/**
 * Multi-tenant data separation framework.
 *
 * Provides factory functions that create Express middleware and provider hooks
 * based on the `multiTenancy` section of mj.config.cjs. All functions return
 * standard hook/middleware types from WS2 so they integrate seamlessly with
 * the MJServer extensibility system.
 */
import type { RequestHandler } from 'express';
import type { PreRunViewHook, PreSaveHook } from '@memberjunction/core';
import { type UserInfo, type TenantContext } from '@memberjunction/core';
import type { MultiTenancyConfig } from '../config.js';
/** Custom tenant context extractor signature */
export type TenantContextExtractor = (user: UserInfo, req: Express.Request) => Promise<{
    TenantID: string;
} | null>;
/**
 * Creates Express middleware that resolves and attaches TenantContext
 * to the authenticated user's UserInfo for each request.
 *
 * This middleware runs in the post-auth slot (after `createUnifiedAuthMiddleware`)
 * so `req.userPayload` is available. It reads the tenant ID from the configured
 * source and attaches it directly to `userPayload.userRecord.TenantContext`.
 *
 * By the time GraphQL resolvers or REST handlers run, the contextUser already
 * has TenantContext set — no deferred pickup via `req['__mj_tenantId']` needed.
 */
export declare function createTenantMiddleware(config: MultiTenancyConfig): RequestHandler;
/**
 * Attaches TenantContext to a UserInfo object.
 * Called from the GraphQL context function after authentication.
 */
export declare function attachTenantContext(user: UserInfo, tenantId: string, source: TenantContext['Source']): void;
/**
 * Creates a PreRunViewHook that auto-injects tenant WHERE clauses
 * into RunView queries for scoped entities.
 */
export declare function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunViewHook;
/**
 * Creates a PreSaveHook that validates the tenant column on writes.
 *
 * In 'strict' mode, rejects saves where the tenant column value doesn't
 * match the user's TenantContext. In 'log' mode, warns but allows. In
 * 'off' mode, this hook is a no-op.
 */
export declare function createTenantPreSaveHook(config: MultiTenancyConfig): PreSaveHook;
//# sourceMappingURL=index.d.ts.map