{"record":{"id":"c1459d3d09702f6d","repo":"hasura/graphql-engine","slug":"session-variable-not-found-name","errorCode":null,"errorMessage":"Session variable not found: {name}","messagePattern":"Session variable not found: (.+?)","errorType":"error_code","errorClass":"ConditionError","httpStatus":null,"severity":"error","filePath":"v3/crates/auth/authorization-rules/src/condition.rs","lineNumber":15,"sourceCode":"//! this is where we evaluate Conditions\n\nuse std::fmt::Display;\n\nuse hasura_authn_core::{SessionVariableName, SessionVariables};\n\nuse crate::ConditionCache;\nuse metadata_resolve::{\n    BinaryOperation, Condition, ConditionHash, Conditions, UnaryOperation, ValueExpression,\n};\nuse open_dds::query::ArgumentName;\n\n#[derive(Debug, PartialEq, Eq, thiserror::Error)]\npub enum ConditionError {\n    #[error(\"Session variable not found: {name}\")]\n    SessionVariableNotFound { name: SessionVariableName },\n    #[error(\"Serde error: {error}\")]\n    SerdeError { error: String },\n    #[error(\"Condition {condition_hash} not found\")]\n    ConditionNotFound { condition_hash: ConditionHash },\n    #[error(\"Expected array or null for right-hand value of contains operation\")]\n    ExpectedArrayOrNullForContains,\n    #[error(\"Expected number for {side}-hand value of comparison operation\")]\n    ExpectedNumberForComparison { side: Side },\n    #[error(\n        \"Number for {side}-hand value of comparison operation is outside precision or range of a double-precision float\"\n    )]\n    NumberOutOfRange { side: Side },\n    #[error(\n        \"Tried to combine a predicate with a literal in argument presets for argument {argument_name}\"\n    )]\n    CouldNotCombinePredicateAndLiteralArgumentPresets { argument_name: ArgumentName },\n}","sourceCodeStart":1,"sourceCodeEnd":33,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/auth/authorization-rules/src/condition.rs#L1-L33","documentation":"Part of the authorization ConditionError enum in Hasura DD Nexus: while evaluating a role-based permission condition (model/command filter), the engine needs to substitute a session variable into the condition, but no such variable is present in the request's session context (claims from JWT/webhook auth).","triggerScenarios":"A permission rule referencing a session variable like `x_hasura_user_id` when the JWT/webhook for the current request does not contain that claim — e.g. logging in with a token from a different auth flow, or a typo in the role's comparison_expressions.","commonSituations":"Auth server stops emitting a claim; role config references a variable name that was renamed; anonymous requests hitting a role that requires user claims; env differences between dev/prod tokens.","solutions":["Inspect the decoded JWT (or webhook response) and confirm the claim matching the session variable exists (e.g. `x-hasura-user-id` maps to `x_hasura_user_id`)","Fix the auth server/token to include the required claim","Correct the session variable name in the role's comparison expression / permission rule","Grant an unauthenticated role for requests without claims if that is intended"],"exampleFix":"# before: JWT lacks the claim\n{ \"sub\": \"user1\" }\n# after\n{ \"sub\": \"user1\", \"https://hasura.io/jwt/claims\": { \"x-hasura-user-id\": \"user1\" } }","handlingStrategy":"validation","validationCode":"const claims = decodeJwtClaims(token);\nconst required = Object.keys(rule.sessionVars ?? {});\nconst missing = required.filter(v => !(v in claims));\nif (missing.length) throw new Error(`Missing session variables: ${missing.join(', ')}`);","typeGuard":"const hasSessionVariable = (claims: Record<string, unknown>, name: string): boolean => Object.prototype.hasOwnProperty.call(claims, name);","tryCatchPattern":"null","preventionTips":["Assert required claims exist before issuing tokens","Mirror claim names exactly (x-hasura-* -> x_hasura_*)","Provide an anonymous role for claim-less requests"],"tags":["auth","authorization","session-variables","jwt","hasura"],"backgroundTag":"missing-session-variable","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}