/**
 * Permission Enforcer
 *
 * Validates sync operations against configured permissions before execution.
 * Uses the existing SyncSettings from config.json (set during specweave init).
 * Logs all permission decisions for audit.
 *
 * IMPORTANT: This integrates with the existing sync.settings configuration:
 * - canUpsertInternalItems: CREATE/UPDATE internal items in external tools
 * - canUpdateExternalItems: UPDATE items created externally
 * - canUpdateStatus: UPDATE status field for both internal and external items
 *
 * @module core/sync/permission-enforcer
 */
import { SyncSettings } from '../types/sync-settings.js';
import { SyncPlatform } from '../types/sync-config.js';
import { Logger } from '../../utils/logger.js';
/**
 * Sync operation types
 *
 * Maps to existing SyncSettings:
 * - 'read' → always allowed (reading is safe)
 * - 'update-status' → canUpdateStatus
 * - 'upsert-internal' → canUpsertInternalItems
 * - 'upsert-external' → canUpdateExternalItems
 */
export type SyncOperation = 'read' | 'update-status' | 'upsert-internal' | 'upsert-external';
/**
 * Item origin - where the item was created
 */
export type ItemOrigin = 'internal' | 'external';
/**
 * Permission check result
 */
export interface PermissionResult {
    /**
     * Whether the operation is allowed
     */
    allowed: boolean;
    /**
     * Reason for the decision
     */
    reason: string;
    /**
     * Platform checked
     */
    platform: SyncPlatform;
    /**
     * Operation attempted
     */
    operation: SyncOperation;
    /**
     * Item ID involved
     */
    itemId: string;
    /**
     * Item origin
     */
    origin: ItemOrigin;
    /**
     * ISO timestamp of the check
     */
    timestamp: string;
}
/**
 * Permission enforcer options
 */
export interface PermissionEnforcerOptions {
    /**
     * SyncSettings from config.json (set during specweave init)
     * If not provided, uses defaults (all permissions disabled)
     */
    settings?: SyncSettings;
    /**
     * Path to .specweave directory for logging
     */
    specweavePath?: string;
    /**
     * Logger instance
     */
    logger?: Logger;
    /**
     * Enable decision logging to file
     * @default true
     */
    enableLogging?: boolean;
}
/**
 * PermissionEnforcer - Validates sync operations before execution
 *
 * Uses the existing SyncSettings from config.json that are configured during
 * `specweave init`. This ensures consistency with user's sync preferences.
 *
 * Features:
 * - Check permissions before any sync operation
 * - Differentiate between internal and external items
 * - Log all decisions for audit
 */
export declare class PermissionEnforcer {
    private settings;
    private readonly logPath;
    private readonly logger;
    private readonly enableLogging;
    constructor(options?: PermissionEnforcerOptions);
    /**
     * Check if an operation is permitted for an item
     */
    checkPermission(platform: SyncPlatform, operation: SyncOperation, itemId: string, origin?: ItemOrigin): PermissionResult;
    /**
     * Check permission and log the decision
     *
     * @param platform - Target platform
     * @param operation - Operation to perform
     * @param itemId - Item ID being operated on
     * @param origin - Whether item is internal or external
     * @returns Permission result
     */
    checkAndLog(platform: SyncPlatform, operation: SyncOperation, itemId: string, origin?: ItemOrigin): Promise<PermissionResult>;
    /**
     * Convenience method: Check if upsert is allowed
     *
     * Automatically determines origin from itemId (ends with 'E' = external)
     *
     * @param platform - Target platform
     * @param itemId - Item ID (e.g., "FS-001" or "FS-001E")
     * @returns Permission result
     */
    checkUpsertPermission(platform: SyncPlatform, itemId: string): PermissionResult;
    /**
     * Convenience method: Check if status update is allowed
     *
     * @param platform - Target platform
     * @param itemId - Item ID
     * @returns Permission result
     */
    checkStatusUpdatePermission(platform: SyncPlatform, itemId: string): PermissionResult;
    /**
     * Update settings at runtime
     *
     * @param settings - New sync settings (partial update supported)
     */
    updateSettings(settings: Partial<SyncSettings>): void;
    /**
     * Get current settings
     *
     * @returns Current sync settings
     */
    getSettings(): SyncSettings;
    /**
     * Check if sync is enabled for any operation
     *
     * @returns true if any sync operation is enabled
     */
    isSyncEnabled(): boolean;
    /**
     * Get a human-readable summary of current permissions
     */
    getPermissionsSummary(): {
        canCreateInternal: boolean;
        canUpdateExternal: boolean;
        canUpdateStatus: boolean;
        summary: string;
    };
    /**
     * Detect item origin from ID
     *
     * External items have 'E' suffix (e.g., FS-001E)
     */
    private detectOrigin;
    /**
     * Check if operation is allowed by current settings
     */
    private isOperationAllowed;
    /**
     * Get denial reason for logging
     */
    private getDenialReason;
    /**
     * Log permission decision to file
     */
    logDecision(result: PermissionResult): Promise<void>;
    /**
     * Get log file path (for testing/debugging)
     */
    getLogPath(): string;
}
/**
 * Create a PermissionEnforcer from config.json
 *
 * Reads the existing sync.settings from config.json that was set during
 * `specweave init` and creates a PermissionEnforcer with those settings.
 *
 * @param specweavePath - Path to .specweave directory
 * @param logger - Optional logger
 * @returns PermissionEnforcer instance
 */
export declare function createPermissionEnforcerFromConfig(specweavePath?: string, logger?: Logger): Promise<PermissionEnforcer>;
//# sourceMappingURL=permission-enforcer.d.ts.map