import type { Context } from '../context.js';
type Middleware = (ctx: Context, next: () => Promise<any>) => any;
interface Permission {
    resource: string;
    actions: string[];
    conditions?: Record<string, any>;
}
interface Role {
    name: string;
    permissions: Permission[];
    inherits?: string[];
    priority?: number;
}
interface User {
    id: string;
    roles: string[];
    permissions?: Permission[];
    metadata?: Record<string, any>;
}
interface RBACConfig {
    roles: Map<string, Role>;
    getUserRoles: (ctx: Context) => Promise<string[]> | string[];
    getUserPermissions?: (ctx: Context) => Promise<Permission[]> | Permission[];
    cache?: boolean;
    cacheTTL?: number;
    onUnauthorized?: (ctx: Context, resource: string, action: string) => void;
    superAdminRole?: string;
}
interface AccessControl {
    allow: (resource: string, actions: string | string[]) => AccessControl;
    deny: (resource: string, actions: string | string[]) => AccessControl;
    when: (condition: (ctx: Context) => boolean | Promise<boolean>) => AccessControl;
    check: (ctx: Context) => Promise<boolean>;
}
/**
 * Advanced RBAC (Role-Based Access Control) Plugin
 *
 * Features:
 * - Hierarchical role inheritance
 * - Fine-grained permissions with conditions
 * - Dynamic permission evaluation
 * - Permission caching for performance
 * - Resource-based access control
 * - Action-level authorization
 * - Wildcard support for resources and actions
 * - Audit logging integration
 */
export declare function rbac(config: RBACConfig): Middleware;
/**
 * Require specific permission middleware
 */
export declare function requirePermission(resource: string, action: string, conditions?: Record<string, any>): Middleware;
/**
 * Require specific role middleware
 */
export declare function requireRole(role: string | string[]): Middleware;
/**
 * Role builder utility
 */
export declare class RoleBuilder {
    private roles;
    defineRole(name: string): RoleDefinition;
    build(): Map<string, Role>;
}
declare class RoleDefinition {
    private roles;
    private role;
    constructor(name: string, roles: Map<string, Role>);
    inherits(...roleNames: string[]): this;
    can(resource: string, actions: string | string[]): this;
    canWhen(resource: string, actions: string | string[], conditions: Record<string, any>): this;
    priority(priority: number): this;
    build(): RoleBuilder;
}
export { type Permission, type Role, type User, type RBACConfig, type AccessControl };
//# sourceMappingURL=rbac.d.ts.map