import { type CreateEmbedJwt, type DashboardFilterInteractivityOptions, type ParameterInteractivityOptions } from '../ee';
import { type Organization } from './organization';
import { type AccountUser, type ExternalUser, type IntrinsicUserAttributes, type LightdashSessionUser, type LightdashUser, type SessionUser } from './user';
import { type UserAttributeValueMap } from './userAttributes';
/**
 * Prefixes for the authorization tokens we store in the database
 */
export declare enum AuthTokenPrefix {
    SCIM = "scim_",
    SERVICE_ACCOUNT = "ldsvc_",
    PERSONAL_ACCESS_TOKEN = "ldpat_",
    OAUTH_APP = "ldapp_",
    OAUTH_REFRESH = "ldref_"
}
export type AuthType = 'session' | 'pat' | 'service-account' | 'jwt' | 'oauth';
export type PersonalAccessTokenAuth = {
    type: 'pat';
    source: string;
};
export type SessionAuth = {
    type: 'session';
    source: string;
};
export type JwtAuth = {
    type: 'jwt';
    data: CreateEmbedJwt;
    source: string;
};
export type ServiceAccountAuth = {
    type: 'service-account';
    source: string;
    serviceAccountUuid: string;
    serviceAccountDescription: string;
};
export type OauthAuth = {
    type: 'oauth';
    source: string;
    token: string;
    clientId: string;
    scopes: string[];
    expiresAt?: number;
    resource?: URL;
};
export type OssEmbed = {
    projectUuid: string;
    organization: Pick<Organization, 'organizationUuid' | 'name' | 'createdAt'>;
    encodedSecret: string;
    dashboardUuids: string[];
    allowAllDashboards: boolean;
    chartUuids: string[];
    allowAllCharts: boolean;
    allowAllApps: boolean;
    appUuids: string[];
    createdAt: string;
    user: Pick<LightdashUser, 'userUuid' | 'firstName' | 'lastName'> | null;
};
export type Authentication = SessionAuth | JwtAuth | ServiceAccountAuth | PersonalAccessTokenAuth | OauthAuth;
export type UserAccessControls = {
    userAttributes: UserAttributeValueMap;
    intrinsicUserAttributes: IntrinsicUserAttributes;
};
/**
 * Details about the content bound to the given JWT
 */
export type EmbedContent = {
    /** The dashboard UUID the JWT may have access to */
    dashboardUuid?: string;
    /** The chart IDs the JWT dashboard may have access to */
    chartUuids: string[];
    /** Explores available to the embedded dashboard */
    explores: string[];
    /** The data app UUID the JWT may have access to (standalone app embed) */
    appUuid?: string;
    /** The AI agent UUID the JWT may have access to */
    agentUuid?: string;
    /** The type of content */
    type: 'dashboard' | 'chart' | 'dataApp' | 'aiAgent';
};
export type EmbedAccess = {
    content: EmbedContent;
    /** Dashboard filtering options for interactivity */
    filtering?: DashboardFilterInteractivityOptions;
    /** User-specific access controls */
    controls?: UserAccessControls;
    /** Dashboard parameter interactivity options */
    parameters?: ParameterInteractivityOptions;
};
export type AccountHelpers = {
    /** Is this user logged in? */
    isAuthenticated: () => boolean;
    /** Is this account for a known user in our database? */
    isRegisteredUser: () => boolean;
    /** Is this account for an anonymous external user? */
    isAnonymousUser: () => boolean;
    /** Is this account for a session user? */
    isSessionUser: () => boolean;
    /** Is this account for a JWT user? */
    isJwtUser: () => boolean;
    /** Is this account for a service account? */
    isServiceAccount: () => boolean;
    /** Is this account for a personal access token? */
    isPatUser: () => boolean;
    /** Is this account for a oauth user? */
    isOauthUser: () => boolean;
};
export type AccountOrganization = Partial<Pick<Organization, 'organizationUuid' | 'name' | 'createdAt'>>;
/**
 * Per-request metadata captured by the auth middleware. Used by the audit log
 * to record the IP, user agent and request id alongside permission checks.
 */
export type AccountRequestContext = {
    ip?: string;
    userAgent?: string;
    requestId?: string;
};
/**
 * Base account interface that all account types extend
 */
export type BaseAccount = {
    organization: AccountOrganization;
    authentication: Authentication;
    user: AccountUser;
    requestContext?: AccountRequestContext;
};
type BaseAccountWithHelpers = BaseAccount & AccountHelpers;
/**
 * Account for registered users with session authentication
 */
export type SessionAccount = BaseAccountWithHelpers & {
    authentication: SessionAuth;
    user: LightdashSessionUser;
};
/**
 * Account for anonymous users with JWT authentication (embeds)
 */
export type AnonymousAccount = BaseAccountWithHelpers & {
    authentication: JwtAuth;
    user: ExternalUser;
    embedWriteUser?: SessionUser;
    embedWriteContext?: {
        canCreateSavedChart: boolean;
        canUseAiAgent: boolean;
        aiAgentErrorMessage?: string;
    };
    /** The access permissions the account has */
    access: EmbedAccess;
    /** The embed configuration associated with the JWT */
    embed: OssEmbed;
};
export type ApiKeyAccount = BaseAccountWithHelpers & {
    authentication: PersonalAccessTokenAuth;
    user: LightdashSessionUser;
};
export type ServiceAcctAccount = BaseAccountWithHelpers & {
    authentication: ServiceAccountAuth;
    user: LightdashSessionUser;
};
export type OauthAccount = BaseAccountWithHelpers & {
    authentication: OauthAuth;
    user: LightdashSessionUser;
};
export type Account = SessionAccount | AnonymousAccount | ApiKeyAccount | ServiceAcctAccount | OauthAccount;
export type RegisteredAccount = Exclude<Account, AnonymousAccount>;
export type AccountWithoutHelpers<T extends Account> = Omit<T, keyof AccountHelpers>;
export declare function assertEmbeddedAuth(account: Account | undefined): asserts account is AnonymousAccount;
export declare function assertSessionAuth(account: Account | undefined): asserts account is SessionAccount;
export declare function assertRegisteredAccount(account: Account | undefined): asserts account is RegisteredAccount;
export declare function isAccount(accountOrUser: Account | SessionUser): accountOrUser is Account;
export declare function isJwtUser(account?: Account): account is AnonymousAccount;
type AccountWithOrg = Account & {
    organization: {
        organizationUuid: string;
        name: string;
        createdAt: Date;
    };
};
export declare function assertIsAccountWithOrg(account: Account): asserts account is AccountWithOrg;
export {};
//# sourceMappingURL=auth.d.ts.map