/**
 * AI Model Access Policy Manager
 * Controls access to AI models based on roles, departments, and security requirements
 * Vorion Security Platform
 */
import { EventEmitter } from 'events';
import { ModelAccessPolicy, DataClassification, AuditLevel } from './types';
/**
 * Access request context
 */
export interface AccessRequestContext {
    userId: string;
    modelId: string;
    roles: string[];
    department: string;
    mfaVerified: boolean;
    ipAddress: string;
    timestamp: Date;
    queryDataClassification?: DataClassification;
    requestedOperation?: string;
    geolocation?: {
        country: string;
        region?: string;
    };
}
/**
 * Access decision result
 */
export interface AccessDecision {
    allowed: boolean;
    reason: string;
    policy?: ModelAccessPolicy;
    violations: PolicyViolation[];
    auditLevel: AuditLevel;
    restrictions: AccessRestriction[];
    expiresAt?: Date;
}
/**
 * Policy violation details
 */
export interface PolicyViolation {
    type: PolicyViolationType;
    message: string;
    severity: 'warning' | 'error' | 'critical';
    policyField: string;
}
/**
 * Policy violation types
 */
export type PolicyViolationType = 'role-not-allowed' | 'department-not-allowed' | 'mfa-required' | 'rate-limit-exceeded' | 'data-classification-exceeded' | 'time-restricted' | 'ip-blocked' | 'ip-not-whitelisted' | 'operation-denied' | 'approval-required' | 'policy-expired' | 'geographic-restricted' | 'token-limit-exceeded' | 'cost-limit-exceeded';
/**
 * Access restriction
 */
export interface AccessRestriction {
    type: string;
    value: unknown;
    description: string;
}
/**
 * Policy storage interface
 */
export interface PolicyStorage {
    save(policy: ModelAccessPolicy): Promise<void>;
    get(modelId: string): Promise<ModelAccessPolicy | null>;
    delete(modelId: string): Promise<void>;
    list(): Promise<ModelAccessPolicy[]>;
    getByRole(role: string): Promise<ModelAccessPolicy[]>;
    getByDepartment(department: string): Promise<ModelAccessPolicy[]>;
}
/**
 * In-memory policy storage implementation
 */
export declare class InMemoryPolicyStorage implements PolicyStorage {
    private policies;
    save(policy: ModelAccessPolicy): Promise<void>;
    get(modelId: string): Promise<ModelAccessPolicy | null>;
    delete(modelId: string): Promise<void>;
    list(): Promise<ModelAccessPolicy[]>;
    getByRole(role: string): Promise<ModelAccessPolicy[]>;
    getByDepartment(department: string): Promise<ModelAccessPolicy[]>;
}
/**
 * Usage tracking for rate limiting
 */
export interface UsageTracker {
    getQueriesInLastHour(userId: string, modelId: string): Promise<number>;
    getTokensUsedToday(userId: string, modelId: string): Promise<number>;
    getCostToday(userId: string, modelId: string): Promise<number>;
    recordQuery(userId: string, modelId: string): Promise<void>;
}
/**
 * In-memory usage tracker implementation
 */
export declare class InMemoryUsageTracker implements UsageTracker {
    private queries;
    private tokens;
    private costs;
    private getKey;
    getQueriesInLastHour(userId: string, modelId: string): Promise<number>;
    getTokensUsedToday(userId: string, modelId: string): Promise<number>;
    getCostToday(userId: string, modelId: string): Promise<number>;
    recordQuery(userId: string, modelId: string): Promise<void>;
    recordTokens(userId: string, modelId: string, tokens: number): Promise<void>;
    recordCost(userId: string, modelId: string, cost: number): Promise<void>;
}
/**
 * Access Policy Manager
 * Evaluates and enforces access policies for AI models
 */
export declare class AccessPolicyManager extends EventEmitter {
    private storage;
    private usageTracker;
    private dataClassificationHierarchy;
    constructor(storage?: PolicyStorage, usageTracker?: UsageTracker);
    /**
     * Create a new access policy
     */
    createPolicy(policy: ModelAccessPolicy): Promise<ModelAccessPolicy>;
    /**
     * Update an existing policy
     */
    updatePolicy(modelId: string, updates: Partial<Omit<ModelAccessPolicy, 'modelId'>>): Promise<ModelAccessPolicy>;
    /**
     * Get a policy by model ID
     */
    getPolicy(modelId: string): Promise<ModelAccessPolicy | null>;
    /**
     * Delete a policy
     */
    deletePolicy(modelId: string): Promise<void>;
    /**
     * List all policies
     */
    listPolicies(): Promise<ModelAccessPolicy[]>;
    /**
     * Check if access is allowed
     */
    checkAccess(context: AccessRequestContext): Promise<AccessDecision>;
    /**
     * Record a successful access
     */
    recordAccess(userId: string, modelId: string): Promise<void>;
    /**
     * Validate policy configuration
     */
    private validatePolicy;
    /**
     * Check if current time is within allowed time restrictions
     */
    private checkTimeRestrictions;
    /**
     * Check if IP is in a list (supports CIDR notation)
     */
    private isIPAllowed;
    /**
     * Check if IP is within a CIDR range
     */
    private isIPInCIDR;
    /**
     * Convert IP address to long integer
     */
    private ipToLong;
    /**
     * Create a default restrictive policy
     */
    createDefaultPolicy(modelId: string): ModelAccessPolicy;
    /**
     * Get policies for a specific role
     */
    getPoliciesForRole(role: string): Promise<ModelAccessPolicy[]>;
    /**
     * Get policies for a specific department
     */
    getPoliciesForDepartment(department: string): Promise<ModelAccessPolicy[]>;
    /**
     * Bulk update policies
     */
    bulkUpdate(modelIds: string[], updates: Partial<Omit<ModelAccessPolicy, 'modelId'>>): Promise<ModelAccessPolicy[]>;
    /**
     * Export policies for backup/audit
     */
    exportPolicies(): Promise<{
        exportedAt: Date;
        policyCount: number;
        policies: ModelAccessPolicy[];
    }>;
    /**
     * Import policies from backup
     */
    importPolicies(policies: ModelAccessPolicy[], overwrite?: boolean): Promise<{
        imported: number;
        skipped: number;
        errors: string[];
    }>;
}
export default AccessPolicyManager;
//# sourceMappingURL=access-policy.d.ts.map