/**
 * Role Definitions for Role-Based Access Control (RBAC)
 *
 * Defines hierarchical roles with inherited permissions. Roles form a
 * hierarchy where higher-privilege roles inherit all permissions from
 * lower-privilege roles.
 *
 * Hierarchy: super_admin > admin > operator > analyst > viewer > guest
 *
 * Integration with TrustTier:
 * - Roles are assigned minimum trust tier requirements
 * - Higher privilege roles require higher trust tiers
 *
 * @packageDocumentation
 */
import { z } from 'zod';
import type { ID, TrustLevel } from '../../common/types.js';
/**
 * Built-in role identifiers
 */
export declare const BuiltinRoles: {
    /** Full system access - T5 required */
    readonly SUPER_ADMIN: "super_admin";
    /** Administrative access - T4 required */
    readonly ADMIN: "admin";
    /** Operational access - T3 required */
    readonly OPERATOR: "operator";
    /** Read and analysis access - T2 required */
    readonly ANALYST: "analyst";
    /** Read-only access - T1 required */
    readonly VIEWER: "viewer";
    /** Minimal access - T0 allowed */
    readonly GUEST: "guest";
};
export type BuiltinRole = (typeof BuiltinRoles)[keyof typeof BuiltinRoles];
/**
 * Role priority for hierarchy (higher = more privileged)
 */
export declare const ROLE_PRIORITY: Record<BuiltinRole, number>;
/**
 * Minimum trust tier required for each role
 */
export declare const ROLE_MINIMUM_TRUST_TIER: Record<BuiltinRole, TrustLevel>;
/**
 * Role definition with permissions and inheritance
 */
export interface RoleDefinition {
    /** Unique role identifier */
    id: string;
    /** Display name */
    name: string;
    /** Role description */
    description: string;
    /** Parent role (for inheritance) */
    parentRole?: string;
    /** Priority for hierarchy resolution */
    priority: number;
    /** Minimum trust tier required */
    minimumTrustTier: TrustLevel;
    /** Directly assigned permissions (not inherited) */
    permissions: string[];
    /** Scope restrictions (e.g., tenant-specific) */
    scope?: RoleScope;
    /** Whether this is a system role (cannot be modified) */
    isSystemRole: boolean;
    /** Whether this role is enabled */
    enabled: boolean;
    /** Metadata */
    metadata?: Record<string, unknown>;
    /** Creation timestamp */
    createdAt: string;
    /** Last update timestamp */
    updatedAt: string;
}
/**
 * Role scope restrictions
 */
export interface RoleScope {
    /** Restrict to specific tenants */
    tenantIds?: ID[];
    /** Restrict to specific resource types */
    resourceTypes?: string[];
    /** Time-based restrictions */
    timeRestrictions?: TimeRestriction[];
    /** IP-based restrictions */
    ipRestrictions?: string[];
}
/**
 * Time-based restriction
 */
export interface TimeRestriction {
    /** Start time (HH:MM) */
    startTime: string;
    /** End time (HH:MM) */
    endTime: string;
    /** Days of week (0-6, 0 = Sunday) */
    daysOfWeek: number[];
    /** Timezone */
    timezone: string;
}
/**
 * Role assignment to a subject (user, agent, service)
 */
export interface RoleAssignment {
    /** Assignment identifier */
    id: ID;
    /** Subject ID (user, agent, or service) */
    subjectId: ID;
    /** Subject type */
    subjectType: 'user' | 'agent' | 'service';
    /** Assigned role ID */
    roleId: string;
    /** Tenant context (if tenant-scoped) */
    tenantId?: ID;
    /** Assignment conditions */
    conditions?: AssignmentConditions;
    /** Assignment expiration */
    expiresAt?: string;
    /** Who assigned this role */
    assignedBy: ID;
    /** Assignment timestamp */
    assignedAt: string;
    /** Whether assignment is active */
    active: boolean;
}
/**
 * Conditions for role assignment
 */
export interface AssignmentConditions {
    /** Required trust tier at evaluation time */
    requiredTrustTier?: TrustLevel;
    /** Required IP ranges */
    allowedIpRanges?: string[];
    /** Time-based conditions */
    timeConditions?: TimeRestriction[];
    /** Custom attribute requirements */
    attributeRequirements?: Record<string, unknown>;
}
export declare const timRestrictionSchema: z.ZodObject<{
    startTime: z.ZodString;
    endTime: z.ZodString;
    daysOfWeek: z.ZodArray<z.ZodNumber, "many">;
    timezone: z.ZodString;
}, "strip", z.ZodTypeAny, {
    startTime?: string;
    endTime?: string;
    daysOfWeek?: number[];
    timezone?: string;
}, {
    startTime?: string;
    endTime?: string;
    daysOfWeek?: number[];
    timezone?: string;
}>;
export declare const roleScopeSchema: z.ZodObject<{
    tenantIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    resourceTypes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    timeRestrictions: z.ZodOptional<z.ZodArray<z.ZodObject<{
        startTime: z.ZodString;
        endTime: z.ZodString;
        daysOfWeek: z.ZodArray<z.ZodNumber, "many">;
        timezone: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }, {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }>, "many">>;
    ipRestrictions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    tenantIds?: string[];
    resourceTypes?: string[];
    timeRestrictions?: {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }[];
    ipRestrictions?: string[];
}, {
    tenantIds?: string[];
    resourceTypes?: string[];
    timeRestrictions?: {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }[];
    ipRestrictions?: string[];
}>;
export declare const roleDefinitionSchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    description: z.ZodString;
    parentRole: z.ZodOptional<z.ZodString>;
    priority: z.ZodNumber;
    minimumTrustTier: z.ZodType<TrustLevel>;
    permissions: z.ZodArray<z.ZodString, "many">;
    scope: z.ZodOptional<z.ZodObject<{
        tenantIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        resourceTypes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        timeRestrictions: z.ZodOptional<z.ZodArray<z.ZodObject<{
            startTime: z.ZodString;
            endTime: z.ZodString;
            daysOfWeek: z.ZodArray<z.ZodNumber, "many">;
            timezone: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }, {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }>, "many">>;
        ipRestrictions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        tenantIds?: string[];
        resourceTypes?: string[];
        timeRestrictions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        ipRestrictions?: string[];
    }, {
        tenantIds?: string[];
        resourceTypes?: string[];
        timeRestrictions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        ipRestrictions?: string[];
    }>>;
    isSystemRole: z.ZodBoolean;
    enabled: z.ZodBoolean;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    createdAt: z.ZodString;
    updatedAt: z.ZodString;
}, "strip", z.ZodTypeAny, {
    name?: string;
    priority?: number;
    id?: string;
    description?: string;
    enabled?: boolean;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    createdAt?: string;
    updatedAt?: string;
    parentRole?: string;
    scope?: {
        tenantIds?: string[];
        resourceTypes?: string[];
        timeRestrictions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        ipRestrictions?: string[];
    };
    isSystemRole?: boolean;
    minimumTrustTier?: TrustLevel;
}, {
    name?: string;
    priority?: number;
    id?: string;
    description?: string;
    enabled?: boolean;
    metadata?: Record<string, unknown>;
    permissions?: string[];
    createdAt?: string;
    updatedAt?: string;
    parentRole?: string;
    scope?: {
        tenantIds?: string[];
        resourceTypes?: string[];
        timeRestrictions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        ipRestrictions?: string[];
    };
    isSystemRole?: boolean;
    minimumTrustTier?: TrustLevel;
}>;
export declare const assignmentConditionsSchema: z.ZodObject<{
    requiredTrustTier: z.ZodType<TrustLevel | undefined>;
    allowedIpRanges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    timeConditions: z.ZodOptional<z.ZodArray<z.ZodObject<{
        startTime: z.ZodString;
        endTime: z.ZodString;
        daysOfWeek: z.ZodArray<z.ZodNumber, "many">;
        timezone: z.ZodString;
    }, "strip", z.ZodTypeAny, {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }, {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }>, "many">>;
    attributeRequirements: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, "strip", z.ZodTypeAny, {
    requiredTrustTier?: TrustLevel;
    allowedIpRanges?: string[];
    timeConditions?: {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }[];
    attributeRequirements?: Record<string, unknown>;
}, {
    requiredTrustTier?: TrustLevel;
    allowedIpRanges?: string[];
    timeConditions?: {
        startTime?: string;
        endTime?: string;
        daysOfWeek?: number[];
        timezone?: string;
    }[];
    attributeRequirements?: Record<string, unknown>;
}>;
export declare const roleAssignmentSchema: z.ZodObject<{
    id: z.ZodString;
    subjectId: z.ZodString;
    subjectType: z.ZodEnum<["user", "agent", "service"]>;
    roleId: z.ZodString;
    tenantId: z.ZodOptional<z.ZodString>;
    conditions: z.ZodOptional<z.ZodObject<{
        requiredTrustTier: z.ZodType<TrustLevel | undefined>;
        allowedIpRanges: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        timeConditions: z.ZodOptional<z.ZodArray<z.ZodObject<{
            startTime: z.ZodString;
            endTime: z.ZodString;
            daysOfWeek: z.ZodArray<z.ZodNumber, "many">;
            timezone: z.ZodString;
        }, "strip", z.ZodTypeAny, {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }, {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }>, "many">>;
        attributeRequirements: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, "strip", z.ZodTypeAny, {
        requiredTrustTier?: TrustLevel;
        allowedIpRanges?: string[];
        timeConditions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        attributeRequirements?: Record<string, unknown>;
    }, {
        requiredTrustTier?: TrustLevel;
        allowedIpRanges?: string[];
        timeConditions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        attributeRequirements?: Record<string, unknown>;
    }>>;
    expiresAt: z.ZodOptional<z.ZodString>;
    assignedBy: z.ZodString;
    assignedAt: z.ZodString;
    active: z.ZodBoolean;
}, "strip", z.ZodTypeAny, {
    id?: string;
    conditions?: {
        requiredTrustTier?: TrustLevel;
        allowedIpRanges?: string[];
        timeConditions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        attributeRequirements?: Record<string, unknown>;
    };
    tenantId?: string;
    expiresAt?: string;
    active?: boolean;
    assignedBy?: string;
    assignedAt?: string;
    roleId?: string;
    subjectId?: string;
    subjectType?: "agent" | "user" | "service";
}, {
    id?: string;
    conditions?: {
        requiredTrustTier?: TrustLevel;
        allowedIpRanges?: string[];
        timeConditions?: {
            startTime?: string;
            endTime?: string;
            daysOfWeek?: number[];
            timezone?: string;
        }[];
        attributeRequirements?: Record<string, unknown>;
    };
    tenantId?: string;
    expiresAt?: string;
    active?: boolean;
    assignedBy?: string;
    assignedAt?: string;
    roleId?: string;
    subjectId?: string;
    subjectType?: "agent" | "user" | "service";
}>;
/**
 * Get the built-in system roles
 */
export declare function getBuiltinRoles(): RoleDefinition[];
/**
 * Check if a role inherits from another role
 */
export declare function roleInheritsFrom(role: RoleDefinition, ancestorId: string, roleRegistry: Map<string, RoleDefinition>): boolean;
/**
 * Get all permissions for a role including inherited permissions
 */
export declare function getEffectivePermissions(role: RoleDefinition, roleRegistry: Map<string, RoleDefinition>): Set<string>;
/**
 * Get the effective priority for a role (considering inheritance)
 */
export declare function getEffectivePriority(role: RoleDefinition, roleRegistry: Map<string, RoleDefinition>): number;
/**
 * Compare two roles for hierarchy
 * Returns positive if roleA > roleB, negative if roleA < roleB, 0 if equal
 */
export declare function compareRoles(roleA: RoleDefinition, roleB: RoleDefinition, roleRegistry: Map<string, RoleDefinition>): number;
/**
 * Get all ancestor roles in the hierarchy
 */
export declare function getAncestorRoles(role: RoleDefinition, roleRegistry: Map<string, RoleDefinition>): RoleDefinition[];
/**
 * Validate that a role hierarchy has no cycles
 */
export declare function validateRoleHierarchy(roleRegistry: Map<string, RoleDefinition>): {
    valid: boolean;
    cycles: string[][];
};
/**
 * Check if a trust tier meets the minimum requirement for a role
 */
export declare function meetsTrustRequirement(role: RoleDefinition, trustTier: TrustLevel): boolean;
/**
 * Create a custom role definition
 */
export declare function createRoleDefinition(partial: Omit<RoleDefinition, 'createdAt' | 'updatedAt' | 'isSystemRole'> & Partial<Pick<RoleDefinition, 'isSystemRole'>>): RoleDefinition;
/**
 * Create a role assignment
 */
export declare function createRoleAssignment(partial: Omit<RoleAssignment, 'id' | 'assignedAt' | 'active'> & Partial<Pick<RoleAssignment, 'active'>>): RoleAssignment;
//# sourceMappingURL=roles.d.ts.map