import { OrgRole } from "./types.js";

//#region src/auth/authz/permissions.d.ts

/**
 * Check if a user can view a project.
 *
 * - If authz is disabled: returns true (current behavior)
 * - If user is org owner/admin: returns true (bypass)
 * - Otherwise: checks SpiceDB
 */
declare function canViewProject(params: {
  userId: string;
  tenantId: string;
  projectId: string;
  orgRole: OrgRole;
}): Promise<boolean>;
/**
 * Check if a user can use a project (invoke agents, create API keys, view traces).
 *
 * - If authz is disabled: returns true (current behavior)
 * - If user is org owner/admin: returns true (bypass)
 * - Otherwise: checks SpiceDB for use permission
 */
declare function canUseProject(params: {
  userId: string;
  tenantId: string;
  projectId: string;
  orgRole: OrgRole;
}): Promise<boolean>;
/**
 * Check if a user can use a project - always checks SpiceDB.
 *
 * Use this when orgRole is not available (e.g., run-api from JWT).
 */
declare function canUseProjectStrict(params: {
  userId: string;
  tenantId: string;
  projectId: string;
}): Promise<boolean>;
/**
 * Check if a user can edit a project (modify configurations).
 *
 * - If authz is disabled: only org owner/admin can edit
 * - If user is org owner/admin: returns true (bypass)
 * - Otherwise: checks SpiceDB for edit permission
 */
declare function canEditProject(params: {
  userId: string;
  tenantId: string;
  projectId: string;
  orgRole: OrgRole;
}): Promise<boolean>;
/**
 * Get list of accessible project IDs for a user.
 *
 * - If authz is disabled: returns 'all' (no filtering needed)
 * - If user is org owner/admin: returns 'all' (no filtering needed)
 * - Otherwise: uses SpiceDB LookupResources
 */
declare function listAccessibleProjectIds(params: {
  userId: string;
  tenantId: string;
  orgRole: OrgRole;
}): Promise<string[] | 'all'>;
/**
 * Get list of usable project IDs for a user - always checks SpiceDB.
 */
declare function listUsableProjectIds(params: {
  userId: string;
  tenantId: string;
}): Promise<string[]>;
//#endregion
export { canEditProject, canUseProject, canUseProjectStrict, canViewProject, listAccessibleProjectIds, listUsableProjectIds };