/**
 * @license
 * Copyright 2022-2026 Matter.js Authors
 * SPDX-License-Identifier: Apache-2.0
 */
import { AccessLevel, DataModelPath, Schema } from "@matter/model";
import { ClusterId, EndpointNumber, FabricIndex } from "@matter/types";
import { Subject } from "./Subject.js";
/**
 * Confirm that an access control session (or some variante thereof) is a {@link AccessControl.RemoteActorSession}.
 */
export declare function hasRemoteActor<T extends undefined | AccessControl.Session>(session: T): session is Exclude<T, undefined | {
    subject?: undefined;
}>;
/**
 * Throws if a session is not a {@link AccessControl.RemoteActorSession}.
 */
export declare function assertRemoteActor<T extends undefined | AccessControl.Session>(session: T): asserts session is Exclude<T, undefined | {
    subject?: undefined;
}>;
/**
 * Confirm that an access control session (or some variante thereof) is a {@link AccessControl.LocalActorSession}.
 */
export declare function hasLocalActor<T extends undefined | AccessControl.Session>(session: T): session is Exclude<T, {
    subject: Subject;
}>;
/**
 * Enforces access control for a specific schema.
 */
export interface AccessControl {
    /**
     * Operational access control metadata.
     */
    limits: AccessControl.Limits;
    /**
     * Assert read is authorized.
     */
    authorizeRead: AccessControl.Assertion;
    /**
     * Determine if read is authorized.
     */
    mayRead: AccessControl.Verification;
    /**
     * Assert write is authorized.
     */
    authorizeWrite: AccessControl.Assertion;
    /**
     * Determine if write is authorized.
     */
    mayWrite: AccessControl.Verification;
    /**
     * Assert invoke is authorized.
     */
    authorizeInvoke: AccessControl.Assertion;
    /**
     * Determine if invoke is authorized.
     */
    mayInvoke: AccessControl.Verification;
}
/**
 * Obtain an enforcer for specific schema.
 *
 * This is central to security.  Implementation is explicit, all objects are involved are frozen and cache is stored as
 * module-private.
 *
 * Pure function; returned value is cached.
 */
export declare function AccessControl(schema: Schema): AccessControl;
export declare namespace AccessControl {
    /**
     * Operational access control metadata for a schema.
     */
    interface Limits {
        readonly readable: boolean;
        readonly readLevel: AccessLevel;
        readonly writable: boolean;
        readonly writeLevel: AccessLevel;
        readonly fabricScoped: boolean;
        readonly fabricSensitive: boolean;
        readonly timed: boolean;
        readonly largeMessage: boolean;
    }
    /**
     * A function that asserts access control requirements are met.
     *
     * If {@link session} is undefined the function does not enforce access controls.
     */
    type Assertion = (session: Session | undefined, location: Location) => void;
    /**
     * A function that returns true if access control requirements are met.
     *
     * If {@link session} is undefined the function does not enforce access controls.
     */
    type Verification = (session: Session | undefined, location: Location) => boolean;
    /**
     * Metadata that varies with position in the data model.
     */
    interface Location {
        /**
         * The diagnostic path to the location.
         */
        path: DataModelPath;
        /**
         * The owning endpoint.
         */
        endpoint?: EndpointNumber;
        /**
         * The owning behavior.
         */
        cluster?: ClusterId;
        /**
         * The fabric that owns the data subtree.  Undefined or {@link FabricIndex.NO_FABRIC} disables fabric
         * enforcement.
         */
        owningFabric?: FabricIndex;
    }
    /**
     * Authorization metadata that varies by remote actor.
     */
    interface RemoteActorSession {
        /**
         * Determine whether authorized client has authority at a specific location.
         */
        authorityAt(desiredAccessLevel: AccessLevel, location?: Location): Authority;
        /**
         * The fabric of the authorized client.
         *
         * For PASE sessions this will be {@link FabricIndex.NO_FABRIC}.
         */
        readonly fabric: FabricIndex;
        /**
         * The authenticated remote actor. This includes the relevant Node Id, Group ID and also potential relevant Case
         * Authenticated Tags.
         */
        readonly subject: Subject;
        /**
         * If this is true, fabric-scoped lists are filtered to the accessing fabric.
         */
        readonly fabricFiltered?: boolean;
        /**
         * If this is true a timed transaction is in effect.
         */
        readonly timed?: boolean;
        /**
         * If this is true then data access levels are not enforced.  Datatypes and command-related access controls are
         * active.
         */
        readonly command?: boolean;
        /**
         * If this is true the data transfer supports large messages.
         */
        readonly largeMessage?: boolean;
    }
    /**
     * A local actor session has no authenticated subject and access controls are bypassed.
     */
    type LocalActorSession = {
        fabric?: undefined;
        subject?: undefined;
    };
    /**
     * The accessing session.
     */
    type Session = LocalActorSession | RemoteActorSession;
    /**
     * Authority status.
     */
    enum Authority {
        /**
         * Authority is granted.
         */
        Granted = 1,
        /**
         * Insufficient privileges.
         */
        Unauthorized = 2,
        /**
         * Feature is restricted.
         */
        Restricted = 3
    }
}
//# sourceMappingURL=AccessControl.d.ts.map