{"record":{"id":"aedd4e4531687026","repo":"hasura/graphql-engine","slug":"the-object-type-argument-type-used-in-arguments","errorCode":null,"errorMessage":"the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema","messagePattern":"the object type (.+?) used in arguments for the command (.+?) uses rules-based authorization so any presets will not be applied in the GraphQL schema","errorType":"validation","errorClass":"CommandPermissionIssue::CommandArgumentTypeUsesRulesBasedAuthorization","httpStatus":null,"severity":"warning","filePath":"v3/crates/metadata-resolve/src/stages/command_permissions/types.rs","lineNumber":76,"sourceCode":"        role: Option<Role>,\n        command_name: Qualified<CommandName>,\n        argument_name: ArgumentName,\n        typecheck_issue: typecheck::TypecheckIssue,\n    },\n    #[error(\n        \"the object type {data_type} used as a return type for command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandReturnTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        data_type: Qualified<CustomTypeName>,\n    },\n    #[error(\n        \"the command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\n        \"the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema\"\n    )]\n    CommandArgumentTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        argument_type: Qualified<CustomTypeName>,\n    },\n}\n\nimpl ShouldBeAnError for CommandPermissionIssue {\n    fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {\n        match self {\n            CommandPermissionIssue::CommandArgumentPresetTypecheckIssue {\n                typecheck_issue, ..\n            } => typecheck_issue.should_be_an_error(flags),\n            CommandPermissionIssue::CommandReturnTypeUsesRulesBasedAuthorization { .. }\n            | CommandPermissionIssue::CommandUsesRulesBasedAuthorization { .. }\n            | CommandPermissionIssue::CommandArgumentTypeUsesRulesBasedAuthorization { .. } => {\n                false","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/metadata-resolve/src/stages/command_permissions/types.rs#L58-L94","documentation":"CommandArgumentTypeUsesRulesBasedAuthorization warns that an object type used in a command's arguments is rules-based-authorized. Because argument presets are applied through GraphQL input coercion backed by authorization, presets on such arguments cannot be applied in the GraphQL schema; the command may still exist but its presets for those object arguments are ignored.","triggerScenarios":"Declaring a command with an object-typed argument where that object type uses rules-based authorization, and also configuring argument presets for it during the command permissions stage.","commonSituations":"Using object types as command arguments (e.g. filter/input objects) with rules-based auth enabled on those types; presets silently not applying, causing unexpected authorization behavior in production.","solutions":["Move the argument object type to boolean-expression-based or backend-only authorization so presets apply","Verify at runtime that the intended preset restriction is actually enforced; if presets are skipped, enforce the restriction inside the command handler instead","Avoid rules-based authorization on types used as command arguments"],"exampleFix":"# before\nobject_type: UserFilterInput  # rules-based authorized\ncommand_permissions:\n  search:\n    presets:\n      filter: { tenant_id: $session.tenant_id }  # silently not applied\n\n# after\n# authorize UserFilterInput with boolean expressions/backend_only so presets apply","handlingStrategy":"validation","validationCode":"for arg_type in command.argument_object_types() {\n    if type_permissions[arg_type].is_rules_based() {\n        log::warn!(\"presets on argument type {arg_type} of {} will not be applied in GraphQL\", command.name);\n    }\n}","typeGuard":null,"tryCatchPattern":"Log as a warning and, because presets may be skipped, enforce the equivalent restriction inside the command handler as a defense-in-depth check.","preventionTips":["Avoid rules-based auth on object types used as command arguments","Never rely solely on presets for security when argument types are rules-based; enforce in the handler","Test preset behavior end-to-end after changing type authorization"],"tags":["hasura","commands","presets","authorization","rules-based"],"backgroundTag":"rules-based-auth-incompatible","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}