import { BaseEngine, IMetadataProvider, NormalizedPermission, PermissionAction, PermissionAuditEntry, PermissionAuditFilter, PermissionCheckResult, PermissionProviderBase, UserInfo } from '@memberjunction/core';
import { MJPermissionDomainEntity } from '../generated/entity_subclasses.js';
/**
 * Canonical Font Awesome class for each permission domain. Exported so the admin
 * Permissions app and the end-user Sharing Center render the same glyph for each
 * domain without drifting. Consumers should call
 * {@link PermissionEngine.DomainIconFor} rather than reading the map directly so
 * unknown domains get the lock fallback.
 */
export declare const PERMISSION_DOMAIN_ICONS: Record<string, string>;
/** Fallback icon used when a domain isn't in the catalog (e.g., a Phase-3 provider). */
export declare const PERMISSION_DOMAIN_ICON_FALLBACK = "fa-solid fa-lock";
/**
 * PermissionEngine is the unified entry point for permission queries across every registered
 * permission subsystem. At startup it loads the {@link MJPermissionDomainEntity} catalog, then
 * instantiates each active domain's provider via ClassFactory (keyed on `ProviderClassName`).
 *
 * Typical usage:
 * ```typescript
 * // "Can this user read entity X?"
 * const result = PermissionEngine.Instance.CheckPermission(
 *     user, 'Entity Permissions', 'Users', null, 'Read'
 * );
 *
 * // "Show me everything this user has access to"
 * const all = PermissionEngine.Instance.GetAllUserPermissions(user);
 *
 * // "Who has access to this resource?"
 * const rows = PermissionEngine.Instance.GetResourcePermissions(
 *     'Dashboard Permissions', 'Dashboards', dashboardId
 * );
 * ```
 *
 * Priority 15 so it configures after default-priority engines (e.g., UserInfoEngine at 10);
 * providers lazy-resolve their backing engines on first use, so even if a backing engine
 * has not been configured yet at provider construction time, permission checks still work
 * once the backing engine comes online.
 */
export declare class PermissionEngine extends BaseEngine<PermissionEngine> {
    static get Instance(): PermissionEngine;
    private _domains;
    private _providers;
    Config(forceRefresh?: boolean, contextUser?: UserInfo, provider?: IMetadataProvider): Promise<void>;
    /**
     * Walks the loaded domain catalog and instantiates each active provider via ClassFactory.
     * Called on every `Config()` so a `forceRefresh` re-wires the provider map.
     */
    private instantiateProviders;
    /**
     * Check whether a user has a specific permission on a specific resource within a domain.
     * Returns `{Allowed: false, Reason: 'Unknown domain'}` if the domain is not registered
     * (either because no catalog row exists or because its provider failed to load).
     */
    CheckPermission(user: UserInfo, domainName: string, resourceType: string, resourceId: string | null, action: PermissionAction): Promise<PermissionCheckResult>;
    /**
     * Aggregate every resource the user has access to across all registered providers.
     * Providers are queried in parallel; failures from individual providers are logged and skipped.
     * Powers the Sharing Center "User Access Report" view.
     */
    GetAllUserPermissions(user: UserInfo): Promise<NormalizedPermission[]>;
    /**
     * Aggregate every permission this user has granted to *other* users across all
     * registered providers. Powers the end-user Sharing Center's "Shared by me" tab.
     *
     * Role-only providers (Entity Permissions, Application Roles, AI Agent Permissions,
     * Query Permissions) contribute nothing — their base-class default returns `[]`.
     * Providers are queried in parallel; failures are logged and skipped.
     */
    GetPermissionsGrantedByUser(grantor: UserInfo): Promise<NormalizedPermission[]>;
    /**
     * Aggregate every permission where this user is the grantee AND someone else is the
     * grantor — the "shared with me" view. Excludes self-owned resources and role-inherited
     * access. Providers are queried in parallel; failures are logged and skipped.
     */
    GetPermissionsSharedWithUser(grantee: UserInfo): Promise<NormalizedPermission[]>;
    /**
     * Get every grantee's permissions on a specific resource within a domain.
     * Powers the Sharing Center "Resource Access Report" view.
     */
    GetResourcePermissions(domainName: string, resourceType: string, resourceId: string): Promise<NormalizedPermission[]>;
    /** All active, loaded domain catalog records. */
    get Domains(): MJPermissionDomainEntity[];
    /** Look up the provider for a specific domain by name; returns undefined when not loaded. */
    GetProvider(domainName: string): PermissionProviderBase | undefined;
    /**
     * The resource type names supported by the given permission domain — sourced
     * from the provider's `GetResourceTypes()`. Returns `[]` when the domain is
     * unknown or the provider doesn't enumerate its types. Used by admin UIs
     * (e.g., the Resource Access Report) to populate the Resource Type picker
     * after a Domain is selected.
     */
    GetResourceTypes(domainName: string, provider?: IMetadataProvider): string[];
    /**
     * Font Awesome class for a permission domain, with a lock fallback for
     * unknown domains. Drives the icon shown next to domain groups in both the
     * admin Permissions app and the end-user Sharing Center.
     */
    static DomainIconFor(domainName: string): string;
    /** For unit tests: swap the provider map with a caller-supplied one. */
    _SetProvidersForTesting(providers: Map<string, PermissionProviderBase>): void;
    /**
     * Convenience wrapper around {@link CheckPermission} that throws a typed
     * {@link PermissionDeniedError} when the action is not permitted. Intended for
     * programmatic callers — Actions, AI Agents, custom server code — that want
     * "fail loudly on denial" semantics instead of branching on a boolean result.
     *
     * @example
     * ```typescript
     * await PermissionEngine.Instance.AuthorizeOrThrow(
     *     user, 'Dashboard Permissions', 'Dashboards', dashboardId, 'Share'
     * );
     * // If we reach this line, the user can share the dashboard.
     * ```
     *
     * @throws {@link PermissionDeniedError} when the provider returns `Allowed: false`
     *         or when the domain is not registered.
     */
    AuthorizeOrThrow(user: UserInfo, domainName: string, resourceType: string, resourceId: string | null, action: PermissionAction): Promise<void>;
    /**
     * Query RecordChange for audit events against every permission-backing entity.
     * Supports filtering by domain, date range, changed-by user, or a specific
     * record. Results are sorted newest-first and capped at `filter.MaxRows`
     * (default 500).
     *
     * Relies on each permission entity having `TrackRecordChanges=1` in its
     * Entity metadata row. Domains whose backing entities do not track changes
     * contribute nothing to the timeline.
     */
    GetAuditTimeline(filter?: PermissionAuditFilter): Promise<PermissionAuditEntry[]>;
    /**
     * Map a domain-name filter to the set of backing entity names to query.
     * When no filter is given, every known permission entity is included.
     */
    private resolveAuditEntityNames;
    /**
     * Reverse lookup: given a backing entity name, return the owning domain.
     * Falls back to the entity name itself when we can't resolve (e.g., a
     * caller added a new permission entity to the map but no provider yet).
     */
    private resolveDomainForEntity;
}
//# sourceMappingURL=PermissionEngine.d.ts.map