import { RuntimeErrorQueryNode } from '../query-tree/errors.js';
import type { AccessOperation, AuthContext } from './auth-basics.js';
import type { PermissionDescriptor } from './permission-descriptors.js';
/**
 * Identifies the operation of a PERMISSION_DENIED error
 *
 * Use describeAccessCondition() with the same auth context to find out which permissions apply
 * to the user.
 */
export interface PermissionDenial {
    readonly operation: `${AccessOperation}`;
    /**
     * The name of the root entity type (for denials on objects) or of the declaring type (for
     * denials on fields)
     */
    readonly typeName: string;
    /**
     * The field name, for denials on fields
     */
    readonly fieldName?: string;
}
/**
 * Gets the operation that has been denied if the given error is a PERMISSION_DENIED error
 *
 * Works with errors that are reported for parts of the result (e.g. when reading a type or a
 * field is denied) and with errors that abort a mutation (e.g. when an object to be updated does
 * not match the user's permissions), including GraphQL errors that wrap them.
 */
export declare function getPermissionDenial(error: unknown): PermissionDenial | undefined;
export interface CreatePermissionDeniedNodeParams {
    readonly permissionDescriptor: PermissionDescriptor;
    readonly authContext: AuthContext;
    readonly operation: AccessOperation;
    readonly typeName: string;
    readonly fieldName?: string;
    /**
     * The message for the user, e.g. "Not authorized to read File objects"
     */
    readonly message: string;
}
/**
 * Creates a PERMISSION_DENIED error node for an operation that is denied regardless of the objects
 */
export declare function createPermissionDeniedNode({ permissionDescriptor, authContext, operation, typeName, fieldName, message, }: CreatePermissionDeniedNodeParams): RuntimeErrorQueryNode;