import { CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { Repository } from 'typeorm';
import { UserTenantMembership } from '../auth/auth.module';
export declare const KLAVO_MODULES: readonly ["clients", "products", "proposals", "contracts", "charges", "invoices", "signatures", "saas", "rbac", "settings"];
export declare const KLAVO_ACTIONS: readonly ["create", "read", "update", "delete", "approve", "export", "admin"];
export type KlavoModule = typeof KLAVO_MODULES[number];
export type KlavoAction = typeof KLAVO_ACTIONS[number];
export declare class Permission {
    id: string;
    module: string;
    action: string;
    description: string;
}
export declare class Role {
    id: string;
    tenantId: string;
    name: string;
    description: string;
    isSystem: boolean;
    permissions: Permission[];
    createdAt: Date;
    updatedAt: Date;
}
export declare class UserEntity {
    id: string;
    tenantId: string;
    roleId: string;
    name: string;
    email: string;
    passwordHash: string;
    isOwner: boolean;
    status: string;
    lastLoginAt: Date;
    role: Role;
    extraPermissions: Permission[];
    createdAt: Date;
    updatedAt: Date;
}
export declare function userHasPermission(user: UserEntity, module: string, action: string): boolean;
export declare const PERMISSION_KEY = "required_permission";
export declare const RequirePermission: (module: KlavoModule, action: KlavoAction) => import("@nestjs/common").CustomDecorator<string>;
export declare class PermissionGuard implements CanActivate {
    private readonly reflector;
    private readonly userRepo;
    constructor(reflector: Reflector, userRepo: Repository<UserEntity>);
    canActivate(context: ExecutionContext): Promise<boolean>;
}
export declare const JwtPermissionGuards: (module: KlavoModule, action: KlavoAction) => (import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard> | typeof PermissionGuard)[];
export declare class CreateRoleDto {
    name: string;
    description?: string;
    permissionIds: string[];
}
export declare class UpdateRoleDto extends CreateRoleDto {
}
export declare class AssignRoleDto {
    roleId?: string | null;
}
export declare class SetUserPermissionsDto {
    permissionIds: string[];
}
export declare class CreateUserDto {
    name: string;
    email: string;
    password: string;
    roleId?: string;
    tenantIds?: string[];
}
export declare class RbacService {
    private readonly roleRepo;
    private readonly permissionRepo;
    private readonly userRepo;
    private readonly membershipRepo;
    constructor(roleRepo: Repository<Role>, permissionRepo: Repository<Permission>, userRepo: Repository<UserEntity>, membershipRepo: Repository<UserTenantMembership>);
    listPermissions(): Promise<Permission[]>;
    listPermissionsByModule(): Promise<Record<string, Permission[]>>;
    createRole(tenantId: string, dto: CreateRoleDto): Promise<Role>;
    listRoles(tenantId: string): Promise<Role[]>;
    findRole(tenantId: string, id: string): Promise<Role>;
    updateRole(tenantId: string, id: string, dto: UpdateRoleDto): Promise<Role>;
    deleteRole(tenantId: string, id: string): Promise<void>;
    createUser(currentTenantId: string, dto: CreateUserDto): Promise<UserEntity>;
    listUsers(tenantId: string): Promise<Omit<UserEntity, 'passwordHash'>[]>;
    findUser(tenantId: string, id: string): Promise<UserEntity>;
    assignRole(tenantId: string, userId: string, dto: AssignRoleDto): Promise<UserEntity>;
    setUserExtraPermissions(tenantId: string, userId: string, dto: SetUserPermissionsDto): Promise<UserEntity>;
    getUserEffectivePermissions(tenantId: string, userId: string): Promise<{
        module: string;
        action: string;
        source: 'role' | 'user';
    }[]>;
    toggleUserStatus(tenantId: string, userId: string): Promise<UserEntity>;
}
export declare class PermissionsController {
    private readonly rbacService;
    constructor(rbacService: RbacService);
    listByModule(): Promise<Record<string, Permission[]>>;
}
export declare class RolesController {
    private readonly rbacService;
    constructor(rbacService: RbacService);
    create(dto: CreateRoleDto, req: any): Promise<Role>;
    list(req: any): Promise<Role[]>;
    findOne(id: string, req: any): Promise<Role>;
    update(id: string, dto: UpdateRoleDto, req: any): Promise<Role>;
    remove(id: string, req: any): Promise<void>;
}
export declare class UsersController {
    private readonly rbacService;
    constructor(rbacService: RbacService);
    create(dto: CreateUserDto, req: any): Promise<UserEntity>;
    list(req: any): Promise<Omit<UserEntity, "passwordHash">[]>;
    findOne(id: string, req: any): Promise<UserEntity>;
    assignRole(id: string, dto: AssignRoleDto, req: any): Promise<UserEntity>;
    setPermissions(id: string, dto: SetUserPermissionsDto, req: any): Promise<UserEntity>;
    effectivePermissions(id: string, req: any): Promise<{
        module: string;
        action: string;
        source: "role" | "user";
    }[]>;
    toggleStatus(id: string, req: any): Promise<UserEntity>;
}
export declare class RbacModule {
}