import { Request, Response, NextFunction } from 'express';
export interface AuthRequest extends Request {
    user?: {
        _id: string;
        email: string;
        role: string;
        name: string;
        /** true when the identity comes from CSM delegation (no local users row). */
        csm?: boolean;
    };
}
export declare const authenticate: (req: AuthRequest, res: Response, next: NextFunction) => Promise<void>;
export declare const authorize: (...roles: string[]) => (req: AuthRequest, res: Response, next: NextFunction) => void;
/** RBAC: kiểm tra `Role.permissions[permissionKey]` (ADMIN bỏ qua). */
export declare const requirePermission: (permissionKey: string) => (req: AuthRequest, res: Response, next: NextFunction) => Promise<void>;
/** Đổi mật khẩu: chính user đó hoặc có `manage_users`. */
export declare const allowSelfOrManageUsers: (req: AuthRequest, res: Response, next: NextFunction) => Promise<void>;
/** RBAC: cần ít nhất một trong các quyền (ADMIN bỏ qua). */
export declare const requireAnyPermission: (...permissionKeys: string[]) => (req: AuthRequest, res: Response, next: NextFunction) => Promise<void>;
//# sourceMappingURL=auth.middleware.d.ts.map