import type { DB } from '../../data/db/index.js';
export type Scope = 'own' | 'team' | 'territory' | 'tenant';
export interface RbacConfig {
    readonly database: string;
    readonly scopes?: readonly string[];
    readonly cacheTtlMs?: number;
    readonly table?: {
        readonly permissions?: string;
        readonly roles?: string;
        readonly rolePermissions?: string;
        readonly userRoles?: string;
    };
}
export interface ResolvedPermission {
    readonly resource: string;
    readonly action: string;
    readonly scope: string;
}
export interface PermissionSet {
    readonly userId: string;
    readonly tenantId: string;
    readonly authVersion: number;
    readonly permissions: readonly ResolvedPermission[];
}
export interface SeedPermission {
    readonly resource: string;
    readonly action: string;
}
export interface SeedRolePermission {
    readonly resource: string;
    readonly action: string;
    readonly scope: string;
}
export interface SeedRole {
    readonly name: string;
    readonly tenantId: string;
    readonly description?: string;
    readonly permissions: readonly SeedRolePermission[];
}
export interface SeedUserRole {
    readonly userId: string;
    readonly roleName: string;
    readonly tenantId: string;
}
export interface SeedData {
    readonly permissions: readonly SeedPermission[];
    readonly roles: readonly SeedRole[];
    readonly userRoles?: readonly SeedUserRole[];
}
export interface Rbac {
    resolve(db: DB, userId: string, tenantId: string, authVersion: number): Promise<PermissionSet>;
    check(permissions: PermissionSet, resource: string, action: string, requiredScope?: string): boolean;
    invalidate(userId: string, tenantId: string): void;
    seed(db: DB, data: SeedData): Promise<void>;
}
//# sourceMappingURL=types.d.ts.map