import type { Response } from 'express';
import type { RequestContext } from '../middleware/auth';
import { type ResourceOwnerFields } from './resourceOwnership';
export type RbacPermission = 'trace:read' | 'trace:write' | 'trace:download' | 'trace:delete_own' | 'trace:delete_any' | 'agent:run' | 'report:read' | 'report:delete' | 'analysis_result:read' | 'analysis_result:create' | 'analysis_result:share' | 'analysis_result:delete' | 'comparison:create' | 'comparison:read' | 'codebase:read' | 'codebase:manage' | 'codebase:admin' | 'provider:manage_workspace' | 'provider:manage_org' | 'audit:read' | 'runtime:manage';
export declare function hasRbacPermission(context: RequestContext, permission: RbacPermission): boolean;
export declare function sharesWorkspaceWithContext(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canReadTraceResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canDownloadTraceResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canDeleteTraceResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canReadReportResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canDeleteReportResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canReadAnalysisResultResource(resource: (ResourceOwnerFields & {
    visibility?: string | null;
}) | null | undefined, context: RequestContext): boolean;
export declare function canCreateAnalysisResultResource(context: RequestContext): boolean;
export declare function canShareAnalysisResultResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function canDeleteAnalysisResultResource(resource: ResourceOwnerFields | null | undefined, context: RequestContext): boolean;
export declare function sendForbidden(res: Response, details?: string): Response;
//# sourceMappingURL=rbac.d.ts.map