import { AuthUser } from '@datatechsolutions/windsock/client';

/**
 * Generic role-based access factory shared across platform apps (astrlabe,
 * kori-erp, etc). Each app instantiates this with its own role + permission
 * unions and seed-claim mapping. The factory closes over the config and
 * exports `ROLE_DEFINITIONS`, `MODULE_PERMISSIONS`, `normalizePlatformRole`,
 * and `can()` — the same surface the per-app file used to expose.
 *
 * The factory deliberately does not hardcode any specific role enum here —
 * astrlabe, kori-erp, and future apps each pick their own union (admin,
 * manager, analyst, viewer, …) and pass the role definitions in.
 */
type PlatformRoleDefinition<TRole extends string> = {
    id: TRole;
    label: string;
    description: string;
};
type CreatePlatformRbacOptions<TRole extends string, TPermission extends string> = {
    /** Definitions for every role the app supports (id/label/description). */
    roles: Record<TRole, PlatformRoleDefinition<TRole>>;
    /**
     * Maps each app-level permission to one or more JWT permission claim
     * strings. `can()` returns true when ANY of the listed claims (using
     * wildcard matching) is present in the user's JWT permissions.
     */
    permissionClaimsMap: Record<TPermission, readonly string[]>;
    /** Optional map from navigation/module IDs to required permissions. */
    modulePermissions?: Record<string, TPermission>;
    /** Role to fall back to when an unknown role string comes in. */
    defaultRole?: TRole;
};
type PlatformRbac<TRole extends string, TPermission extends string> = {
    ROLE_DEFINITIONS: Record<TRole, PlatformRoleDefinition<TRole>>;
    MODULE_PERMISSIONS: Record<string, TPermission>;
    normalizePlatformRole: (input: unknown) => TRole;
    can: (user: AuthUser | null, permission: TPermission) => boolean;
};
declare function createPlatformRbac<TRole extends string, TPermission extends string>(opts: CreatePlatformRbacOptions<TRole, TPermission>): PlatformRbac<TRole, TPermission>;

export { type CreatePlatformRbacOptions, type PlatformRbac, type PlatformRoleDefinition, createPlatformRbac };
