import { QueryHookPlugin, PreQueryContext } from '../index';
/**
 * Blocked operation details
 */
export interface BlockedOperation {
    reason: string;
    operation: string;
    sql: string;
    tables: string[];
    severity: 'warning' | 'error' | 'critical';
}
/**
 * Options for SafetyGuardPlugin
 */
export interface SafetyGuardOptions {
    /**
     * Block DDL operations (CREATE, ALTER, DROP, TRUNCATE) (default: false)
     * When true, prevents schema changes through the application
     *
     * ⚠️ Recommended: true in production
     */
    blockDDL?: boolean;
    /**
     * Require WHERE clause for UPDATE/DELETE (default: true)
     * Prevents accidental mass updates/deletes
     *
     * ⚠️ CRITICAL: Prevents `UPDATE users SET ...` (updates ALL rows)
     */
    requireWhereClause?: boolean;
    /**
     * Block TRUNCATE operations (default: true)
     * Prevents table truncation which deletes all data
     */
    blockTruncate?: boolean;
    /**
     * Block DROP operations (default: true in production)
     * Prevents table/database drops
     */
    blockDrop?: boolean;
    /**
     * Allowed environments for destructive operations (default: ['development', 'test'])
     * Operations are only blocked outside these environments
     *
     * @example ['development', 'test', 'staging']
     */
    allowedEnvironments?: string[];
    /**
     * Tables that require extra protection (default: [])
     * These tables have stricter rules applied
     *
     * @example ['users', 'payments', 'transactions'] - Critical tables
     */
    protectedTables?: string[];
    /**
     * Allow force flag to override safety (default: false)
     * When false, no overrides are possible (recommended for production)
     * When true, queries with special comment can bypass: /* FORCE_ALLOW *\/
     */
    allowForce?: boolean;
    /**
     * Callback when an operation is blocked (optional)
     *
     * @param context - Query context
     * @param blocked - Details about blocked operation
     *
     * @example
     * ```typescript
     * onBlocked: (context, blocked) => {
     *   logger.error('Dangerous operation blocked', blocked);
     *   monitoring.alert({
     *     type: 'safety_guard_block',
     *     severity: blocked.severity,
     *     operation: blocked.operation
     *   });
     * }
     * ```
     */
    onBlocked?: (context: PreQueryContext, blocked: BlockedOperation) => void;
    /**
     * Throw error when operation is blocked (default: true)
     * When true, throws error to prevent query execution
     * When false, just logs warning (not recommended)
     */
    throwOnBlock?: boolean;
    /**
     * Enable console logging for this plugin (default: false)
     * When true, logs all blocked operations
     */
    enableLogging?: boolean;
}
/**
 * Plugin for blocking dangerous database operations
 * The "Production Airbag" - prevents catastrophic mistakes
 *
 * 🛡️ CRITICAL: Prevents production disasters
 *
 * **What it prevents:**
 * 1. ❌ `UPDATE users SET role='admin'` - No WHERE clause = ALL rows updated
 * 2. ❌ `DELETE FROM orders` - No WHERE clause = ALL orders deleted
 * 3. ❌ `DROP TABLE users` - Accidental table drops
 * 4. ❌ `TRUNCATE payments` - All payment records gone
 * 5. ❌ `synchronize: true` in production - Schema auto-sync disasters
 *
 * **Real stories this prevents:**
 * - Junior dev ran `UPDATE users SET email='test@test.com'` without WHERE → 1M users had same email
 * - Migration with DROP TABLE ran in production
 * - Someone forgot WHERE in DELETE → Lost 6 months of data
 *
 * @example
 * ```typescript
 * import { enableQueryHooks, registerPlugin } from 'typeorm-query-hooks';
 * import { SafetyGuardPlugin } from 'typeorm-query-hooks/plugins/safety-guard';
 *
 * enableQueryHooks();
 *
 * // Basic usage: Production safety
 * registerPlugin(SafetyGuardPlugin({
 *   blockDDL: true,           // No CREATE/ALTER/DROP
 *   requireWhereClause: true, // No UPDATE/DELETE without WHERE
 *   blockTruncate: true,      // No TRUNCATE
 *   throwOnBlock: true        // Stop execution
 * }));
 *
 * // Advanced: Environment-aware with protected tables
 * registerPlugin(SafetyGuardPlugin({
 *   blockDDL: process.env.NODE_ENV === 'production',
 *   requireWhereClause: true,
 *   allowedEnvironments: ['development', 'test'],
 *   protectedTables: ['users', 'payments', 'transactions'], // Extra protection
 *   allowForce: false, // No overrides in production
 *   onBlocked: (context, blocked) => {
 *     // Send critical alert
 *     pagerduty.trigger({
 *       severity: 'critical',
 *       summary: `Dangerous operation blocked: ${blocked.operation}`,
 *       details: blocked
 *     });
 *
 *     // Log to audit trail
 *     auditLog.save({
 *       event: 'operation_blocked',
 *       severity: blocked.severity,
 *       reason: blocked.reason,
 *       sql: blocked.sql,
 *       userId: getCurrentUser()?.id,
 *       timestamp: new Date()
 *     });
 *   },
 *   enableLogging: true
 * }));
 *
 * // Example: Strict mode for financial tables
 * registerPlugin(SafetyGuardPlugin({
 *   requireWhereClause: true,
 *   protectedTables: ['payments', 'transactions', 'invoices'],
 *   throwOnBlock: true,
 *   onBlocked: (context, blocked) => {
 *     throw new Error(`🛑 CRITICAL: Attempted ${blocked.operation} on ${blocked.tables.join(', ')} - BLOCKED`);
 *   }
 * }));
 * ```
 */
export declare function SafetyGuardPlugin(options?: SafetyGuardOptions): QueryHookPlugin;
//# sourceMappingURL=safety-guard.d.ts.map