import type { MessageStore } from '../types/message-store.js';
import type { RecordsRead } from '../interfaces/records/messages/records-read.js';
import { RecordsWrite } from '../interfaces/records/messages/records-write.js';
export declare class ProtocolAuthorization {
    /**
     * Performs protocol-based authorization against the given message.
     * @throws {Error} if authorization fails.
     */
    static authorize(tenant: string, incomingMessage: RecordsRead | RecordsWrite, author: string | undefined, messageStore: MessageStore): Promise<void>;
    /**
     * Fetches the protocol definition based on the protocol specified in the given message.
     */
    private static fetchProtocolDefinition;
    /**
     * Constructs a chain of ancestor messages
     * @returns the ancestor chain of messages where the first element is the root of the chain; returns empty array if no parent is specified.
     */
    private static constructAncestorMessageChain;
    /**
     * Gets the rule set corresponding to the given message chain.
     */
    private static getRuleSet;
    /**
     * Verifies the `protocolPath` declared in the given message (if it is a RecordsWrite) matches the path of actual ancestor chain.
     * @throws {DwnError} if fails verification.
     */
    private static verifyProtocolPath;
    /**
     * Verifies the `dataFormat` and `schema` declared in the given message (if it is a RecordsWrite) matches dataFormat
     * and schema of the type in the given protocol.
     * @throws {DwnError} if fails verification.
     */
    private static verifyType;
    /**
     * Verifies the actions specified in the given message matches the allowed actions in the rule set.
     * @throws {Error} if action not allowed.
     */
    private static verifyAllowedActions;
    /**
     * Verifies if the desired action can be taken.
     * Currently the only check is: if the write is not the initial write, the author must be the same as the initial write
     * @throws {Error} if fails verification
     */
    private static verifyActionCondition;
    /**
     * Gets the message from the message chain based on the path specified.
     * Returns undefined if matching message does not existing in ancestor chain
     * @param protocolPath `/` delimited path starting from the root ancestor.
     *                    Each path segment denotes the expected record type declared in protocol definition.
     *                    e.g. `A/B/C` means that the root ancestor must be of type A, its child must be of type B, followed by a child of type C.
     *                    NOTE: the path scheme use here may be temporary dependent on final protocol spec.
     */
    private static getMessage;
    private static getTypeName;
}
//# sourceMappingURL=protocol-authorization.d.ts.map