import express from 'express';
import { AuthorizeResult, DefinitivePolicyDecision, IdentifiedPermissionMessage, MetadataResponse as CommonMetadataResponse, MetadataResponseSerializedRule as CommonMetadataResponseSerializedRule, Permission, PermissionCondition, PermissionCriteria, PolicyDecision } from '@backstage/plugin-permission-common';
import { PermissionRule, PermissionRuleset } from '../types';
import { NoInfer } from './util';
import { PermissionResourceRef } from './createPermissionResourceRef';
/**
 * A request to load the referenced resource and apply conditions in order to
 * finalize a conditional authorization response.
 *
 * @public
 */
export type ApplyConditionsRequestEntry = IdentifiedPermissionMessage<{
    resourceRef: string | string[];
    resourceType: string;
    conditions: PermissionCriteria<PermissionCondition>;
}>;
/**
 * A batch of {@link ApplyConditionsRequestEntry} objects.
 *
 * @public
 */
export type ApplyConditionsRequest = {
    items: ApplyConditionsRequestEntry[];
};
/**
 * The result of applying the conditions, expressed as a definitive authorize
 * result of ALLOW or DENY.
 *
 * @public
 */
export type ApplyConditionsResponseEntry = IdentifiedPermissionMessage<DefinitivePolicyDecision | {
    result: Array<AuthorizeResult.ALLOW | AuthorizeResult.DENY>;
}>;
/**
 * A batch of {@link ApplyConditionsResponseEntry} objects.
 *
 * @public
 */
export type ApplyConditionsResponse = {
    items: ApplyConditionsResponseEntry[];
};
/**
 * Serialized permission rules, with the paramsSchema
 * converted from a ZodSchema to a JsonSchema.
 *
 * @public
 * @deprecated Please import from `@backstage/plugin-permission-common` instead.
 */
export type MetadataResponseSerializedRule = CommonMetadataResponseSerializedRule;
/**
 * Response type for the .metadata endpoint.
 *
 * @public
 * @deprecated Please import from `@backstage/plugin-permission-common` instead.
 */
export type MetadataResponse = CommonMetadataResponse;
/**
 * Takes some permission conditions and returns a definitive authorization result
 * on the resource to which they apply.
 *
 * @public
 */
export declare function createConditionAuthorizer<TResource>(permissionRuleset: PermissionRuleset<TResource>): (decision: PolicyDecision, resource: TResource | undefined) => boolean;
/**
 * @public
 * @deprecated Use the version of `createConditionAuthorizer` that accepts a `PermissionRuleset` instead.
 */
export declare function createConditionAuthorizer<TResource, TQuery>(rules: PermissionRule<TResource, TQuery, string>[]): (decision: PolicyDecision, resource: TResource | undefined) => boolean;
/**
 * Options for creating a permission integration router specific
 * for a particular resource type.
 *
 * @public
 * @deprecated {@link createPermissionIntegrationRouter} is deprecated
 */
export type CreatePermissionIntegrationRouterResourceOptions<TResourceType extends string, TResource> = {
    resourceType: TResourceType;
    permissions?: Array<Permission>;
    rules: PermissionRule<TResource, any, NoInfer<TResourceType>>[];
    getResources?: (resourceRefs: string[]) => Promise<Array<TResource | undefined>>;
};
/**
 * Options for creating a permission integration router exposing
 * permissions and rules from multiple resource types.
 *
 * @public
 * @deprecated {@link createPermissionIntegrationRouter} is deprecated
 */
export type PermissionIntegrationRouterOptions<TResourceType1 extends string = string, TResource1 = any, TResourceType2 extends string = string, TResource2 = any, TResourceType3 extends string = string, TResource3 = any> = {
    resources: Readonly<[
        CreatePermissionIntegrationRouterResourceOptions<TResourceType1, TResource1>
    ] | [
        CreatePermissionIntegrationRouterResourceOptions<TResourceType1, TResource1>,
        CreatePermissionIntegrationRouterResourceOptions<TResourceType2, TResource2>
    ] | [
        CreatePermissionIntegrationRouterResourceOptions<TResourceType1, TResource1>,
        CreatePermissionIntegrationRouterResourceOptions<TResourceType2, TResource2>,
        CreatePermissionIntegrationRouterResourceOptions<TResourceType3, TResource3>
    ]>;
};
/**
 * Create an express Router which provides an authorization route to allow
 * integration between the permission backend and other Backstage backend
 * plugins. Plugin owners that wish to support conditional authorization for
 * their resources should add the router created by this function to their
 * express app inside their `createRouter` implementation.
 *
 * In case the `permissions` option is provided, the router also
 * provides a route that exposes permissions and routes of a plugin.
 *
 * In case resources is provided, the routes can handle permissions
 * for multiple resource types.
 *
 * @remarks
 *
 * To make this concrete, we can use the Backstage software catalog as an
 * example. The catalog has conditional rules around access to specific
 * _entities_ in the catalog. The _type_ of resource is captured here as
 * `resourceType`, a string identifier (`catalog-entity` in this example) that
 * can be provided with permission definitions. This is merely a _type_ to
 * verify that conditions in an authorization policy are constructed correctly,
 * not a reference to a specific resource.
 *
 * The `rules` parameter is an array of {@link PermissionRule}s that introduce
 * conditional filtering logic for resources; for the catalog, these are things
 * like `isEntityOwner` or `hasAnnotation`. Rules describe how to filter a list
 * of resources, and the `conditions` returned allow these rules to be applied
 * with specific parameters (such as 'group:default/team-a', or
 * 'backstage.io/edit-url').
 *
 * The `getResources` argument should load resources based on a reference
 * identifier. For the catalog, this is an
 * {@link @backstage/catalog-model#EntityRef}. For other plugins, this can be
 * any serialized format. This is used to construct the
 * `createPermissionIntegrationRouter`, a function to add an authorization route
 * to your backend plugin. This function will be called by the
 * `permission-backend` when authorization conditions relating to this plugin
 * need to be evaluated.
 *
 * @public
 * @deprecated use `PermissionRegistryService` instead, see {@link https://backstage.io/docs/backend-system/core-services/permissions-registry#migrating-from-createpermissionintegrationrouter | the migration section in the service docs} for more details.
 */
export declare function createPermissionIntegrationRouter<TResourceType1 extends string, TResource1, TResourceType2 extends string, TResource2, TResourceType3 extends string, TResource3>(options?: {
    permissions: Array<Permission>;
} | CreatePermissionIntegrationRouterResourceOptions<TResourceType1, TResource1> | PermissionIntegrationRouterOptions<TResourceType1, TResource1, TResourceType2, TResource2, TResourceType3, TResource3>): express.Router & {
    addPermissions(permissions: Permission[]): void;
    addPermissionRules(rules: PermissionRule<unknown, unknown, string>[]): void;
    addResourceType<const TResourceType extends string, TResource>(resource: CreatePermissionIntegrationRouterResourceOptions<TResourceType, TResource>): void;
    getPermissionRuleset<TResource, TQuery, TResourceType extends string>(resourceRef: PermissionResourceRef<TResource, TQuery, TResourceType>): PermissionRuleset<TResource, TQuery, TResourceType>;
};
