/**
 * Group Membership Verification Service
 *
 * Provides authoritative verification of user group memberships against the database,
 * not trusting JWT claims which can be manipulated by attackers.
 *
 * This is a CRITICAL security component that prevents escalation authorization bypass attacks.
 *
 * @packageDocumentation
 */
import type { ID } from './types.js';
/**
 * Result of a group membership verification
 */
export interface GroupMembershipResult {
    /** Whether the user is a verified member of the group */
    isMember: boolean;
    /** Source of the verification (database, cache, or external directory) */
    source: 'database' | 'cache' | 'directory';
    /** When the membership was verified */
    verifiedAt: string;
    /** Optional additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Result of an escalation approver check
 */
export interface EscalationApproverResult {
    /** Whether the user is an assigned approver for this escalation */
    isApprover: boolean;
    /** When the user was assigned as approver (if applicable) */
    assignedAt?: string;
    /** Who assigned the user as approver (if applicable) */
    assignedBy?: string;
}
/**
 * Options for verifying group membership
 */
export interface VerifyGroupMembershipOptions {
    /** Skip cache and verify directly against database */
    skipCache?: boolean;
    /** Include external directory check (if configured) */
    checkExternalDirectory?: boolean;
}
/**
 * Options for assigning an approver to an escalation
 */
export interface AssignApproverOptions {
    /** The escalation ID */
    escalationId: ID;
    /** The user ID to assign as approver */
    userId: ID;
    /** The tenant ID for isolation */
    tenantId: ID;
    /** Who is making the assignment */
    assignedBy: ID;
}
/**
 * Verify if a user is a member of a specific group within a tenant.
 * This function queries the authoritative database source, NOT JWT claims.
 *
 * @param userId - The user ID to check
 * @param groupName - The group name to check membership for
 * @param tenantId - The tenant context for multi-tenancy isolation
 * @param options - Optional verification options
 * @returns Promise resolving to verification result
 */
export declare function verifyGroupMembership(userId: string, groupName: string, tenantId: string, options?: VerifyGroupMembershipOptions): Promise<GroupMembershipResult>;
/**
 * Check if a user is an explicitly assigned approver for an escalation.
 * This provides a more fine-grained authorization than group membership.
 *
 * @param escalationId - The escalation ID
 * @param userId - The user ID to check
 * @param tenantId - The tenant context for isolation
 * @returns Promise resolving to approver check result
 */
export declare function isAssignedApprover(escalationId: string, userId: string, tenantId: string): Promise<EscalationApproverResult>;
/**
 * Assign a user as an approver for a specific escalation.
 *
 * @param options - Assignment options
 * @returns Promise resolving to the created assignment
 */
export declare function assignApprover(options: AssignApproverOptions): Promise<{
    id: string;
    assignedAt: string;
}>;
/**
 * Remove an approver assignment from an escalation.
 *
 * @param escalationId - The escalation ID
 * @param userId - The user ID to remove
 * @param tenantId - The tenant context
 * @returns Promise resolving to true if removed, false if not found
 */
export declare function removeApprover(escalationId: string, userId: string, tenantId: string): Promise<boolean>;
/**
 * List all assigned approvers for an escalation.
 *
 * @param escalationId - The escalation ID
 * @param tenantId - The tenant context
 * @returns Promise resolving to list of approver assignments
 */
export declare function listApprovers(escalationId: string, tenantId: string): Promise<Array<{
    userId: string;
    assignedAt: string;
    assignedBy: string;
}>>;
/**
 * Invalidate cached group membership for a user.
 * Call this when group memberships are updated.
 *
 * @param userId - The user ID
 * @param tenantId - The tenant context
 * @param groupName - Optional specific group to invalidate (all groups if not specified)
 */
export declare function invalidateGroupMembershipCache(userId: string, tenantId: string, groupName?: string): Promise<void>;
//# sourceMappingURL=group-membership.d.ts.map