import type { GenericMessage } from '../types/message-types.js';
import type { MessageStore } from '../types/message-store.js';
import type { PermissionsGrantMessage } from '../types/permissions-types.js';
import { Message } from './message.js';
export declare class GrantAuthorization {
    /**
     * Performs PermissionsGrant-based authorization against the given message
     * Does not validate grant `conditions` or `scope` beyond `interface` and `method`
     * @throws {Error} if authorization fails
     */
    static authorizeGenericMessage(tenant: string, incomingMessage: Message<GenericMessage>, author: string, permissionsGrantId: string, messageStore: MessageStore): Promise<PermissionsGrantMessage>;
    /**
     * Fetches PermissionsGrantMessage with CID `permissionsGrantId`.
     * @returns the PermissionsGrantMessage with CID `permissionsGrantId` if message exists
     * @throws {Error} if PermissionsGrantMessage with CID `permissionsGrantId` does not exist
     */
    private static fetchGrant;
    /**
     * Verifies the given `grantedTo` and `grantedFor` values against the given permissions grant and throws error if there is a mismatch.
     */
    private static verifyGrantedToAndGrantedFor;
    /**
     * Verify that the incoming message is within the allowed time frame of the grant,
     * and the grant has not been revoked.
     * @param permissionsGrantId Purely being passed as an optimization. Technically can be computed from `permissionsGrantMessage`.
     * @throws {Error} if incomingMessage has timestamp for a time in which the grant is not active.
     */
    private static verifyGrantActive;
    /**
     * Verify that the `interface` and `method` grant scopes match the incoming message
     * @throws {Error} if the `interface` and `method` of the incoming message do not match the scope of the PermissionsGrant
     */
    private static verifyGrantScopeInterfaceAndMethod;
}
//# sourceMappingURL=grant-authorization.d.ts.map