import { EntityDeleteOptions, EntityPermissionType, EntitySaveOptions } from "@memberjunction/core";
import { MJResourcePermissionEntity } from "../../generated/entity_subclasses.js";
/**
 * Subclass for the Resource Permissiosn entity that implements some workflow logic
 */
export declare class MJResourcePermissionEntityExtended extends MJResourcePermissionEntity {
    /**
     * Set by the async `Delete`/`Save` overrides after they confirm the
     * context user is authorized via resource ownership or Owner-level grant.
     * Read by the (sync) `CheckPermissions` override to bypass the role-based
     * gate that would otherwise block non-admin users from revoking shares.
     */
    private _authorizedByOwnerOverride;
    /**
     * Relaxes the default role-based Update/Delete gate for three parties
     * who legitimately need to manage a share:
     *
     *  1. **Grantor** — whoever created the grant (`SharedByUserID`).
     *  2. **Resource owner** — the user who owns the underlying resource.
     *     Checked synchronously via in-memory engine caches (currently
     *     `ConversationEngine` for Conversations; add other engines as
     *     resource types adopt this pattern).
     *  3. **Owner-level grantee** — anyone else holding an `Owner` permission
     *     on the same resource, consulted via the cached
     *     `ResourcePermissionEngine.Permissions`.
     *
     * Without this, resource owners can't revoke shares other users created —
     * the UI/Developer roles don't have `CanDelete` on `MJ: Resource Permissions`.
     */
    CheckPermissions(type: EntityPermissionType, throwError: boolean): boolean;
    /**
     * Async owner lookup that loads the target resource and returns `true`
     * if the context user owns it. Generic — uses the resource type catalog
     * to find the owner field name, so any resource type seeded in
     * `MJ: Resource Types` works without per-type code here.
     */
    private currentUserOwnsResourceAsync;
    /**
     * Compute whether the context user may Update/Delete this permission row.
     * Combines the sync checks (fast path, uses engine caches) with the async
     * resource-owner lookup (works on the server where caches aren't populated).
     */
    private callerMayManageShare;
    /**
     * Async wrapper that runs the full authorization check (including the
     * async resource-owner lookup) before delegating to the base delete. Sets
     * `_authorizedByOwnerOverride` so the sync `CheckPermissions` called by
     * the base class will bypass the role-based gate.
     */
    Delete(options?: EntityDeleteOptions): Promise<boolean>;
    /**
     * Checks resource-type-specific engine caches synchronously to decide
     * whether `userId` owns the record this permission row points at.
     */
    private currentUserOwnsResource;
    /**
     * Owner-level grantees (direct or via role) can manage shares on the
     * resource. Reads from `ResourcePermissionEngine`'s cached permissions —
     * must already be configured; on the server this happens at startup.
     */
    private currentUserHasOwnerGrant;
    /**
     * This override encapsulates some busienss logic for the Resource Permissions entity as follows:
     * 1) Whenever a new permission record is created that has a status of "Requested", we generate a new Notifications record for the owner of the resource being requested
     * 2) Whenever a permisison record has a status that changes from "Requested" to something else, we notify the user who requested access to the resource
     * We only do this logic when we're on the server side to avoid redundancy of notifications
     * @param options
     */
    Save(options?: EntitySaveOptions): Promise<boolean>;
    /**
     * `true` when the context user may create an Approved grant on this resource:
     * they are either the resource's owner, or they already hold an Owner-level
     * `MJ: Resource Permissions` row on it (direct or via role). Returns `false`
     * when there is no context user.
     */
    private callerMayGrantShare;
}
//# sourceMappingURL=MJResourcePermissionEntityExtended.d.ts.map