captify 0.1.18 → 0.1.19

package/dist/permissions/permissions.errors.js

@@ -0,0 +1,137 @@
+/**
+ * Permissions module error classes
+ */
+import { ConflictError, NotFoundError, ValidationError, ForbiddenError, } from "../shared/services/services.errors";
+// ============================================================================
+// Error Codes
+// ============================================================================
+/**
+ * Permission-specific error codes
+ */
+export const PERMISSIONS_ERROR_CODES = {
+    POLICY_NOT_FOUND: "PolicyNotFound",
+    ROLE_NOT_FOUND: "RoleNotFound",
+    ASSIGNMENT_NOT_FOUND: "AssignmentNotFound",
+    DUPLICATE_POLICY: "DuplicatePolicy",
+    DUPLICATE_ROLE: "DuplicateRole",
+    DUPLICATE_ASSIGNMENT: "DuplicateAssignment",
+    SELF_LOCKOUT: "SelfLockout",
+    SYSTEM_ROLE: "SystemRole",
+    ROLE_IN_USE: "RoleInUse",
+    INVALID_RESOURCE: "InvalidResource",
+    INVALID_ACTION: "InvalidAction",
+};
+// ============================================================================
+// Error Classes
+// ============================================================================
+/**
+ * Error thrown when a policy is not found
+ */
+export class PolicyNotFoundError extends NotFoundError {
+    constructor(message = "Policy not found") {
+        super(message);
+        this.name = "PolicyNotFoundError";
+    }
+}
+/**
+ * Error thrown when a role is not found
+ */
+export class RoleNotFoundError extends NotFoundError {
+    constructor(message = "Role not found") {
+        super(message);
+        this.name = "RoleNotFoundError";
+    }
+}
+/**
+ * Error thrown when an assignment is not found
+ */
+export class AssignmentNotFoundError extends NotFoundError {
+    constructor(message = "Role assignment not found") {
+        super(message);
+        this.name = "AssignmentNotFoundError";
+    }
+}
+/**
+ * Error thrown when trying to create a duplicate policy
+ */
+export class DuplicatePolicyError extends ConflictError {
+    constructor(message = "A policy with these values already exists") {
+        super(message);
+        this.name = "DuplicatePolicyError";
+    }
+}
+/**
+ * Error thrown when trying to create a role with an existing name
+ */
+export class DuplicateRoleError extends ConflictError {
+    constructor(message = "A role with this name already exists") {
+        super(message);
+        this.name = "DuplicateRoleError";
+    }
+}
+/**
+ * Error thrown when trying to create a duplicate assignment
+ */
+export class DuplicateAssignmentError extends ConflictError {
+    constructor(message = "This role is already assigned to this group in this domain") {
+        super(message);
+        this.name = "DuplicateAssignmentError";
+    }
+}
+/**
+ * Generic permission denied error for resource/action checks
+ */
+export class PermissionDeniedError extends ForbiddenError {
+    constructor(resource, action) {
+        super(`You do not have permission to ${action} ${resource}`);
+        this.name = "PermissionDeniedError";
+        this.resource = resource;
+        this.action = action;
+    }
+}
+/**
+ * Error thrown when a user would lock themselves out of permissions management
+ */
+export class SelfLockoutError extends ForbiddenError {
+    constructor(message = "This action would remove your own permissions management access") {
+        super(message);
+        this.name = "SelfLockoutError";
+    }
+}
+/**
+ * Error thrown when trying to modify/delete a system role
+ */
+export class SystemRoleError extends ForbiddenError {
+    constructor(message = "System roles cannot be modified or deleted") {
+        super(message);
+        this.name = "SystemRoleError";
+    }
+}
+/**
+ * Error thrown when trying to delete a role that has active assignments
+ */
+export class RoleInUseError extends ConflictError {
+    constructor(message = "Cannot delete role with active group assignments") {
+        super(message);
+        this.name = "RoleInUseError";
+    }
+}
+/**
+ * Error thrown for invalid resource name
+ */
+export class InvalidResourceError extends ValidationError {
+    constructor(message = "Invalid resource name") {
+        super(message);
+        this.name = "InvalidResourceError";
+    }
+}
+/**
+ * Error thrown for invalid action name
+ */
+export class InvalidActionError extends ValidationError {
+    constructor(message = "Invalid action for this resource") {
+        super(message);
+        this.name = "InvalidActionError";
+    }
+}
+//# sourceMappingURL=permissions.errors.js.map

package/dist/permissions/permissions.errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.errors.js","sourceRoot":"","sources":["../../lib/permissions/permissions.errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,uCAAuC,CAAC;AAE/C,+EAA+E;AAC/E,cAAc;AACd,+EAA+E;AAE/E;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,cAAc,EAAE,cAAc;IAC9B,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,iBAAiB;IACnC,cAAc,EAAE,eAAe;IAC/B,oBAAoB,EAAE,qBAAqB;IAC3C,YAAY,EAAE,aAAa;IAC3B,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,WAAW;IACxB,gBAAgB,EAAE,iBAAiB;IACnC,cAAc,EAAE,eAAe;CACvB,CAAC;AAEX,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACpD,YAAY,OAAO,GAAG,kBAAkB;QACtC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,aAAa;IAClD,YAAY,OAAO,GAAG,gBAAgB;QACpC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,aAAa;IACxD,YAAY,OAAO,GAAG,2BAA2B;QAC/C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,YAAY,OAAO,GAAG,2CAA2C;QAC/D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IACnD,YAAY,OAAO,GAAG,sCAAsC;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,wBAAyB,SAAQ,aAAa;IACzD,YAAY,OAAO,GAAG,4DAA4D;QAChF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,qBAAsB,SAAQ,cAAc;IAIvD,YAAY,QAAgB,EAAE,MAAc;QAC1C,KAAK,CAAC,iCAAiC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAClD,YAAY,OAAO,GAAG,iEAAiE;QACrF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,cAAc;IACjD,YAAY,OAAO,GAAG,4CAA4C;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,cAAe,SAAQ,aAAa;IAC/C,YAAY,OAAO,GAAG,kDAAkD;QACtE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IACvD,YAAY,OAAO,GAAG,uBAAuB;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,eAAe;IACrD,YAAY,OAAO,GAAG,kCAAkC;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/permissions/permissions.interfaces.d.ts

@@ -0,0 +1,567 @@
+/**
+ * Permissions module TypeScript interfaces
+ */
+import type { PolicyFormSchemaType, RoleAssignmentFormSchemaType, Policy, Role, RoleAssignment } from "./permissions.schemas";
+import type { UserAwsCredentials } from "../shared/services";
+import type { DynamoDbService } from "../shared/services/dynamodb";
+import type { PoliciesTableSchema, PolicyPK, PolicySK, PolicyGsi1PK, PolicyGsi1SK, PolicyGsi2PK, PolicyGsi2SK } from "../db/schemas/policies.schema";
+import type { RolePK, RoleSK, RoleGsi1PK, RoleGsi1SK } from "../db/schemas/roles.schema";
+import type { RoleAssignmentsTableSchema, RoleAssignmentPK, RoleAssignmentSK, RoleAssignmentGsi1PK, RoleAssignmentGsi1SK, RoleAssignmentGsi2PK, RoleAssignmentGsi2SK } from "../db/schemas/role-assignments.schema";
+/** Subject type for policies - who the policy applies to */
+export type SubjectType = Policy["subjectType"];
+/** Effect type for policies - whether to allow or deny */
+export type PolicyEffect = Policy["effect"];
+/** Status type for policies - whether enabled or disabled */
+export type PolicyStatus = Policy["status"];
+/** Casbin policy type */
+export type PolicyType = Policy["ptype"];
+/** Protected resource names in the system */
+export type ResourceName = Policy["resource"];
+/** Standard actions that can be performed on resources */
+export type ActionName = Policy["actions"][number];
+/**
+ * Policy with DynamoDB keys
+ */
+export interface PolicyRecord extends Policy {
+    PK: PolicyPK;
+    SK: PolicySK;
+    /** Casbin v0: subject */
+    v0: string;
+    /** Casbin v1: domain */
+    v1: string;
+    /** Casbin v2: resource */
+    v2: string;
+    /** Casbin v3: actions */
+    v3: string[];
+    /** Casbin v4: effect */
+    v4: string;
+    GSI1_PK: PolicyGsi1PK;
+    GSI1_SK: PolicyGsi1SK;
+    GSI2_PK: PolicyGsi2PK;
+    GSI2_SK: PolicyGsi2SK;
+}
+/**
+ * Role with DynamoDB keys
+ */
+export interface RoleRecord extends Role {
+    PK: RolePK;
+    SK: RoleSK;
+    GSI1_PK: RoleGsi1PK;
+    GSI1_SK: RoleGsi1SK;
+}
+/**
+ * Role assignment with DynamoDB keys
+ */
+export interface RoleAssignmentRecord extends RoleAssignment {
+    PK: RoleAssignmentPK;
+    SK: RoleAssignmentSK;
+    GSI1_PK: RoleAssignmentGsi1PK;
+    GSI1_SK: RoleAssignmentGsi1SK;
+    GSI2_PK: RoleAssignmentGsi2PK;
+    GSI2_SK: RoleAssignmentGsi2SK;
+}
+/**
+ * Action definition for a resource
+ */
+export interface Action {
+    name: ActionName;
+    displayName: string;
+    description: string;
+}
+/**
+ * Protected resource definition
+ */
+export interface Resource {
+    resourceId: string;
+    name: ResourceName;
+    displayName: string;
+    description: string;
+    actions: Action[];
+}
+export interface ListPoliciesParams {
+    resource?: ResourceName;
+    subjectType?: SubjectType;
+    effect?: PolicyEffect;
+    status?: PolicyStatus;
+    search?: string;
+    sortBy?: "subject" | "resource" | "action" | "effect" | "status" | "createdAt";
+    sortOrder?: "asc" | "desc";
+    page?: number;
+    limit?: number;
+}
+export interface CreatePolicyRequest {
+    subject: string;
+    subjectType: SubjectType;
+    resource: ResourceName;
+    actions: ActionName[];
+    effect: PolicyEffect;
+}
+export interface UpdatePolicyRequest {
+    actions?: ActionName[];
+    effect?: PolicyEffect;
+}
+export interface UpdatePolicyStatusRequest {
+    status: PolicyStatus;
+}
+export interface CreateRoleRequest {
+    roleName: string;
+    description?: string;
+}
+export interface UpdateRoleRequest {
+    description?: string;
+}
+export interface CreateRoleAssignmentRequest {
+    groupId: string;
+    domain?: string;
+}
+export interface PolicyRowActions {
+    onEdit?: (policy: Policy) => void;
+    onDelete?: (policy: Policy) => void;
+    onToggleStatus?: (policy: Policy) => void;
+    /** Permission flags for conditional rendering */
+    canUpdate?: boolean;
+    canDelete?: boolean;
+    canEnable?: boolean;
+    canDisable?: boolean;
+}
+export interface RoleAssignmentDialogProps {
+    /** Whether the dialog is open */
+    open: boolean;
+    /** Callback when dialog open state changes */
+    onOpenChange: (open: boolean) => void;
+    /** Role to assign */
+    role: Role | null;
+    /** Callback when form is submitted */
+    onSubmit: (values: RoleAssignmentFormSchemaType) => Promise<void>;
+    /** Whether submission is in progress */
+    isSubmitting?: boolean;
+}
+/**
+ * Props for PolicyFormDialog component
+ */
+export interface PolicyFormDialogProps {
+    /** Whether the dialog is open */
+    open: boolean;
+    /** Callback when dialog open state changes */
+    onOpenChange: (open: boolean) => void;
+    /** Policy to edit (null for create mode) */
+    policy?: Policy | null;
+    /** Default resource for create mode (defaults to agents) */
+    defaultResource?: ResourceName;
+    /** Callback when form is submitted */
+    onSubmit: (values: PolicyFormSchemaType) => Promise<void>;
+    /** Whether submission is in progress */
+    isSubmitting?: boolean;
+}
+/**
+ * Options for policy service operations
+ */
+export interface PolicyServiceOptions {
+    userId: string;
+    tenantId: string;
+    /** User's Cognito groups - required for self-lockout protection on delete operations */
+    groups?: string[];
+    /** User's AWS credentials for DynamoDB operations */
+    userCredentials?: UserAwsCredentials;
+}
+/**
+ * Result from listing policies
+ */
+export interface ListPoliciesResult {
+    policies: Policy[];
+    totalCount: number;
+    page: number;
+    limit: number;
+    totalPages: number;
+}
+/**
+ * Options for role assignment service operations
+ */
+export interface RoleAssignmentServiceOptions {
+    userId: string;
+    tenantId: string;
+    /** User's AWS credentials for DynamoDB operations */
+    userCredentials?: UserAwsCredentials;
+}
+/**
+ * Parameters for permission enforcement
+ */
+export interface EnforceParams {
+    subject: string;
+    tenantId: string;
+    resource: string;
+    action: string;
+    logicalDomain?: string;
+    /** User's Cognito groups - used to check role-based permissions */
+    groups?: string[];
+    /** User's AWS credentials for DynamoDB operations */
+    userCredentials?: UserAwsCredentials;
+}
+/**
+ * Options for Casbin DynamoDB adapter
+ */
+export interface CasbinDynamoDbAdapterOptions {
+    tenantId: string;
+    userCredentials?: UserAwsCredentials;
+    dynamoDbService?: DynamoDbService<PoliciesTableSchema>;
+    assignmentsDbService?: DynamoDbService<RoleAssignmentsTableSchema>;
+}
+/** Valid sortable columns for policies */
+export type PolicySortColumn = "subject" | "resource" | "action" | "effect" | "status" | "createdAt";
+/**
+ * State for permissions dashboard
+ */
+export interface PermissionsDashboardState {
+    resource: ResourceName | undefined;
+    subjectType: SubjectType | undefined;
+    effect: PolicyEffect | undefined;
+    status: PolicyStatus | undefined;
+    search: string;
+    page: number;
+    limit: number;
+    sortBy: PolicySortColumn;
+    sortOrder: "asc" | "desc";
+}
+/**
+ * Options for usePolicies hook
+ */
+export interface UsePoliciesOptions {
+    params?: ListPoliciesParams;
+    enabled?: boolean;
+}
+/**
+ * Options for useResources hook
+ */
+export interface UseResourcesOptions {
+    enabled?: boolean;
+}
+/**
+ * Options for useRoles hook
+ */
+export interface UseRolesOptions {
+    enabled?: boolean;
+}
+/**
+ * Options for useRoleAssignments hook
+ */
+export interface UseRoleAssignmentsOptions {
+    roleId: string;
+    enabled?: boolean;
+}
+export interface ListPoliciesClientResponse {
+    policies: Policy[];
+    totalCount: number;
+    page: number;
+    limit: number;
+    totalPages: number;
+}
+export interface PolicyClientResponse {
+    policy: Policy;
+}
+export interface ListRolesClientResponse {
+    roles: Role[];
+}
+export interface RoleClientResponse {
+    role: Role;
+}
+export interface ListAssignmentsClientResponse {
+    assignments: RoleAssignment[];
+}
+export interface AssignmentClientResponse {
+    assignment: RoleAssignment;
+}
+export interface ListResourcesClientResponse {
+    resources: Resource[];
+}
+export interface BulkDeletePoliciesRequest {
+    policyIds: string[];
+}
+export interface BulkDeletePoliciesResponse {
+    deleted: string[];
+    failed: {
+        policyId: string;
+        error: string;
+    }[];
+}
+/**
+ * Single permission check request item
+ */
+export interface PermissionCheckItem {
+    resource: ResourceName;
+    action: ActionName;
+}
+/**
+ * Request body for batch permission check
+ */
+export interface CheckPermissionsRequest {
+    checks: PermissionCheckItem[];
+}
+/**
+ * Response from permission check endpoint
+ */
+export interface CheckPermissionsResponse {
+    permissions: Record<string, boolean>;
+}
+/**
+ * Options for usePermissions hook
+ */
+export interface UsePermissionsOptions {
+    enabled?: boolean;
+}
+/**
+ * Return type for usePermissions hook
+ */
+export interface UsePermissionsReturn {
+    /** Check if user has permission for resource:action */
+    can: (resource: ResourceName, action: ActionName) => boolean;
+    /** All permissions as a map */
+    permissions: Record<string, boolean>;
+    /** Loading state */
+    isLoading: boolean;
+    /** Error state */
+    error: Error | null;
+    /** Refetch permissions */
+    refetch: () => void;
+}
+/**
+ * Return type for useUserPermissions hook
+ */
+export interface UseUserPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    canEnable: boolean;
+    canDisable: boolean;
+    canAddToGroup: boolean;
+    canRemoveFromGroup: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useGroupPermissions hook
+ */
+export interface UseGroupPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useDocumentPermissions hook
+ */
+export interface UseDocumentPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    canUpload: boolean;
+    canDownload: boolean;
+    canListOtherUsers: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useFeedbackPermissions hook
+ */
+export interface UseFeedbackPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    canGenerate: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useOntologyPermissions hook
+ */
+export interface UseOntologyPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useLlmProviderPermissions hook
+ */
+export interface UseLlmProviderPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    canEnable: boolean;
+    canDisable: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useLlmBudgetPermissions hook
+ */
+export interface UseLlmBudgetPermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    canCreate: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+    isLoading: boolean;
+}
+/**
+ * Return type for useLlmUsagePermissions hook
+ */
+export interface UseLlmUsagePermissionsReturn {
+    canList: boolean;
+    canRead: boolean;
+    isLoading: boolean;
+}
+/**
+ * Props for PolicyDataTable component
+ */
+export interface PolicyDataTableProps {
+    policies: Policy[];
+    loading?: boolean;
+    error?: Error | null;
+    page: number;
+    limit: number;
+    totalCount: number;
+    totalPages: number;
+    onPageChange: (page: number) => void;
+    onLimitChange: (limit: number) => void;
+    sortBy: string;
+    sortOrder: "asc" | "desc";
+    onSort: (column: string) => void;
+    onEdit?: (policy: Policy) => void;
+    onDelete?: (policy: Policy) => void;
+    onToggleStatus?: (policy: Policy) => void;
+    onRefresh?: () => void;
+    isRefreshing?: boolean;
+}
+/**
+ * Props for PolicyDeleteDialog component
+ */
+export interface PolicyDeleteDialogProps {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    policy: Policy | null;
+    onConfirm: () => Promise<void>;
+    isDeleting?: boolean;
+}
+/**
+ * Props for PolicyBulkDeleteDialog component
+ */
+export interface PolicyBulkDeleteDialogProps {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    selectedCount: number;
+    onConfirm: () => Promise<void>;
+    isDeleting?: boolean;
+}
+/**
+ * Props for PolicyStatusToggle component
+ */
+export interface PolicyStatusToggleProps {
+    policy: Policy;
+    isLoading?: boolean;
+    disabled?: boolean;
+    onToggle: (policy: Policy, newStatus: PolicyStatus) => void;
+}
+/**
+ * Props for ResourcePanel component
+ */
+export interface ResourcePanelProps {
+    resources: Resource[];
+    isLoading?: boolean;
+    selectedResource?: ResourceName;
+    onResourceSelect?: (resource: ResourceName | undefined) => void;
+    className?: string;
+}
+/**
+ * Props for CreateRoleWithGroupsDialog component
+ */
+export interface CreateRoleWithGroupsDialogProps {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    onSubmit: (values: {
+        roleName: string;
+        description?: string;
+        initialGroups: string[];
+    }) => Promise<void>;
+    isSubmitting: boolean;
+}
+/**
+ * Props for EditRoleDialog component
+ */
+export interface EditRoleDialogProps {
+    open: boolean;
+    onOpenChange: (open: boolean) => void;
+    role: Role | null;
+    onSubmit: (values: {
+        description?: string;
+    }) => Promise<void>;
+    isSubmitting: boolean;
+}
+/**
+ * Props for DeleteRoleDialog component
+ *
+ * Note: The dialog is open when role is not null.
+ * The open state is derived internally from !!role.
+ */
+export interface DeleteRoleDialogProps {
+    /** Role to delete (dialog opens when role is set) */
+    role: Role | null;
+    /** Callback when dialog open state changes */
+    onOpenChange: (open: boolean) => void;
+    /** Callback when deletion is confirmed */
+    onConfirm: () => Promise<void>;
+    /** Whether deletion is in progress */
+    isDeleting: boolean;
+}
+/**
+ * Props for DeleteAssignmentDialog component
+ *
+ * Note: The dialog is open when assignment is not null.
+ * The open state is derived internally from !!assignment.
+ * The component handles the delete action internally via useRoleAssignments hook.
+ */
+export interface DeleteAssignmentDialogProps {
+    /** Assignment to delete (dialog opens when assignment is set) */
+    assignment: {
+        role: Role;
+        assignment: RoleAssignment;
+    } | null;
+    /** Callback when dialog open state changes */
+    onOpenChange: (open: boolean) => void;
+}
+/**
+ * Props for PolicyHelpSheet component
+ */
+export interface PolicyHelpSheetProps {
+    /** Whether the sheet is open */
+    open: boolean;
+    /** Callback when sheet open state changes */
+    onOpenChange: (open: boolean) => void;
+}
+/**
+ * Props for PolicyHelpButton component
+ */
+export interface PolicyHelpButtonProps {
+    /** Callback when help button is clicked */
+    onClick: () => void;
+}
+/**
+ * Configuration for assignments data passed to column definitions
+ * Used to avoid N+1 queries by batch fetching at table level
+ */
+export interface RoleAssignmentsData {
+    /** Map of roleId to assignments array */
+    assignmentsMap: Map<string, RoleAssignment[]>;
+    /** Whether assignments are still loading */
+    isLoading: boolean;
+    /** Whether there was an error loading assignments */
+    hasError: boolean;
+}
+//# sourceMappingURL=permissions.interfaces.d.ts.map