import { IApiBaseEntity } from '../../../../interface/api-base-entity.interface';
import { IApiAuthorizationPolicySubscriberPermissionRuleOptions, IApiAuthorizationPolicySubscriberRule } from '../../../../interface/class/api/authorization/policy/subscriber';
import { TApiAuthorizationPolicySubscriberPermissionRuleOptionsWithoutTransform, TApiAuthorizationPolicySubscriberRuleWithoutEffectWithoutTransform, TApiAuthorizationPolicySubscriberRuleWithoutTransform } from '../../../../type/class/api/authorization/policy/subscriber';
import { ApiSubscriberBase } from '../../subscriber/base.class';
/**
 * Base class for all authorization policies. It mirrors ApiFunctionSubscriberBase
 * and provides helper methods to create allow/deny rules that are later executed by the policy executor.
 * @template E - Entity type extending IApiBaseEntity
 */
export declare abstract class ApiAuthorizationPolicyBase<E extends IApiBaseEntity> extends ApiSubscriberBase {
    /**
     * Creates an ALLOW rule with optional overrides.
     * @param {Omit<IApiAuthorizationPolicySubscriberRule<E>, "effect">} [rule] - Rule fields to merge.
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Allow rule array.
     */
    protected allow(rule?: TApiAuthorizationPolicySubscriberRuleWithoutEffectWithoutTransform<E>): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected allow<R>(rule: Omit<IApiAuthorizationPolicySubscriberRule<E, R>, "effect">): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
    /**
     * Helper that creates an allow rule conditioned on the principal having the required permissions.
     * Granted permissions may use `*` or `<prefix>.*` wildcards.
     * @template R - Rule result type.
     * @param {Array<string>} requiredPermissions - Permissions that grant access.
     * @param {IApiAuthorizationPolicySubscriberPermissionRuleOptions<E, R>} [options] - Optional rule overrides.
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Allow rule array targeting the given permissions.
     */
    protected allowForPermissions(requiredPermissions: Array<string>, options?: TApiAuthorizationPolicySubscriberPermissionRuleOptionsWithoutTransform<E>): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected allowForPermissions<R>(requiredPermissions: Array<string>, options: IApiAuthorizationPolicySubscriberPermissionRuleOptions<E, R>): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
    /**
     * Helper that creates an allow rule conditioned on the principal having at least one of the provided roles.
     * @param {Array<string>} roles - Roles that grant access.
     * @param {Omit<IApiAuthorizationPolicySubscriberRule<E>, "effect">} [rule] - Optional overrides.
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Allow rule array targeting the given roles.
     */
    protected allowForRoles(roles: Array<string>, rule?: TApiAuthorizationPolicySubscriberRuleWithoutEffectWithoutTransform<E>): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected allowForRoles<R>(roles: Array<string>, rule: Omit<IApiAuthorizationPolicySubscriberRule<E, R>, "effect">): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
    /**
     * Creates a DENY rule with optional overrides.
     * @param {Omit<IApiAuthorizationPolicySubscriberRule<E>, "effect">} [rule] - Rule fields to merge.
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Deny rule array.
     */
    protected deny(rule?: TApiAuthorizationPolicySubscriberRuleWithoutEffectWithoutTransform<E>): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected deny<R>(rule: Omit<IApiAuthorizationPolicySubscriberRule<E, R>, "effect">): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
    /**
     * Helper that creates a deny rule conditioned on the principal having the required permissions.
     * Granted permissions may use `*` or `<prefix>.*` wildcards.
     * @template R - Rule result type.
     * @param {Array<string>} requiredPermissions - Permissions that trigger access denial.
     * @param {IApiAuthorizationPolicySubscriberPermissionRuleOptions<E, R>} [options] - Optional rule overrides.
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Deny rule array targeting the given permissions.
     */
    protected denyForPermissions(requiredPermissions: Array<string>, options?: TApiAuthorizationPolicySubscriberPermissionRuleOptionsWithoutTransform<E>): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected denyForPermissions<R>(requiredPermissions: Array<string>, options: IApiAuthorizationPolicySubscriberPermissionRuleOptions<E, R>): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
    /**
     * Helper that scopes data access to the owner identified by a field.
     * Automatically resolves relation vs scalar fields by default.
     * @param {keyof E} [ownerField] - Entity field used to match the principal id, defaults to ownerId.
     * @param {Omit<IApiAuthorizationPolicySubscriberRule<E>, "effect">} [rule] - Optional overrides.
     * @param {{ isRelation?: boolean }} [options] - Override relation handling; defaults to auto.
     * @param {boolean} [options.isRelation] - Whether the field is a relation (defaults to auto).
     * @returns {Array<IApiAuthorizationPolicySubscriberRule<E>>} Allow rule array with owner scope.
     */
    protected scopeToOwner(ownerField?: keyof E, rule?: TApiAuthorizationPolicySubscriberRuleWithoutEffectWithoutTransform<E>, options?: {
        isRelation?: boolean;
    }): Array<TApiAuthorizationPolicySubscriberRuleWithoutTransform<E>>;
    protected scopeToOwner<R>(ownerField: keyof E | undefined, rule: Omit<IApiAuthorizationPolicySubscriberRule<E, R>, "effect">, options?: {
        isRelation?: boolean;
    }): Array<IApiAuthorizationPolicySubscriberRule<E, R>>;
}