    revoked: boolean;
    revoked_at?: Date;
}
export interface JWTPayload {
    sub: string;
    tenant_id: string;
    role: Role;
    permissions: Permission[];
    iat: number;
    exp: number;
    iss?: string;
}
export interface AuthContext {
    user_id: string;
    tenant_id: string;
    role: Role;
    permissions: Permission[];
    method: AuthMethod;
    metadata?: Record<string, unknown>;
}
export interface AccessPolicy {
    id: string;
    name: string;
    effect: 'allow' | 'deny';
    actions: string[];
    resources: string[];
    conditions?: PolicyCondition[];
}
export interface PolicyCondition {
    type: 'time' | 'ip' | 'tenant' | 'custom';
    operator: 'equals' | 'not_equals' | 'in' | 'not_in' | 'greater_than' | 'less_than';
    value: unknown;
}
export declare class ApiKeyManager {
    private keys;
    private key_index;
    /**
     * Generate new API key
     */
    generate(params: {
        name: string;
        tenant_id: string;
        user_id?: string;
        permissions: Permission[];
        expires_in_days?: number;
        rate_limit?: number;
    }): ApiKey;
    /**
     * Validate API key
     */
    validate(key: string): {
        valid: boolean;
        api_key?: ApiKey;
        reason?: string;
    };
    /**
     * Revoke API key
     */
    revoke(key_id: string): boolean;
    /**
     * List API keys
     */
    list(tenant_id: string, user_id?: string): ApiKey[];
    /**
     * Get API key by ID
     */
    get(key_id: string): ApiKey | null;
    private generateKey;
    private generateId;
}
export declare class JWTManager {
    private secret;
    private issuer;
    private default_expiry_seconds;
    constructor(config: {
        secret: string;
        issuer?: string;
        default_expiry_seconds?: number;
    });
    /**
     * Generate JWT token
     */
    generate(payload: Omit<JWTPayload, 'iat' | 'exp' | 'iss'>): string;
    /**
     * Verify and decode JWT token
     */
    verify(token: string): {
        valid: boolean;
        payload?: JWTPayload;
        reason?: string;
    };
    private sign;
    private base64UrlEncode;
    private base64UrlDecode;
}
export declare class RBACManager {
    private role_permissions;
    private policies;
    constructor();
    /**
     * Check if user has permission
     */
    hasPermission(context: AuthContext, permission: Permission): boolean;
    /**
     * Check access against policies
     */
    checkAccess(context: AuthContext, action: string, resource: string): boolean;
    /**
     * Add permission to role
     */
    grantPermission(role: Role, permission: Permission): void;
    /**
     * Remove permission from role
     */
    revokePermission(role: Role, permission: Permission): void;
    /**
     * Register access policy
     */
    registerPolicy(policy: AccessPolicy): void;
    /**
     * Get all permissions for role
     */
    getRolePermissions(role: Role): Permission[];
    private initializeDefaultRoles;
    private policyApplies;
    private matchesPattern;
    private evaluateConditions;
}
export declare class AuthManager {
    private api_key_manager;
    private jwt_manager;
    private rbac_manager;
    constructor(config: {
        jwt_secret: string;
        jwt_issuer?: string;
    });
    /**
     * Authenticate request
     */
    authenticate(method: AuthMethod, credentials: string): {
        authenticated: boolean;
        context?: AuthContext;
        reason?: string;
    };
    /**
     * Authorize action
     */
    authorize(context: AuthContext, permission: Permission): boolean;
    /**
     * Check access to resource
     */
    checkAccess(context: AuthContext, action: string, resource: string): boolean;
    /**
     * Get managers
     */
    getApiKeyManager(): ApiKeyManager;
    getJWTManager(): JWTManager;
    getRBACManager(): RBACManager;
    private authenticateApiKey;
    private authenticateJWT;
}
//# sourceMappingURL=auth-manager.d.ts.map