import * as _alepha_core1 from "alepha";
import * as _alepha_core0 from "alepha";
import { Alepha } from "alepha";
import { JwtProvider, Permission, SecurityProvider, UserAccountToken } from "alepha/security";
import { FetchOptions } from "alepha/server";

//#region src/providers/ServerSecurityProvider.d.ts
declare class ServerSecurityProvider {
  protected readonly log: _alepha_core1.Logger;
  protected readonly securityProvider: SecurityProvider;
  protected readonly jwtProvider: JwtProvider;
  protected readonly alepha: Alepha;
  protected readonly onConfigure: _alepha_core1.HookDescriptor<"configure">;
  protected readonly onActionRequest: _alepha_core1.HookDescriptor<"action:onRequest">;
  protected readonly onRequest: _alepha_core1.HookDescriptor<"server:onRequest">;
  /**
   * Get the user account token for a local action call.
   * There are three possible sources for the user:
   * - `options.user`: the user passed in the options
   * - `"system"`: the system user from the state (you MUST set state `server.security.system.user`)
   * - `"context"`: the user from the request context (you MUST be in an HTTP request context)
   *
   * Priority order: `options.user` > `"system"` > `"context"`.
   *
   * In testing environment, if no user is provided, a test user is created based on the SecurityProvider's roles.
   */
  protected createUserFromLocalFunctionContext(options: {
    user?: UserAccountToken | "system" | "context";
  }, permission?: Permission): UserAccountToken;
  protected createTestUser(): UserAccountToken;
  protected readonly onClientRequest: _alepha_core1.HookDescriptor<"client:onRequest">;
}
type ServerRouteSecure = boolean | {
  permissions?: string[];
  roles?: string[];
  realms?: string[];
  organizations?: string[];
};
//# sourceMappingURL=ServerSecurityProvider.d.ts.map
//#endregion
//#region src/index.d.ts
declare module "alepha" {
  interface State {
    /**
     * Real (or fake) user account, used for internal actions.
     *
     * If you define this, you assume that all actions are executed by this user by default.
     * > To force a different user, you need to pass it explicitly in the options.
     */
    "server.security.system.user"?: UserAccountToken;
  }
}
declare module "alepha/server" {
  interface ServerRequest<TConfig> {
    user?: UserAccountToken;
  }
  interface ServerActionRequest<TConfig> {
    user: UserAccountToken;
  }
  interface ServerRoute {
    /**
     * If true, the route will be protected by the security provider.
     * All actions are secure by default, but you can disable it for specific actions.
     */
    secure?: boolean;
  }
  interface ClientRequestOptions extends FetchOptions {
    /**
     * Forward user from the previous request.
     * If "system", use system user. @see {ServerSecurityProvider.localSystemUser}
     * If "context", use the user from the current context (e.g. request).
     *
     * @default "system" is provided, else "context" is used.
     */
    user?: UserAccountToken | "system" | "context";
  }
}
/**
 * Plugin for Alepha Server that provides security features. Based on the Alepha Security module.
 *
 * By default, all $action will be guarded by a permission check.
 *
 * @see {@link ServerSecurityProvider}
 * @module alepha.server.security
 */
declare const AlephaServerSecurity: _alepha_core0.Service<_alepha_core0.Module>;
//# sourceMappingURL=index.d.ts.map
//#endregion
export { AlephaServerSecurity, ServerRouteSecure, ServerSecurityProvider };
//# sourceMappingURL=index.d.ts.map