import { Request, Response, NextFunction } from 'express';
export interface AuthRequest extends Request {
    user?: {
        username: string;
    };
}
/**
 * Check if request originates from localhost.
 * Uses socket.remoteAddress directly — not req.ip — so this is NOT affected by
 * X-Forwarded-For even if `trust proxy` is enabled. A reverse proxy terminating
 * on the same host will still show as 127.0.0.1, which is acceptable: operator
 * opted in to that deployment.
 */
export declare function isLocalRequest(req: Request): boolean;
export declare function verifyToken(token: string): {
    username: string;
} | null;
/** Generate a JWT for local access (no credentials needed).
 * Requires config.json — callers (currently only `/api/auth/local-token`) must handle the throw.
 * Previously fell back to a constant-secret token; removed because any attacker who can coerce
 * the verifier into the same fallback path would forge admin tokens.
 */
export declare function generateLocalToken(): string;
export declare function authMiddleware(req: AuthRequest, res: Response, next: NextFunction): void;
//# sourceMappingURL=auth.d.ts.map