{"record":{"id":"0dbd0f817f86da81","repo":"hasura/graphql-engine","slug":"the-command-command-name-uses-rules-based-author","errorCode":null,"errorMessage":"the command {command_name} uses rules-based authorization so will not appear in the GraphQL schema","messagePattern":"the command (.+?) uses rules-based authorization so will not appear in the GraphQL schema","errorType":"validation","errorClass":"CommandPermissionIssue::CommandUsesRulesBasedAuthorization","httpStatus":null,"severity":"warning","filePath":"v3/crates/metadata-resolve/src/stages/command_permissions/types.rs","lineNumber":70,"sourceCode":"pub enum CommandPermissionIssue {\n    #[error(\n        \"Type error in preset argument {argument_name:} {}in command {command_name:}: {typecheck_issue:}\", \n            {match role { Some(role) => format!(\"for role {role} \"), None => String::new()}}) \n    ]\n    CommandArgumentPresetTypecheckIssue {\n        role: Option<Role>,\n        command_name: Qualified<CommandName>,\n        argument_name: ArgumentName,\n        typecheck_issue: typecheck::TypecheckIssue,\n    },\n    #[error(\n        \"the object type {data_type} used as a return type for command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandReturnTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        data_type: Qualified<CustomTypeName>,\n    },\n    #[error(\n        \"the command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\n        \"the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema\"\n    )]\n    CommandArgumentTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        argument_type: Qualified<CustomTypeName>,\n    },\n}\n\nimpl ShouldBeAnError for CommandPermissionIssue {\n    fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {\n        match self {\n            CommandPermissionIssue::CommandArgumentPresetTypecheckIssue {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/metadata-resolve/src/stages/command_permissions/types.rs#L52-L88","documentation":"CommandUsesRulesBasedAuthorization warns that the command itself is authorized via rules-based authorization, which cannot be represented in the GraphQL schema, so the command will not appear as a GraphQL field. It is a resolution-stage warning that the command is effectively GraphQL-invisible.","triggerScenarios":"Defining command permissions for a command using the rules-based authorization form (rules engine) instead of boolean expressions/backend-only; resolving metadata then emits this warning for that command.","commonSituations":"Adopting rules-based authorization globally and applying it to commands without realizing commands cannot be exposed in GraphQL under it; feature-flag rollout of rules-based auth hitting existing commands.","solutions":["Switch the command's authorization to boolean-expression or backend-only permissions so it appears in the GraphQL schema","If the command must stay rules-based, expose its functionality through a different entry point (e.g. a model query or custom handler)","Suppress/acknowledge the warning if the command is intentionally GraphQL-hidden"],"exampleFix":"# before\ncommand_permissions:\n  my_command:\n    rules: [...]   # rules-based\n\n# after\ncommand_permissions:\n  my_command:\n    filter: [...]  # boolean-expression based\n# or backend_only: true","handlingStrategy":"validation","validationCode":"if command_permissions.is_rules_based() {\n    log::warn!(\"command {} uses rules-based auth and will not appear in the GraphQL schema\", command_name);\n}","typeGuard":null,"tryCatchPattern":"Capture as a warning from the resolve stage; do not abort, but track the command as GraphQL-invisible and adjust client queries accordingly.","preventionTips":["Use boolean-expression or backend-only permissions for GraphQL-exposed commands","When enabling rules-based auth, audit the command list first","Smoke-test the generated GraphQL schema to catch missing commands early"],"tags":["hasura","commands","authorization","rules-based","graphql-schema"],"backgroundTag":"rules-based-auth-incompatible","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}