/**
 * Built-in auth middleware handler
 * Validates the request's access token and sets the authenticated user on Auth
 *
 * Resolution is shared with `Auth.getBearerToken()` via `requestToken`, which
 * checks the Authorization header and then the auth cookie. This used to be a
 * second hand-rolled copy that stopped at the header, so a browser signed in
 * by cookie — the whole point of `cookie-auth.ts`, and what
 * `SocialCallbackAction` produces — was rejected here with 401 on every
 * protected route (#2306).
 */
export declare function authMiddleware(request: any): Promise<void>;
/**
 * The authenticated user, for a middleware or action that needs to reason
 * about one.
 *
 * Every authorization middleware in the scaffold used to open with the same
 * line:
 *
 *     const user = request.user || request._user || request._authenticatedUser
 *
 * Two things were wrong with it. `_user` is assigned nowhere in the framework,
 * so it was a dead term. And `user` is a lazily-resolving MACRO - a function -
 * so on any request carrying it, `user` WAS the function: truthy enough to
 * pass the "is anyone signed in" check, then missing every field the caller
 * went on to read, which surfaces as a confusing 403 rather than an honest
 * 401.
 *
 * Resolving it here means every caller agrees on what "the user" is, and the
 * answer is a user rather than a callable.
 */
export declare function authenticatedUser(request: any): Promise<any | undefined>;
/**
 * Auth middleware object with handle method (for compatibility with middleware loader)
 * @defaultValue `{ name: 'auth' }`
 */
export declare const authMiddlewareHandler: {
  /** @defaultValue 'auth' */
  name: string;
  handle: unknown
};