import type { Kysely } from 'kysely';
import type { Database } from '../db/types.js';
interface GlobalWorkflowPermission {
    allowed: boolean;
    reason?: string;
}
/**
 * Org-level permission enforcement for global workflows.
 *
 * Three independent axes (each stored as a jsonb array of
 * `{routingKey?, pattern}` entries on `org_settings`):
 *
 * - Workflow-repo allow-list (`global_workflow_allowed_repos`): which repos
 *   may author global workflows. null/empty = any repo. Checked at
 *   registration-extraction time and at dispatch time against the
 *   REGISTRATION's repo (the repo that defined the workflow).
 *
 * - Source-repo deny-list (`global_workflow_denied_repos`): which repos
 *   must never have global workflows run against their events (e.g., forks,
 *   untrusted contrib repos). Checked at dispatch time against the EVENT's
 *   repo (the repo that emitted the webhook).
 *
 * - Elevated access (`global_workflow_elevated_repos`): which workflow-
 *   authoring repos can read source-repo secrets during execution.
 *
 * Each entry can optionally pin a `routingKey`, restricting the entry to
 * one webhook source. An entry without a routing key applies to any source
 * in the org. An entry whose routing key no longer matches any current
 * source becomes a no-op (orphan, never matches) — by design, so deleting
 * a source does not silently rebind its policy entries to an unrelated
 * source.
 */
export declare class GlobalWorkflowPolicy {
    private readonly db;
    constructor(db: Kysely<Database>);
    /**
     * Check whether a workflow-authoring repository is allowed to register or
     * dispatch global workflows. The workflow's own routing key is matched
     * against each entry's optional `routingKey` qualifier.
     *
     * Decision flow:
     * 1. No org_settings row or globally disabled → not allowed (opt-in).
     * 2. allowed list null/empty → any repo allowed.
     * 3. Entry matches when its `routingKey` is absent OR equals
     *    `workflowRoutingKey`, AND its pattern matches the workflow repo.
     * 4. Otherwise → not allowed.
     */
    isWorkflowRepoAllowed(workflowRoutingKey: string, workflowRepoIdentifier: string, customerId: string): Promise<GlobalWorkflowPermission>;
    /**
     * Check whether events from a source repository may trigger any global
     * workflows. Each deny entry is matched against the EVENT's routing key
     * (so a source-qualified deny only applies to that specific source).
     *
     * Decision flow:
     * 1. No org_settings row or globally disabled → not allowed (opt-in).
     * 2. denied list null/empty → allowed.
     * 3. Any deny entry whose routing key (if set) equals the event's routing
     *    key AND whose pattern matches the source repo → not allowed.
     */
    isSourceRepoAllowed(eventRoutingKey: string, sourceRepoIdentifier: string, customerId: string): Promise<GlobalWorkflowPermission>;
    /**
     * Check whether a workflow-authoring repository has elevated access (i.e.,
     * may read source-repo secrets during execution). The workflow's routing
     * key is matched against each entry's optional `routingKey` qualifier.
     *
     * Returns false if no org_settings row or the elevated list is null/empty.
     */
    isElevatedAccessAllowed(workflowRoutingKey: string, repoIdentifier: string, customerId: string): Promise<boolean>;
    private getSettings;
}
export {};
//# sourceMappingURL=global-workflow-policy.d.ts.map