import { User, UserAPI } from "../types/user.types.js";
import { Organization, OrganizationAPI } from "../types/organization.types.js";
import { Project, ProjectAPI } from "../types/project.types.js";
import { Dictionary, DictionaryAPI } from "../types/dictionary.types.js";
import { Tag, TagAPI } from "../types/tag.types.js";
import { SessionContext } from "../types/session.types.js";

//#region src/utils/permissions.d.ts

/**
 * A named grouping of privileges (e.g. `"org_admin"`).
 * Users are *granted* one or more Roles.
 */
type Roles = 'user' | 'admin' | 'org_admin' | 'org_user' | 'project_admin' | 'project_user' | 'project_reviewer';
/**
 * An atomic operation that can be performed on a resource.
 * - **read**: view or list
 * - **write**: create or update
 * - **admin**: delete or change permissions
 */
type Action = 'read' | 'write' | 'admin';
/**
 * A first‑class entity in your domain model that you want to protect.
 */
type Resource = {
  organization: Organization;
  project: Project;
  dictionary: Dictionary;
  tag: Tag;
  user: User;
};
/**
 * A literal string combining a Resource and an Action, e.g. `"project:write"`.
 * This is the *unit* checked at runtime in your middleware.
 */
type Permission = `${keyof Resource}:${Action}`;
declare const ROLE_POLICY: {
  readonly admin: {
    readonly 'organization:read': () => true;
    readonly 'organization:write': () => true;
    readonly 'organization:admin': () => true;
    readonly 'project:read': () => true;
    readonly 'project:write': () => true;
    readonly 'project:admin': () => true;
    readonly 'dictionary:read': () => true;
    readonly 'dictionary:write': () => true;
    readonly 'dictionary:admin': () => true;
    readonly 'tag:read': () => true;
    readonly 'tag:write': () => true;
    readonly 'tag:admin': () => true;
    readonly 'user:read': () => true;
    readonly 'user:write': () => true;
    readonly 'user:admin': () => true;
  };
  readonly user: {
    readonly 'user:read': ({
      user,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
    readonly 'user:write': ({
      user,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
    readonly 'user:admin': ({
      user,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
    readonly 'organization:read': ({
      user,
      targetOrganizations
    }: SessionContext & {
      targetOrganizations: (Organization | OrganizationAPI)[];
    }) => boolean;
  };
  readonly org_admin: {
    readonly 'organization:read': ({
      organization,
      targetOrganizations
    }: SessionContext & {
      targetOrganizations: (Organization | OrganizationAPI)[];
    }) => boolean;
    readonly 'organization:write': ({
      organization,
      targetOrganizations
    }: SessionContext & {
      targetOrganizations: (Organization | OrganizationAPI)[];
    }) => boolean;
    readonly 'organization:admin': ({
      organization,
      targetOrganizations
    }: SessionContext & {
      targetOrganizations: (Organization | OrganizationAPI)[];
    }) => boolean;
    readonly 'project:read': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'project:write': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'project:admin': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'tag:read': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'tag:write': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'tag:admin': ({
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'user:write': ({
      organization,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
  };
  readonly org_user: {
    readonly 'organization:read': ({
      organization,
      targetOrganizations
    }: SessionContext & {
      targetOrganizations: (Organization | OrganizationAPI)[];
    }) => boolean;
    readonly 'project:read': ({
      user,
      targetProjects
    }: SessionContext & {
      targetProjects: (Project | ProjectAPI)[];
    }) => boolean;
    readonly 'user:read': ({
      organization,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
  };
  readonly project_admin: {
    readonly 'project:read': ({
      project,
      targetProjectIds
    }: SessionContext & {
      targetProjectIds?: (Project | ProjectAPI)["id"][];
    }) => boolean;
    readonly 'project:write': ({
      project,
      targetProjectIds
    }: SessionContext & {
      targetProjectIds?: (Project | ProjectAPI)["id"][];
    }) => boolean;
    readonly 'project:admin': ({
      project,
      targetProjectIds
    }: SessionContext & {
      targetProjectIds?: (Project | ProjectAPI)["id"][];
    }) => boolean;
    readonly 'tag:read': ({
      project,
      targetTags
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'tag:write': ({
      project,
      targetTags
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'tag:admin': ({
      project,
      targetTags
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'user:write': ({
      project,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
    readonly 'dictionary:read': ({
      project,
      user
    }: SessionContext) => boolean;
    readonly 'dictionary:write': ({
      project,
      user
    }: SessionContext) => boolean;
    readonly 'dictionary:admin': ({
      project,
      user
    }: SessionContext) => boolean;
  };
  readonly project_user: {
    readonly 'project:read': ({
      user,
      organization,
      project
    }: SessionContext) => boolean;
    readonly 'dictionary:read': ({
      user,
      project,
      targetDictionaries
    }: SessionContext & {
      targetDictionaries: (Dictionary | DictionaryAPI)[];
    }) => boolean;
    readonly 'dictionary:write': ({
      user,
      project
    }: SessionContext) => boolean;
    readonly 'tag:read': ({
      project,
      targetTags,
      user
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'tag:write': ({
      project,
      targetTags,
      user
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'tag:admin': ({
      user,
      project,
      targetTags
    }: SessionContext & {
      targetTags: (Tag | TagAPI)[];
    }) => boolean;
    readonly 'user:read': ({
      project,
      targetUsers
    }: SessionContext & {
      targetUsers: (User | UserAPI)[];
    }) => boolean;
  };
  readonly project_reviewer: {
    readonly 'dictionary:read': ({
      user,
      project
    }: SessionContext) => boolean;
    readonly 'dictionary:write': ({
      user,
      project
    }: SessionContext) => boolean;
    readonly 'tag:read': () => true;
  };
};
declare const getSessionRoles: ({
  user,
  organization,
  project
}: SessionContext) => Roles[];
declare const computeEffectivePermission: (roles: Roles[]) => Permission[];
/**
 * Intersect two permission lists
 * @param permissionList1 - The first permission list
 * @param permissionList2 - The second permission list
 * @returns The intersection of the two permission lists (only permissions present in both)
 */
declare const intersectPermissions: (permissions1: Permission[], permissions2: Permission[]) => Permission[];
type PermissionResult<R extends Roles, P extends Permission> = (typeof ROLE_POLICY)[R] extends infer RolePerms ? RolePerms extends Record<string, (args: any) => any> ? P extends keyof RolePerms ? RolePerms[P] extends undefined ? never : RolePerms[P] : never : never : never;
declare const hasPermission: <P extends Permission>(roles: Roles[], permission: P) => PermissionResult<Roles, P>;
//#endregion
export { Action, Permission, ROLE_POLICY, Resource, Roles, computeEffectivePermission, getSessionRoles, hasPermission, intersectPermissions };
//# sourceMappingURL=permissions.d.ts.map