/**
 * Auth Access Prompt Module
 *
 * Categories: missing_auth, security_bypass
 * Contains contradiction handling rules that require AI reasoning.
 * Heuristic-handled patterns (middleware awareness, throwing helpers) are NOT included.
 */
export declare const AUTH_ACCESS_MODULE = "\n### Authentication & Access Control\n\nFlag as REAL vulnerability (keep high severity) ONLY when:\n- Route has no visible auth check AND is NOT covered by middleware AND has no throwing auth helper\n- Sensitive operations without user scoping (cross-tenant access possible)\n- Auth checks that can be bypassed (e.g., checking wrong variable)\n\n**CRITICAL CONTRADICTION HANDLING**:\n- If we detect both \"protected by middleware\" and \"missing auth\" on the same route - REJECT the \"missing auth\" finding\n- If we detect both \"uses throwing auth helper\" and \"missing auth\" - REJECT the \"missing auth\" finding\n- Client components calling these protected API routes should NOT be flagged for \"missing auth\"\n- Adding \"if (!userId)\" after a throwing helper is a FALSE POSITIVE - reject it\n";
//# sourceMappingURL=auth-access.d.ts.map