import type { PermissionFilter, PermissionData } from '../types/index.js';
export type { PermissionFilter };
/**
 * Role interface for type safety
 */
export interface Role {
    id: string | number;
    name: string;
    description?: string;
    isTenantSpecific?: boolean;
    canInviteRoleIds?: string[];
}
/**
 * Permission Service - Handles role-based access control
 *
 * Uses hybrid L1(Memory)+L2(Redis) caching for both roles and permissions.
 *
 * Cache Architecture:
 * - Roles use "auth:roles:*" keys (hybrid keys, auto-synced across instances)
 * - Permissions use "permissions:role:*" keys (hybrid keys)
 * - L1 reads are fast (in-memory), L2 (Redis) is source of truth
 * - Periodic sync (default 5s) keeps all instances in sync
 */
export declare class PermissionService {
    private rolesLoaded;
    constructor();
    /**
     * Get cache instance
     */
    private getCache;
    /**
     * Load all roles from database into hybrid cache
     * Called once at startup alongside loadPermissions
     */
    loadRoles(): Promise<void>;
    /**
     * Ensure roles are loaded into cache
     */
    private ensureRolesLoaded;
    /**
     * Get role by ID (async, from hybrid cache)
     */
    getRoleByIdAsync(roleId: string | number): Promise<Role | null>;
    /**
     * Get role by name (async, from hybrid cache)
     */
    getRoleByNameAsync(name: string): Promise<Role | null>;
    /**
     * Get the public role (async, from hybrid cache)
     */
    getPublicRoleAsync(): Promise<Role | null>;
    /**
     * Get the administrator role (async, from hybrid cache)
     */
    getAdministratorRoleAsync(): Promise<Role | null>;
    /**
     * Check if a role ID is the administrator role (async)
     */
    isAdministratorRoleAsync(roleId: string | number | null | undefined): Promise<boolean>;
    /**
     * Check if a role name is administrator
     */
    isAdministratorRoleName(roleName: string | null | undefined): boolean;
    /**
     * Get all roles (async, from hybrid cache)
     */
    getAllRolesAsync(): Promise<Role[]>;
    /**
     * Check if roles are loaded
     */
    areRolesLoaded(): boolean;
    /**
     * Invalidate role cache and reload
     * Call this when roles are created, updated, or deleted
     */
    invalidateRoles(): Promise<void>;
    /**
     * Load permissions from database
     * Also loads roles if not already loaded
     */
    loadPermissions(role_Id?: string | number | null): Promise<void>;
    /**
     * Parse fields string to array
     */
    private parseFields;
    /**
     * Get permissions for a role
     */
    getPermissions(role_Id: string | number): Promise<Record<string, Record<string, PermissionData>>>;
    /**
     * Check if role can access collection with operation
     */
    canAccess(role_Id: string | number, collection: string, operation: 'create' | 'read' | 'update' | 'delete', fields?: string[] | null): Promise<boolean>;
    /**
     * Check if requested fields are allowed
     */
    private checkFieldPermissions;
    /**
     * Check if a single field is allowed
     */
    private isFieldAllowed;
    /**
     * Match field pattern with wildcards
     * Supports:
     * - * : matches exactly one level (e.g., "user.*" matches "user.name" but not "user.role.name")
     * - ** : matches any number of nested levels (e.g., "user.**" matches "user.name", "user.role.name", etc.)
     */
    private matchFieldPattern;
    /**
     * Get filter conditions for a role and collection
     */
    getFilter(role_Id: string | number, collection: string, operation: 'create' | 'read' | 'update' | 'delete', accountability: any): Promise<PermissionFilter>;
    /**
     * Get default values from permissions
     */
    getDefaultValues(role_Id: string | number, collection: string, operation: 'create' | 'update', accountability: any): Promise<Record<string, any>>;
    /**
     * Get allowed fields for a role and collection
     */
    getAllowedFields(role_Id: string | number, collection: string, operation: 'create' | 'read' | 'update' | 'delete'): Promise<string[] | null>;
    /**
     * Combined permission lookup — single cache hit returns canAccess, filter, and allowedFields.
     * Use this instead of calling canAccess + getFilter + getAllowedFields separately.
     */
    getFullPermissionData(role_Id: string | number, collection: string, operation: 'create' | 'read' | 'update' | 'delete', accountability: any): Promise<{
        canAccess: boolean;
        filter: PermissionFilter;
        allowedFields: string[] | null;
        /**
         * The raw, UNEXPANDED permission fields (e.g. ["*", "role_Id"]). Used to
         * distinguish a field granted explicitly by name from one merely swept in by
         * a "*" wildcard — privilege fields are writable only when explicitly named.
         */
        rawFields: string[] | null;
    }>;
}
declare global {
    var __baasix_permissionService: PermissionService | undefined;
}
declare const permissionService: PermissionService;
export { permissionService };
export default permissionService;
//# sourceMappingURL=PermissionService.d.ts.map