@payloadcms/plugin-mcp 4.0.0-internal.811e0a4 → 4.0.0-internal.8867dba

package/src/mcp/builtin/collections/updateTool.ts

@@ -9,15 +9,15 @@ import {
   getCollectionVirtualFieldNames,
   stripVirtualFields,
 } from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 import { validateCollectionData } from '../validateEntityData.js'
+import { fileInputSchema, resolveFile } from './fileInput.js'
 import { formatCollectionError } from './formatCollectionError.js'
 
 const DEFAULT_DESCRIPTION =
-  'Update documents in any collection by passing the collection slug and data.'
+  'Update documents in any collection. Files can use a URL, base64, or an upload prepared by getUploadInstructions.'
 
 export const updateDocumentTool = defineCollectionTool({
   access: (args) =>
@@ -32,7 +32,11 @@ export const updateDocumentTool = defineCollectionTool({
   description: DEFAULT_DESCRIPTION,
   input: z.object({
     id: z.union([z.string(), z.number()]).describe('The ID of the document to update').optional(),
-    data: z.record(z.string(), z.unknown()).describe('The fields to update'),
+    data: z
+      .record(z.string(), z.unknown())
+      .describe(
+        'The fields to update. Only include fields permitted by the schema returned by getCollectionSchema.',
+      ),
     depth: z
       .number()
       .describe('How many levels deep to populate relationships')
@@ -40,14 +44,16 @@ export const updateDocumentTool = defineCollectionTool({
       .default(0),
     draft: z
       .boolean()
-      .describe('Whether to update the document as a draft')
+      .describe(
+        'Only if getCollectionSchema includes _status; otherwise _status does not exist. true saves only a draft version; false updates main and versions. data._status: "published" overrides true.',
+      )
       .optional()
       .default(false),
     fallbackLocale: z
       .string()
       .describe('Optional: fallback locale code to use when requested locale is not available')
       .optional(),
-    filePath: z.string().describe('File path for file uploads').optional(),
+    file: fileInputSchema.optional(),
     locale: z
       .string()
       .describe(
@@ -64,6 +70,12 @@ export const updateDocumentTool = defineCollectionTool({
       .describe('Whether to overwrite existing files')
       .optional()
       .default(false),
+    publishAllLocales: z
+      .boolean()
+      .describe(
+        'For collections with localized publishing status, whether publishing should affect every locale. Set false with locale to publish only that locale.',
+      )
+      .optional(),
     select: z
       .record(z.string(), z.unknown())
       .describe(
@@ -86,10 +98,11 @@ export const updateDocumentTool = defineCollectionTool({
     depth,
     draft,
     fallbackLocale,
-    filePath,
+    file: fileInput,
     locale,
     overrideLock,
     overwriteExistingFiles,
+    publishAllLocales,
     select,
     where,
   } = input
@@ -119,6 +132,7 @@ export const updateDocumentTool = defineCollectionTool({
     }
 
     const parsedData = transformPointDataToPayload(inputData)
+    const file = await resolveFile({ collectionSlug, input: fileInput, req })
 
     const whereClause: Where = where ?? {}
 
@@ -129,11 +143,12 @@ export const updateDocumentTool = defineCollectionTool({
         data: parsedData,
         depth,
         draft,
+        overrideAccess: authorizedMCP.overrideAccess,
         overrideLock,
         req,
-        ...localAPIDefaults(authorizedMCP),
-        ...(filePath ? { filePath } : {}),
+        ...(file ? { file } : {}),
         ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
+        ...(publishAllLocales !== undefined ? { publishAllLocales } : {}),
         ...(locale ? { locale } : {}),
         ...(fallbackLocale ? { fallbackLocale } : {}),
         ...(select ? { select: select as SelectType } : {}),
@@ -155,12 +170,13 @@ export const updateDocumentTool = defineCollectionTool({
       data: parsedData,
       depth,
       draft,
+      overrideAccess: authorizedMCP.overrideAccess,
       overrideLock,
       req,
       where: whereClause,
-      ...localAPIDefaults(authorizedMCP),
-      ...(filePath ? { filePath } : {}),
+      ...(file ? { file } : {}),
       ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
+      ...(publishAllLocales !== undefined ? { publishAllLocales } : {}),
       ...(locale ? { locale } : {}),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(select ? { select: select as SelectType } : {}),

package/src/mcp/builtin/collections/uploadInstructionsTool.ts

@@ -0,0 +1,64 @@
+import { getUploadInstructions as getPayloadUploadInstructions } from 'payload/internal'
+import { z } from 'zod'
+
+import { defaultAccess } from '../../../defaultAccess.js'
+import { defineCollectionTool } from '../../../defineTool.js'
+
+export const getUploadInstructionsTool = defineCollectionTool({
+  access: (args) =>
+    defaultAccess(args) &&
+    Boolean(
+      args.permissions?.collections?.[args.collectionSlug]?.create ||
+        args.permissions?.collections?.[args.collectionSlug]?.update,
+    ),
+  annotations: {
+    destructiveHint: false,
+    idempotentHint: false,
+    openWorldHint: true,
+    readOnlyHint: false,
+    title: 'Get Upload Instructions',
+  },
+  description:
+    'Prepare a file upload before createDocument or updateDocument. Pass file metadata only, without base64 or file contents.',
+  input: z.object({
+    docPrefix: z.string().describe('Optional document folder or prefix').optional(),
+    filename: z.string().describe('The original file name'),
+    filesize: z.number().int().nonnegative().describe('The file size in bytes'),
+    mimeType: z.string().describe('The file MIME type'),
+  }),
+}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
+  try {
+    const instructions = await getPayloadUploadInstructions({
+      ...input,
+      collectionSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
+      req,
+    })
+
+    const nextStep =
+      instructions.type === 'http'
+        ? 'Send the exact file bytes using request, then pass { source: "uploadReference", file } to createDocument or updateDocument.'
+        : `Call the local MCP tool named "${instructions.name}" with the file and data, then pass { source: "uploadReference", file } to createDocument or updateDocument.`
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Upload instructions for collection "${collectionSlug}":\n\`\`\`json\n${JSON.stringify(instructions)}\n\`\`\`\n${nextStep}`,
+        },
+      ],
+      structuredContent: { instructions },
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Unknown error'
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error getting upload instructions for collection "${collectionSlug}": ${message}`,
+        },
+      ],
+      isError: true,
+    }
+  }
+})

package/src/mcp/builtin/getConfigInfoTool.ts

@@ -12,10 +12,8 @@ export const getConfigInfoTool = defineTool({
   },
   description: 'List the Payload collection and global slugs visible to this MCP client.',
 }).handler(async ({ authorizedMCP, req }) => {
-  const user = authorizedMCP.user
-  const permissions = authorizedMCP.overrideAccess
-    ? null
-    : await getAccessResults({ req: { ...req, user } })
+  const user = req.user
+  const permissions = authorizedMCP.overrideAccess ? null : await getAccessResults({ req })
   const authorizedCollectionSlugs = new Set<string>()
   const authorizedGlobalSlugs = new Set<string>()
 

package/src/mcp/builtin/globals/countVersionsTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -21,10 +20,7 @@ export const countGlobalVersionsTool = defineGlobalTool({
   },
   description: DEFAULT_DESCRIPTION,
   input: z.object({
-    locale: z
-      .string()
-      .describe('Optional: locale code to count versions in')
-      .optional(),
+    locale: z.string().describe('Optional: locale code to count versions in').optional(),
     where: whereSchema
       .describe(
         'Optional: where clause for filtering versions. Version document fields are usually under "version". Example: {"version.siteName":{"contains":"test"}}',
@@ -41,8 +37,8 @@ export const countGlobalVersionsTool = defineGlobalTool({
   try {
     const result = await payload.countGlobalVersions({
       global: globalSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(where ? { where } : {}),
     })

package/src/mcp/builtin/globals/findTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION = 'Find any Payload global by passing the global slug.'
 
@@ -66,7 +65,8 @@ export const findGlobalTool = defineGlobalTool({
     const findOptions: Parameters<typeof payload.findGlobal>[0] = {
       slug: globalSlug,
       depth,
-      ...localAPIDefaults(authorizedMCP),
+      overrideAccess: authorizedMCP.overrideAccess,
+      req,
     }
 
     if (locale) {

package/src/mcp/builtin/globals/findVersionByIDTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
 const DEFAULT_DESCRIPTION =
   'Find a specific global version in any version-enabled global by passing the global slug and version ID.'
@@ -70,8 +69,8 @@ export const findGlobalVersionByIDTool = defineGlobalTool({
       id,
       slug: globalSlug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(populate ? { populate: populate as PopulateType } : {}),

package/src/mcp/builtin/globals/findVersionsTool.ts

@@ -5,7 +5,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -110,9 +109,9 @@ export const findGlobalVersionsTool = defineGlobalTool({
       slug: globalSlug,
       depth,
       limit,
+      overrideAccess: authorizedMCP.overrideAccess,
       page,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(pagination !== undefined ? { pagination } : {}),

package/src/mcp/builtin/globals/getGlobalSchemaTool.ts

@@ -1,3 +1,5 @@
+import { getAccessResults } from 'payload'
+
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getGlobalInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
@@ -6,7 +8,7 @@ export const getGlobalSchemaTool = defineGlobalTool({
   access: (args) => {
     const permissions = args.permissions?.globals?.[args.globalSlug]
 
-    return defaultAccess(args) && Boolean(permissions?.read || permissions?.update)
+    return defaultAccess(args) && Boolean(permissions?.update)
   },
   annotations: {
     destructiveHint: false,
@@ -16,8 +18,28 @@ export const getGlobalSchemaTool = defineGlobalTool({
     title: 'Get Global Schema',
   },
   description: 'Get the input schema for updating a global.',
-}).handler(({ globalSlug, req }) => {
-  const inputSchema = getGlobalInputSchema({ globalSlug, req })
+}).handler(async ({ authorizedMCP, globalSlug, req }) => {
+  const permissions = authorizedMCP.overrideAccess
+    ? null
+    : (await getAccessResults({ req })).globals?.[globalSlug]
+
+  if (!authorizedMCP.overrideAccess && !permissions?.update) {
+    return {
+      content: [
+        {
+          type: 'text',
+          text: `Error: MCP access to "getGlobalSchema" is not enabled for global "${globalSlug}"`,
+        },
+      ],
+      isError: true,
+    }
+  }
+
+  const inputSchema = getGlobalInputSchema({
+    globalSlug,
+    req,
+    ...(permissions ? { permissions } : {}),
+  })
 
   if (!inputSchema) {
     return {

package/src/mcp/builtin/globals/restoreVersionTool.ts

@@ -5,9 +5,9 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 
-const DEFAULT_DESCRIPTION = 'Restore a global from a previous version in any version-enabled global.'
+const DEFAULT_DESCRIPTION =
+  'Restore a global from a previous version in any version-enabled global.'
 
 export const restoreGlobalVersionTool = defineGlobalTool({
   access: (args) =>
@@ -61,8 +61,8 @@ export const restoreGlobalVersionTool = defineGlobalTool({
       id,
       slug: globalSlug,
       depth,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
       ...(populate ? { populate: populate as PopulateType } : {}),

package/src/mcp/builtin/globals/updateTool.ts

@@ -9,7 +9,6 @@ import {
   getGlobalVirtualFieldNames,
   stripVirtualFields,
 } from '../../../utils/getVirtualFieldNames.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateGlobalData } from '../validateEntityData.js'
 
@@ -81,7 +80,8 @@ export const updateGlobalTool = defineGlobalTool({
       data: parsedData,
       depth,
       draft,
-      ...localAPIDefaults(authorizedMCP),
+      overrideAccess: authorizedMCP.overrideAccess,
+      req,
     }
 
     if (locale) {

package/src/mcp/builtinTools.ts

@@ -20,6 +20,7 @@ import { findVersionsTool } from './builtin/collections/findVersionsTool.js'
 import { getCollectionSchemaTool } from './builtin/collections/getCollectionSchemaTool.js'
 import { restoreVersionTool } from './builtin/collections/restoreVersionTool.js'
 import { updateDocumentTool } from './builtin/collections/updateTool.js'
+import { getUploadInstructionsTool } from './builtin/collections/uploadInstructionsTool.js'
 import { getConfigInfoTool } from './builtin/getConfigInfoTool.js'
 import { countGlobalVersionsTool } from './builtin/globals/countVersionsTool.js'
 import { findGlobalTool } from './builtin/globals/findTool.js'
@@ -32,6 +33,7 @@ import { updateGlobalTool } from './builtin/globals/updateTool.js'
 type CollectionBuiltin = {
   mcpName: string
   requiresDuplicateEnabled?: boolean
+  requiresUpload?: boolean
   requiresVersions?: boolean
   tool: CollectionTool
 }
@@ -70,6 +72,11 @@ export const COLLECTION_BUILTINS = {
   },
   findVersions: { mcpName: 'findVersions', requiresVersions: true, tool: findVersionsTool },
   getCollectionSchema: { mcpName: 'getCollectionSchema', tool: getCollectionSchemaTool },
+  getUploadInstructions: {
+    mcpName: 'getUploadInstructions',
+    requiresUpload: true,
+    tool: getUploadInstructionsTool,
+  },
   restoreVersion: { mcpName: 'restoreVersion', requiresVersions: true, tool: restoreVersionTool },
   update: { mcpName: 'updateDocument', tool: updateDocumentTool },
 } satisfies Record<string, CollectionBuiltin>

package/src/mcp/sanitizeMCPConfig.ts

@@ -127,7 +127,7 @@ const sanitizeCollectionConfig = ({
 
   for (const [
     toolKey,
-    { mcpName, requiresDuplicateEnabled, requiresVersions, tool },
+    { mcpName, requiresDuplicateEnabled, requiresUpload, requiresVersions, tool },
   ] of COLLECTION_BUILTIN_ENTRIES) {
     if (requiresVersions && !collection.versions) {
       continue
@@ -135,6 +135,9 @@ const sanitizeCollectionConfig = ({
     if (requiresDuplicateEnabled && isDuplicateDisabled) {
       continue
     }
+    if (requiresUpload && !collection.upload) {
+      continue
+    }
     const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]
     if (matchedConfigEntry === false) {
       continue

package/src/types.ts

@@ -15,7 +15,6 @@ import type {
   MaybePromise,
   PayloadRequest,
   SanitizedPermissions,
-  User,
 } from 'payload'
 
 import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
@@ -99,6 +98,11 @@ export type GlobalToolHandlerArgs<TSchema = undefined> = {
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  /**
+   * Runs while authorizing each MCP request, before the tool is advertised or called. Return
+   * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`
+   * is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description: string
@@ -113,6 +117,12 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  /**
+   * Runs while authorizing each MCP request for this collection. Return `false` to reject calls
+   * to this tool for the collection. The shared tool is not advertised when no collections allow
+   * it, but can remain advertised when it is available for another collection. This is skipped
+   * when `overrideAccess` is enabled.
+   */
   access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
@@ -120,6 +130,12 @@ export type CollectionTool<
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    /**
+     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to
+     * this tool for the global. The shared tool is not advertised when no globals allow it, but
+     * can remain advertised when it is available for another global. This is skipped when
+     * `overrideAccess` is enabled.
+     */
     access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
     input?: TSchema
@@ -131,6 +147,10 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * required handler) from being silently accepted at a built-in key slot.
  */
 export type MCPBuiltInCollectionToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this collection. This is skipped when `overrideAccess` is enabled.
+   */
   access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
@@ -139,6 +159,10 @@ export type MCPBuiltInCollectionToolOverride = {
 }
 
 export type MCPBuiltInGlobalToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this global. This is skipped when `overrideAccess` is enabled.
+   */
   access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
@@ -183,6 +207,11 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  /**
+   * Runs while authorizing each MCP request, before the prompt is advertised or used. Return
+   * `false` to make the prompt unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
@@ -201,6 +230,11 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  /**
+   * Runs while authorizing each MCP request, before the resource is advertised or read. Return
+   * `false` to make the resource unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
   access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
@@ -248,7 +282,12 @@ export type MCPPluginConfig = {
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  /** Replace the default MCP authorization resolver. */
+  /**
+   * Replace the default MCP authorization resolver.
+   *
+   * This hook replaces the default authentication flow. It must set `req.user` to the
+   * authenticated Payload user, or to `null` for an anonymous caller, before returning.
+   */
   overrideGetAuthorizedMCP?: (
     args: {
       pluginConfig: SanitizedMCPPluginConfig
@@ -312,13 +351,10 @@ export type MCPItem =
   | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items authorized for this request. Disabled
- * items and items blocked by access callbacks or Payload operation access are
- * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
- * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]
   overrideAccess: boolean
-  user: null | User
 }

package/src/utils/schemaConversion/filterFieldsByAccess.ts

@@ -0,0 +1,123 @@
+import type {
+  FlattenedBlock,
+  FlattenedField,
+  Operation,
+  SanitizedDocumentPermissions,
+  SanitizedFieldsPermissions,
+} from 'payload'
+
+type FieldOperation = Exclude<Operation, 'delete'>
+type AllowedFieldOperations = Record<FieldOperation, boolean>
+
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */
+export const filterFieldsByAccess = ({
+  blocks,
+  fields,
+  permissions,
+  shouldExcludeField,
+}: {
+  blocks?: FlattenedBlock[]
+  fields: FlattenedField[]
+  permissions: SanitizedDocumentPermissions
+  shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean
+}): FlattenedField[] => {
+  const filterFields = (
+    nestedFields: FlattenedField[],
+    nestedPermissions: SanitizedFieldsPermissions | undefined,
+    parentAllowedOperations: AllowedFieldOperations,
+  ): FlattenedField[] => {
+    const accessibleFields: FlattenedField[] = []
+
+    for (const field of nestedFields) {
+      const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name]
+      const isOperationAllowed = (operation: FieldOperation): boolean =>
+        parentAllowedOperations[operation] &&
+        (fieldPermissions === true || fieldPermissions?.[operation] === true)
+      const allowedOperations: AllowedFieldOperations = {
+        create: isOperationAllowed('create'),
+        read: isOperationAllowed('read'),
+        update: isOperationAllowed('update'),
+      }
+
+      if (shouldExcludeField(allowedOperations)) {
+        continue
+      }
+
+      if (field.type === 'blocks') {
+        const accessibleBlocks: (FlattenedBlock | string)[] = []
+
+        for (const blockOrReference of field.blocks) {
+          const block =
+            typeof blockOrReference === 'string'
+              ? blocks?.find(({ slug }) => slug === blockOrReference)
+              : blockOrReference
+
+          if (!block) {
+            continue
+          }
+
+          const blockPermissions =
+            fieldPermissions === true
+              ? true
+              : fieldPermissions?.blocks === true
+                ? true
+                : fieldPermissions?.blocks?.[block.slug]
+
+          accessibleBlocks.push({
+            ...block,
+            flattenedFields: filterFields(
+              block.flattenedFields,
+              blockPermissions === true ? true : blockPermissions?.fields,
+              allowedOperations,
+            ),
+          })
+        }
+
+        if (accessibleBlocks.length === 0) {
+          continue
+        }
+
+        accessibleFields.push({ ...field, blocks: accessibleBlocks })
+        continue
+      }
+
+      if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {
+        accessibleFields.push({
+          ...field,
+          flattenedFields: filterFields(
+            field.flattenedFields,
+            fieldPermissions === true ? true : fieldPermissions?.fields,
+            allowedOperations,
+          ),
+        })
+        continue
+      }
+
+      accessibleFields.push(field)
+    }
+
+    return accessibleFields
+  }
+
+  return filterFields(fields, permissions.fields, {
+    create: 'create' in permissions && permissions.create === true,
+    read: permissions.read === true,
+    update: permissions.update === true,
+  })
+}