{"record":{"id":"1d4a8bd66c70b07b","repo":"cube-js/cube","slug":"cube-references-are-not-allowed-when-evaluating-rl","errorCode":null,"errorMessage":"Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}","messagePattern":"Cube references are not allowed when evaluating RLS conditions or filters\\. Found: (.+?) in (.+?)","errorType":"validation","errorClass":"UserError","httpStatus":null,"severity":"error","filePath":"packages/cubejs-schema-compiler/src/compiler/CubeSymbols.ts","lineNumber":1181,"sourceCode":"      return [memberRef.name || path[path.length - 1], memberDefinition];\n    });\n  }\n\n  /**\n   * This method is mainly used for evaluating RLS conditions and filters.\n   * It allows referencing security_context (lowercase) in dynamic conditions or filter values.\n   *\n   * It currently does not support async calls because inner resolveSymbol and\n   * resolveSymbolsCall are sync. Async support may be added later with deeper\n   * refactoring.\n   */\n  public evaluateContextFunction(cube: any, contextFn: any, context: any = {}) {\n    return this.resolveSymbolsCall(contextFn, (name: string) => {\n      const resolvedSymbol = this.resolveSymbol(cube, name);\n      if (resolvedSymbol) {\n        return resolvedSymbol;\n      }\n      throw new UserError(\n        `Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}`\n      );\n    }, {\n      contextSymbols: {\n        securityContext: context.securityContext,\n      }\n    });\n  }\n\n  public evaluateReferences<T extends ToString | Array<ToString>>(\n    cube: string | null,\n    referencesFn: (...args: Array<unknown>) => T,\n    options: { collectJoinHints?: boolean, originalSorting?: boolean } = {}\n  ):\n  T extends Array<ToString> ? Array<string> : T extends ToString ? string : string | Array<string> {\n    const cubeEvaluator = this;\n\n    const fullPath = (joinHints, path) => {","sourceCodeStart":1163,"sourceCodeEnd":1199,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-schema-compiler/src/compiler/CubeSymbols.ts#L1163-L1199","documentation":"While evaluating a security context function (RLS context or filter values), the resolver encountered a reference to a cube symbol. This evaluation path intentionally resolves only the securityContext object — referencing cube members, measures or dimensions there is unsupported because resolveSymbolsCall runs synchronously without cube scope.","triggerScenarios":"Thrown at packages/cubejs-schema-compiler/src/compiler/CubeSymbols.ts:1181 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reference only security_context properties inside securityContext functions, e.g. securityContext.userId","Move logic that needs cube members into the member's own SQL or definition instead of the security context"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}