{"record":{"id":"0f9dd235deec4cdc","repo":"hasura/graphql-engine","slug":"no-permission-to-select-from-command-command-name","errorCode":null,"errorMessage":"no permission to select from command {command_name:}","messagePattern":"no permission to select from command (.+?)","errorType":"exception","errorClass":"PermissionError::CommandNotAccessible","httpStatus":null,"severity":"error","filePath":"v3/crates/plan/src/types.rs","lineNumber":58,"sourceCode":"            Self::Permission(permission_error) => permission_error.visibility(),\n            Self::Relationship(relationship_error) => relationship_error.visibility(),\n            Self::OrderBy(order_by_error) => order_by_error.visibility(),\n            Self::BooleanExpression(boolean_expression_error) => {\n                boolean_expression_error.visibility()\n            }\n            Self::Internal(_) => ErrorVisibility::Internal,\n        }\n    }\n}\n\n#[derive(Debug, thiserror::Error)]\n// errors thrown during permissions evaluation, but not necessary errors due to permisssions\npub enum PermissionError {\n    #[error(\"command {command_name:} could not be found\")]\n    CommandNotFound {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"no permission to select from command {command_name:}\")]\n    CommandNotAccessible {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"model {model_name:} could not be found\")]\n    ModelNotFound { model_name: Qualified<ModelName> },\n    #[error(\"model {model_name:} has no source\")]\n    ModelHasNoSource { model_name: Qualified<ModelName> },\n\n    #[error(\"no permission to select from model {model_name:}\")]\n    ModelNotAccessible { model_name: Qualified<ModelName> },\n\n    #[error(\"object type {object_type_name:} could not be found\")]\n    ObjectTypeNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"no permission to select from type {object_type_name:}\")]\n    ObjectTypeNotAccessible {\n        object_type_name: Qualified<CustomTypeName>,","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plan/src/types.rs#L40-L76","documentation":"PermissionError::CommandNotAccessible is raised during permission evaluation when the requesting role has no select permission (or an explicit deny) for the named command, so the query is refused before planning proceeds. It is a permissions failure, distinct from CommandNotFound which means the command doesn't exist at all.","triggerScenarios":"Querying a command (custom query/mutation exposed by a data connector) under a role that lacks a permission entry allowing select/execute on it — e.g. as an anonymous user or a role without the command granted.","commonSituations":"Forgetting to add command permissions for the admin/anon/other roles; role name mismatch between the session/JWT role and metadata role definitions; testing a new command before attaching permissions; env differences where dev metadata has permissions but prod does not.","solutions":["Add a permission entry for the required role on the command (allow select/execute)","Verify the request's session role (X-Hasura-Role) matches a role defined in the command's permissions","If access should be denied, handle this error as an authorization response rather than a bug","Check for typos in role names in both metadata and JWT claims"],"exampleFix":"// before\n// command \"get_users\" has no permissions block\n// after\npermissions: [ { role: \"user\", actions: [\"select\"] } ]  // metadata for command get_users","handlingStrategy":"try-catch","validationCode":"// Before executing, check the role has permission for the command\nfn can_select_command(permissions: &[CommandPermission], role: &str, cmd: &str) -> bool {\n    permissions.iter().any(|p| p.command == cmd && p.role == role && p.can_select)\n}","typeGuard":null,"tryCatchPattern":"Match PermissionError::CommandNotAccessible and convert to an HTTP 403/authorization error for the client; do not retry.","preventionTips":["Define permissions for every role that will call each command","Automate metadata permission provisioning (IaC for Hasura metadata)","Log the requesting role on authorization failures to speed diagnosis"],"tags":["rust","authorization","permissions","commands","hasura"],"backgroundTag":"authorization-denied","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}