import { GranteeType, IMetadataProvider, NormalizedPermission, PermissionAction, PermissionCheckResult, PermissionProviderBase, UserInfo } from '@memberjunction/core';
/**
 * Wraps `MJ: Access Control Rules` behind the unified {@link PermissionProviderBase} contract.
 *
 * ACRs are record-scoped permissions on any entity, using a single polymorphic
 * `(GranteeType, GranteeID)` column pair. They support the broadest grantee set
 * (User, Role, Everyone, Public), the full CRUD+Share action set, and optional
 * time-bound expiration via `ExpiresAt`.
 *
 * `resourceType` is the entity name the ACR targets (e.g., `"Accounts"`); the provider
 * resolves it to the EntityID before querying. `resourceId` is the `RecordID` value
 * (typically a UUID but stored as nvarchar(500) to accommodate composite keys).
 */
export declare class AccessControlRuleProvider extends PermissionProviderBase {
    readonly DomainName = "Access Control Rules";
    readonly Description = "Record-level permissions with User/Role/Everyone/Public grantees, full CRUD+Share, and optional expiration.";
    readonly SupportedGranteeTypes: GranteeType[];
    readonly SupportedActions: PermissionAction[];
    readonly SupportsDeny = false;
    readonly SupportsExpiration = true;
    GetResourceTypes(provider?: IMetadataProvider): string[];
    CheckPermission(user: UserInfo, resourceType: string, resourceId: string | null, action: PermissionAction, provider?: IMetadataProvider): Promise<PermissionCheckResult>;
    GetEffectivePermissions(user: UserInfo, resourceType: string, resourceId: string, provider?: IMetadataProvider): Promise<NormalizedPermission[]>;
    GetUserResources(user: UserInfo, resourceType?: string, provider?: IMetadataProvider): Promise<NormalizedPermission[]>;
    GetResourcePermissions(resourceType: string, resourceId: string, provider?: IMetadataProvider): Promise<NormalizedPermission[]>;
    /**
     * ACRs where this user is the User-type grantee AND someone else issued the grant.
     * Excludes rules the user created for themselves. Role/Everyone/Public grants don't
     * belong in the personal "Shared with me" view — they're always aggregated, and there's
     * no single recipient they were shared *with*. Only unexpired rules are returned.
     */
    GetPermissionsSharedWithUser(grantee: UserInfo): Promise<NormalizedPermission[]>;
    /**
     * Every ACR where this user is the grantor. Only unexpired rules are returned — an
     * expired ACR can't be acted on, so surfacing it in "Shared by me" would be noise.
     */
    GetPermissionsGrantedByUser(grantor: UserInfo): Promise<NormalizedPermission[]>;
    /**
     * Dialect-neutral "not yet expired" predicate. Uses a JS-computed ISO-8601
     * timestamp literal rather than a SQL function — SQL Server's `GETUTCDATE()`
     * does not exist on PostgreSQL and would crash the underlying RunView query
     * there. An ISO-8601 literal compares correctly against `datetimeoffset`
     * (SQL Server) and `timestamptz` (PostgreSQL) alike.
     */
    private unexpiredClause;
    private resolveEntityId;
    private fetchActiveRules;
    private resolveGranteeName;
    private actionsForUser;
    private granteeMatchesUser;
    private rowActions;
}
//# sourceMappingURL=AccessControlRuleProvider.d.ts.map