import { FastifyReply, FastifyRequest } from "fastify";
/**
 * Validates the session cookie against the in-memory SessionStore and decorates
 * `request.authUser`. Must run before `requireFreshPassword`/`requirePermission`
 * in a route's `preHandler` array.
 */
export declare function requireAuth(request: FastifyRequest, reply: FastifyReply): Promise<void>;
/**
 * Blocks access to any gated route while the caller still has a forced password
 * change pending. `GET /auth/me`, `PATCH /auth/change-password`, and `POST /auth/logout`
 * are intentionally not gated by this so a user can still see their own state and
 * complete the change.
 */
export declare function requireFreshPassword(request: FastifyRequest, reply: FastifyReply): Promise<void>;