import { Request, Response, NextFunction } from 'express';
export interface AuthUser {
    workspaceId: string;
    domainId?: string;
    orgId?: string;
    sub: string;
    [key: string]: any;
}
declare global {
    namespace Express {
        interface Request {
            user?: AuthUser;
        }
    }
}
export interface AuthMiddlewareOptions {
    jwtSecret: string;
    trustProxyAuth: boolean;
}
/**
 * Creates authentication middleware that supports two modes:
 *
 * 1. JWT Validation Mode (trustProxyAuth: false):
 *    - Validates JWT token from Authorization header
 *    - Extracts user claims from the token
 *    - Use when service is exposed directly without a gateway
 *
 * 2. Proxy Trust Mode (trustProxyAuth: true):
 *    - Trusts that an upstream proxy (like Kong) has already validated the JWT
 *    - Reads user info from headers set by the proxy:
 *      - x-workspace-id: The user's workspace ID
 *      - x-user-id: The user's subject/ID
 *    - Use when behind Kong or similar API gateway that handles JWT validation
 */
export declare function authMiddleware(options: AuthMiddlewareOptions): (req: Request, res: Response, next: NextFunction) => Response<any, Record<string, any>> | undefined;
//# sourceMappingURL=auth.d.ts.map