/**
 * Role-Based Access Control (RBAC) Module
 *
 * Comprehensive RBAC implementation for Vorion with:
 * - Hierarchical roles (admin > operator > viewer)
 * - Resource-based permissions (tenant:*, intent:read, proof:verify)
 * - Policy-based access control
 * - TenantContext integration
 * - Trust-engine integration for trust-based access
 * - Audit logging for all access decisions
 *
 * @example
 * ```typescript
 * import { RBACService, createRBACService } from './security/rbac';
 *
 * const rbac = createRBACService();
 *
 * // Check permission
 * const result = await rbac.checkAccess({
 *   subjectId: 'user-123',
 *   subjectType: 'user',
 *   resource: 'intent',
 *   action: 'read',
 *   tenantId: 'tenant-456',
 * });
 *
 * if (!result.permitted) {
 *   throw new ForbiddenError(result.reason);
 * }
 * ```
 *
 * @packageDocumentation
 */
import type { FastifyRequest, FastifyPluginCallback, preHandlerHookHandler } from 'fastify';
import type { ID, TrustLevel } from '../../common/types.js';
export { BuiltinRoles, type BuiltinRole, type RoleDefinition, type RoleAssignment, type RoleScope, type TimeRestriction, type AssignmentConditions, ROLE_PRIORITY, ROLE_MINIMUM_TRUST_TIER, getBuiltinRoles, getEffectivePermissions, roleInheritsFrom, compareRoles, getAncestorRoles, validateRoleHierarchy, meetsTrustRequirement, createRoleDefinition, createRoleAssignment, roleDefinitionSchema, roleAssignmentSchema, } from './roles.js';
export { PermissionActions, ResourceTypes, PermissionCategories, type PermissionAction, type ResourceType, type PermissionCategory, type PermissionDefinition, type PermissionCheckRequest, type PermissionCheckResult, getBuiltinPermissions, parsePermission, buildPermission, permissionMatches, hasPermission, hasAllPermissions, hasAnyPermission, filterMatchingPermissions, isValidPermissionFormat, getPermissionsByCategory, getSensitivePermissions, getCompliancePermissions, createPermissionDefinition, permissionDefinitionSchema, permissionCheckRequestSchema, permissionCheckResultSchema, } from './permissions.js';
export { PolicyTypes, PolicyEffects, CombiningAlgorithms, type PolicyType, type PolicyEffect, type CombiningAlgorithm, type AccessPolicy, type PolicyTarget, type PolicyConditions, type PolicyEvaluationContext, type PolicyEvaluationResult, type EvaluatedPolicy, type PolicyEngineOptions, RBACPolicyEngine, createRBACPolicyEngine, createPolicyEvaluationContext, createAccessPolicy, accessPolicySchema, } from './policy-engine.js';
import { type RoleDefinition, type RoleAssignment } from './roles.js';
import { type PolicyEngineOptions, RBACPolicyEngine } from './policy-engine.js';
/**
 * RBAC access check request
 */
export interface AccessCheckRequest {
    /** Subject ID (user, agent, or service) */
    subjectId: ID;
    /** Subject type */
    subjectType: 'user' | 'agent' | 'service';
    /** Resource type being accessed */
    resource: string;
    /** Action being performed */
    action: string;
    /** Resource ID (for resource-specific checks) */
    resourceId?: ID;
    /** Tenant context */
    tenantId?: ID;
    /** Subject's current trust tier */
    trustTier?: TrustLevel;
    /** Additional context attributes */
    context?: Record<string, unknown>;
    /** Client IP address */
    ipAddress?: string;
    /** User agent */
    userAgent?: string;
    /** Request ID for tracing */
    requestId?: ID;
}
/**
 * RBAC access check result
 */
export interface AccessCheckResult {
    /** Whether access is permitted */
    permitted: boolean;
    /** Reason for the decision */
    reason: string;
    /** Permissions that were checked */
    checkedPermissions: string[];
    /** Roles that were evaluated */
    evaluatedRoles: string[];
    /** Missing requirements (if denied) */
    missingRequirements?: {
        permissions?: string[];
        roles?: string[];
        trustTier?: TrustLevel;
    };
    /** How the decision was made */
    decisionSource: 'policy' | 'role' | 'permission' | 'default';
    /** Evaluation duration in milliseconds */
    durationMs: number;
    /** Evaluation timestamp */
    evaluatedAt: string;
}
/**
 * RBAC Service options
 */
export interface RBACServiceOptions extends PolicyEngineOptions {
    /** Enable trust tier enforcement */
    enforceTrustTier?: boolean;
    /** Default trust tier for subjects without one */
    defaultTrustTier?: TrustLevel;
    /** Enable tenant isolation */
    enableTenantIsolation?: boolean;
    /** Allow cross-tenant access for super admins */
    allowSuperAdminCrossTenant?: boolean;
}
/**
 * RBAC Service
 *
 * High-level service for Role-Based Access Control that integrates:
 * - Role management
 * - Permission checking
 * - Policy evaluation
 * - Trust-tier enforcement
 * - Tenant isolation
 * - Audit logging
 */
export declare class RBACService {
    private policyEngine;
    private options;
    private auditLogger;
    constructor(options?: RBACServiceOptions);
    /**
     * Check if a subject has access to a resource
     */
    checkAccess(request: AccessCheckRequest): Promise<AccessCheckResult>;
    /**
     * Check if subject has specific permission
     */
    hasPermission(subjectId: ID, permission: string, tenantId?: ID): Promise<boolean>;
    /**
     * Check if subject has all specified permissions
     */
    hasAllPermissions(subjectId: ID, permissions: string[], tenantId?: ID): Promise<boolean>;
    /**
     * Check if subject has a specific role
     */
    hasRole(subjectId: ID, roleId: string, tenantId?: ID): Promise<boolean>;
    /**
     * Require access (throws ForbiddenError if denied)
     */
    requireAccess(request: AccessCheckRequest): Promise<void>;
    /**
     * Require permission (throws ForbiddenError if denied)
     */
    requirePermission(subjectId: ID, permission: string, tenantId?: ID): Promise<void>;
    /**
     * Require role (throws ForbiddenError if denied)
     */
    requireRole(subjectId: ID, roleId: string, tenantId?: ID): Promise<void>;
    /**
     * Add a custom role
     */
    addRole(role: RoleDefinition): void;
    /**
     * Update a custom role
     */
    updateRole(roleId: string, updates: Partial<RoleDefinition>): void;
    /**
     * Remove a custom role
     */
    removeRole(roleId: string): boolean;
    /**
     * Get a role by ID
     */
    getRole(roleId: string): RoleDefinition | undefined;
    /**
     * Get all roles
     */
    getAllRoles(): RoleDefinition[];
    /**
     * Assign a role to a subject
     */
    assignRole(assignment: RoleAssignment): void;
    /**
     * Revoke a role from a subject
     */
    revokeRole(subjectId: ID, roleId: string, tenantId?: ID): boolean;
    /**
     * Get role assignments for a subject
     */
    getRoleAssignments(subjectId: ID): RoleAssignment[];
    /**
     * Get subject's effective permissions
     */
    getSubjectPermissions(subjectId: ID, tenantId?: ID): Promise<Set<string>>;
    /**
     * Get subject's roles
     */
    getSubjectRoles(subjectId: ID, tenantId?: ID): Promise<RoleDefinition[]>;
    /**
     * Get the underlying policy engine
     */
    getPolicyEngine(): RBACPolicyEngine;
    /**
     * Check if trust tier meets requirements for assigned roles
     */
    private checkTrustTierForRoles;
    /**
     * Check tenant access
     */
    private checkTenantAccess;
    /**
     * Get service statistics
     */
    getStats(): ReturnType<RBACPolicyEngine['getStats']> & {
        options: RBACServiceOptions;
    };
    /**
     * Destroy the service
     */
    destroy(): void;
}
/**
 * Create a new RBAC service
 */
export declare function createRBACService(options?: RBACServiceOptions): RBACService;
/**
 * RBAC middleware options
 */
export interface RBACMiddlewareOptions {
    /** RBAC service instance */
    rbacService?: RBACService;
    /** Skip RBAC check for these paths */
    skipPaths?: string[];
    /** Extract subject from request */
    extractSubject?: (request: FastifyRequest) => {
        id: ID;
        type: 'user' | 'agent' | 'service';
        trustTier?: TrustLevel;
        tenantId?: ID;
    } | undefined;
    /** Get required permission for route */
    getRoutePermission?: (request: FastifyRequest) => string | undefined;
}
/**
 * Fastify request with security RBAC context
 */
export interface SecurityRBACRequestContext {
    /** RBAC service */
    rbacService: RBACService;
    /** Subject info */
    subject?: {
        id: ID;
        type: 'user' | 'agent' | 'service';
        trustTier: TrustLevel;
        roles: string[];
        permissions: string[];
    };
    /** Check access within request handler */
    checkAccess: (resource: string, action: string, resourceId?: ID) => Promise<AccessCheckResult>;
    /** Require access (throws if denied) */
    requireAccess: (resource: string, action: string, resourceId?: ID) => Promise<void>;
    /** Check permission */
    hasPermission: (permission: string) => Promise<boolean>;
    /** Require permission (throws if denied) */
    requirePermission: (permission: string) => Promise<void>;
}
declare module 'fastify' {
    interface FastifyRequest {
        securityRbac?: SecurityRBACRequestContext;
    }
}
/**
 * Create RBAC middleware
 */
export declare function rbacMiddleware(options?: RBACMiddlewareOptions): preHandlerHookHandler;
/**
 * RBAC Fastify plugin
 */
export declare const rbacPlugin: FastifyPluginCallback<RBACMiddlewareOptions>;
declare module 'fastify' {
    interface FastifyInstance {
        rbacService?: RBACService;
    }
}
/**
 * Permission requirement for route decoration
 */
export interface PermissionRequirement {
    /** Required permission */
    permission: string;
    /** Required role (alternative to permission) */
    role?: string;
    /** Required trust tier */
    trustTier?: TrustLevel;
    /** Operator for multiple requirements */
    operator?: 'and' | 'or';
}
/**
 * Create a preHandler that requires specific permissions
 */
export declare function requirePermissions(...permissions: string[]): preHandlerHookHandler;
/**
 * Create a preHandler that requires any of the specified permissions
 */
export declare function requireAnyPermission(...permissions: string[]): preHandlerHookHandler;
/**
 * Create a preHandler that requires specific role
 */
export declare function requireRole(roleId: string): preHandlerHookHandler;
/**
 * Create a preHandler that requires resource-specific access
 */
export declare function requireResourceAccess(resource: string, action: string, getResourceId?: (request: FastifyRequest) => ID | undefined): preHandlerHookHandler;
/**
 * Create a preHandler that requires minimum trust tier
 */
export declare function requireTrustTier(minimumTier: TrustLevel): preHandlerHookHandler;
/**
 * Get the default RBAC service singleton
 */
export declare function getRBACService(options?: RBACServiceOptions): RBACService;
/**
 * Reset the default RBAC service (for testing)
 */
export declare function resetRBACService(): void;
//# sourceMappingURL=index.d.ts.map