/**
 * Tenant membership verification result
 */
export interface TenantMembershipResult {
    /** Whether the user is a member of the tenant */
    isMember: boolean;
    /** The user's role in the tenant (if member) */
    role?: string;
    /** Whether the result was served from cache */
    cached: boolean;
}
/**
 * Verify that a user is a member of a tenant.
 *
 * This function first checks Redis cache for a cached membership result.
 * If not cached, it queries the database and caches the result.
 *
 * @param userId - The user ID from the JWT `sub` claim
 * @param tenantId - The tenant ID from the JWT `tenantId` claim
 * @returns Promise resolving to membership verification result
 *
 * @example
 * ```typescript
 * const result = await verifyTenantMembership(userId, tenantId);
 * if (!result.isMember) {
 *   throw new ForbiddenError('User is not a member of this tenant');
 * }
 * ```
 */
export declare function verifyTenantMembership(userId: string, tenantId: string): Promise<TenantMembershipResult>;
/**
 * Verify tenant membership and throw ForbiddenError if user is not a member.
 *
 * This is a convenience function that combines verification with error handling
 * for use in request handlers.
 *
 * @param userId - The user ID from the JWT `sub` claim
 * @param tenantId - The tenant ID from the JWT `tenantId` claim
 * @throws ForbiddenError if the user is not a member of the tenant
 *
 * @example
 * ```typescript
 * // In a request handler:
 * await requireTenantMembership(user.sub, payload.tenantId);
 * // If we reach here, user is verified as tenant member
 * ```
 */
export declare function requireTenantMembership(userId: string, tenantId: string): Promise<void>;
/**
 * Invalidate the cached membership for a user-tenant pair.
 *
 * Call this when a user's membership changes (added, removed, or role changed).
 *
 * @param userId - The user ID
 * @param tenantId - The tenant ID
 */
export declare function invalidateMembershipCache(userId: string, tenantId: string): Promise<void>;
/**
 * Invalidate all cached memberships for a user.
 *
 * Call this when a user is removed from the system or all their memberships change.
 *
 * @param userId - The user ID
 */
export declare function invalidateUserMembershipCache(userId: string): Promise<void>;
/**
 * Invalidate all cached memberships for a tenant.
 *
 * Call this when tenant membership rules change globally.
 *
 * @param tenantId - The tenant ID
 */
export declare function invalidateTenantMembershipCache(tenantId: string): Promise<void>;
//# sourceMappingURL=tenant-verification.d.ts.map