import type { FieldDefinition } from '../config/types.js';
export type Role = 'ADMIN' | 'EDITOR' | 'AUTHOR' | 'CLIENT';
export type FieldAccessUser = {
    id: string;
    role: string;
} | null;
export interface Permission {
    action: 'create' | 'read' | 'update' | 'delete' | 'publish';
    resource: string;
    fields?: string[];
}
/** Check whether a user with the given role can perform an action on a resource. */
export declare function checkAccess(userRole: Role, requiredRole: Role): boolean;
/** Return the list of permissions granted to a role. */
export declare function getPermissionsForRole(role: Role): Permission[];
/** Filter field definitions to only include those the user is allowed to read. */
export declare function filterFieldsByRole(fields: Record<string, FieldDefinition>, user: FieldAccessUser): Promise<Record<string, FieldDefinition>>;
/** Filter incoming data to only include keys the user is allowed to update. */
export declare function filterWritableFields(fields: Record<string, FieldDefinition>, data: Record<string, unknown>, user: FieldAccessUser): Promise<Record<string, unknown>>;
/**
 * Apply field-level access control to a data object.
 * For 'read': strips keys the user cannot read.
 * For 'write': strips keys the user cannot update.
 */
export declare function applyFieldAccess(operation: 'read' | 'write', fields: Record<string, FieldDefinition>, data: Record<string, unknown>, user: FieldAccessUser): Promise<Record<string, unknown>>;
//# sourceMappingURL=access.d.ts.map