/**
 * Authentication Middleware
 *
 * Verifies JWT tokens from the Authorization header and attaches
 * decoded user info to the request. Supports both Supabase JWTs
 * (via JWKS) and locally-signed JWTs (via CREWLY_JWT_SECRET).
 *
 * In development mode (NODE_ENV !== 'production' and no JWT secret),
 * falls through with a placeholder user to allow local testing.
 *
 * @module middleware/require-auth
 */
import type { Request, Response, NextFunction } from 'express';
/** Shape of the decoded JWT payload we expect */
export interface JwtPayload {
    /** Subject — the user's unique ID */
    sub: string;
    /** User email address */
    email?: string;
    /** Subscription plan tier */
    plan?: string;
    /** Token issued-at timestamp (seconds) */
    iat?: number;
    /** Token expiration timestamp (seconds) */
    exp?: number;
}
/** User object attached to authenticated requests */
export interface AuthUser {
    userId: string;
    email: string;
    plan?: string;
}
/** Extended Request type with user attached */
export interface AuthenticatedRequest extends Request {
    user: AuthUser;
}
/**
 * Verify and decode an HS256 JWT token.
 *
 * @param token - The raw JWT string
 * @param secret - HMAC secret for signature verification
 * @returns Decoded payload or null if verification fails
 */
export declare function verifyHs256Token(token: string, secret: string): JwtPayload | null;
/**
 * Express middleware that enforces JWT authentication.
 *
 * Reads the token from the Authorization header (Bearer scheme).
 * On success, attaches `user` to the request. On failure, responds
 * with 401.
 *
 * In development (no JWT_SECRET and NODE_ENV !== 'production'),
 * falls through with a dev placeholder user.
 *
 * @param req - Express request
 * @param res - Express response
 * @param next - Express next function
 */
export declare const requireAuth: (req: Request, res: Response, next: NextFunction) => void;
//# sourceMappingURL=require-auth.middleware.d.ts.map