import { BaseController, Ok } from '@spinajs/http';
import { User } from '@spinajs/rbac';
import { RoleGuard } from '../../interfaces.js';
import '../../services/RoleGuard.js';
export declare class RoleDto {
    role: string;
    constructor(data: Partial<RoleDto>);
}
/**
 * User role management (admin).
 * Grants and revokes RBAC roles for user accounts.
 *
 * Both routes run the configured {@link RoleGuard} before touching anything: a
 * role is the one thing in this API that can grant MORE than the caller has, so
 * "may update users" is not by itself an answer to "may hand out this role".
 * @tags Admin Users
 */
export declare class Roles extends BaseController {
    protected RoleGuard: RoleGuard;
    /**
     * Grant role to user (admin)
     * Assigns the specified RBAC role to the user identified by login name.
     * @security cookieAuth
     * @param login User login name
     * @response 200 Role granted successfully
     * @response 400 Unknown role name
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required, or the role grants more than the caller holds
     * @response 404 User not found
     */
    addRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
    /**
     * Revoke role from user (admin)
     * Removes the specified RBAC role from the user identified by login name.
     * @security cookieAuth
     * @param login User login name
     * @response 200 Role revoked successfully
     * @response 400 Unknown role name
     * @response 401 Unauthorized — valid session required
     * @response 403 Forbidden — updateAny permission required, or the revocation would lock the caller or the installation out
     * @response 404 User not found
     */
    revokeRole(actor: User, user: User, roleDto: RoleDto): Promise<Ok<any>>;
}
//# sourceMappingURL=Roles.d.ts.map