import { OrgRole, ProjectRole } from "./types.js";

//#region src/auth/authz/sync.d.ts

/**
 * Sync a user's org membership to SpiceDB.
 * Call when: user joins org, role changes, user leaves org.
 */
declare function syncOrgMemberToSpiceDb(params: {
  tenantId: string;
  userId: string;
  role: OrgRole;
  action: 'add' | 'remove';
}): Promise<void>;
/**
 * Change a user's organization role.
 * Removes the old role and adds the new one atomically in a single transaction.
 * Call when: user's org role is updated (e.g., member -> admin).
 */
declare function changeOrgRole(params: {
  tenantId: string;
  userId: string;
  oldRole: OrgRole;
  newRole: OrgRole;
}): Promise<void>;
/**
 * Sync a new project to SpiceDB.
 * Links project to org and grants creator project_admin role (if not already org admin/owner).
 * Call when: project is created.
 */
declare function syncProjectToSpiceDb(params: {
  tenantId: string;
  projectId: string;
  creatorUserId: string;
}): Promise<void>;
/**
 * Grant project access to a user.
 */
declare function grantProjectAccess(params: {
  tenantId: string;
  projectId: string;
  userId: string;
  role: ProjectRole;
}): Promise<void>;
/**
 * Revoke project access from a user.
 */
declare function revokeProjectAccess(params: {
  tenantId: string;
  projectId: string;
  userId: string;
  role: ProjectRole;
}): Promise<void>;
/**
 * Change a user's project role.
 * Removes the old role and adds the new one atomically in a single transaction.
 */
declare function changeProjectRole(params: {
  tenantId: string;
  projectId: string;
  userId: string;
  oldRole: ProjectRole;
  newRole: ProjectRole;
}): Promise<void>;
/**
 * Remove a project from SpiceDB.
 * Call when: project is deleted.
 */
declare function removeProjectFromSpiceDb(params: {
  tenantId: string;
  projectId: string;
}): Promise<void>;
/**
 * List all explicit project members from SpiceDB.
 * Returns users with project_admin, project_member, or project_viewer roles.
 *
 * NOTE: This is an appropriate use of readRelationships for data introspection,
 * not permission logic (per SpiceDB best practices).
 */
declare function listProjectMembers(params: {
  tenantId: string;
  projectId: string;
}): Promise<Array<{
  userId: string;
  role: ProjectRole;
}>>;
/**
 * List all project memberships for a specific user.
 * Returns projects where the user has explicit project_admin, project_member, or project_viewer roles.
 *
 * NOTE: This is an appropriate use of readRelationships for data introspection,
 * not permission logic (per SpiceDB best practices).
 */
declare function listUserProjectMembershipsInSpiceDb(params: {
  tenantId: string;
  userId: string;
}): Promise<Array<{
  projectId: string;
  role: ProjectRole;
}>>;
/**
 * Revoke all project memberships for a user.
 * Call when: user is promoted to org admin (they get inherited access, explicit project roles become redundant).
 *
 * Uses efficient bulk delete - deletes all project relationships for user without listing first.
 */
declare function revokeAllProjectMemberships(params: {
  tenantId: string;
  userId: string;
}): Promise<void>;
/**
 * Revoke ALL user relationships within an organization.
 * Call when: user is being removed from an organization.
 *
 * This removes:
 * 1. Organization-level relationships (owner, admin, member)
 * 2. All project-level relationships within the organization
 *
 * Uses the most efficient approach: filters by subject without specifying relation.
 * This is much more efficient than individual relation-specific deletions.
 */
declare function revokeAllUserRelationships(params: {
  tenantId: string;
  userId: string;
}): Promise<void>;
//#endregion
export { changeOrgRole, changeProjectRole, grantProjectAccess, listProjectMembers, listUserProjectMembershipsInSpiceDb, removeProjectFromSpiceDb, revokeAllProjectMemberships, revokeAllUserRelationships, revokeProjectAccess, syncOrgMemberToSpiceDb, syncProjectToSpiceDb };