{"record":{"id":"c1864f1bb6c05295","repo":"hasura/graphql-engine","slug":"the-object-type-data-type-used-as-a-return-type","errorCode":null,"errorMessage":"the object type {data_type} used as a return type for command {command_name} uses rules-based authorization so will not appear in the GraphQL schema","messagePattern":"the object type (.+?) used as a return type for command (.+?) uses rules-based authorization so will not appear in the GraphQL schema","errorType":"validation","errorClass":"CommandPermissionIssue::CommandReturnTypeUsesRulesBasedAuthorization","httpStatus":null,"severity":"warning","filePath":"v3/crates/metadata-resolve/src/stages/command_permissions/types.rs","lineNumber":63,"sourceCode":"    pub allow_execution: bool,\n    pub argument_presets:\n        BTreeMap<ArgumentName, (QualifiedTypeReference, ValueExpressionOrPredicate)>,\n}\n\n#[derive(Debug, thiserror::Error)]\n#[allow(clippy::enum_variant_names)]\npub enum CommandPermissionIssue {\n    #[error(\n        \"Type error in preset argument {argument_name:} {}in command {command_name:}: {typecheck_issue:}\", \n            {match role { Some(role) => format!(\"for role {role} \"), None => String::new()}}) \n    ]\n    CommandArgumentPresetTypecheckIssue {\n        role: Option<Role>,\n        command_name: Qualified<CommandName>,\n        argument_name: ArgumentName,\n        typecheck_issue: typecheck::TypecheckIssue,\n    },\n    #[error(\n        \"the object type {data_type} used as a return type for command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandReturnTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        data_type: Qualified<CustomTypeName>,\n    },\n    #[error(\n        \"the command {command_name} uses rules-based authorization so will not appear in the GraphQL schema\"\n    )]\n    CommandUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\n        \"the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema\"\n    )]\n    CommandArgumentTypeUsesRulesBasedAuthorization {\n        command_name: Qualified<CommandName>,\n        argument_type: Qualified<CustomTypeName>,","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/metadata-resolve/src/stages/command_permissions/types.rs#L45-L81","documentation":"CommandReturnTypeUsesRulesBasedAuthorization warns that a command's return object type uses rules-based authorization (row-level security rules evaluated via a command/rule engine) rather than backend-only/boolean expressions, so that type cannot be represented in the GraphQL schema. Commands returning such types are effectively dropped from the GraphQL API surface.","triggerScenarios":"Declaring a command whose return type is an object type whose type permissions use rules-based authorization; metadata resolution emits this warning during the command permissions stage.","commonSituations":"Migrating to rules-based authorization on an object type that is also a command return type; enabling the rules-based auth feature flag on existing types without realizing commands returning them stop appearing in GraphQL.","solutions":["Change the return type's authorization from rules-based to boolean-expression/backend-only permissions so it can appear in the GraphQL schema","Or accept the type will not be exposed via GraphQL and query it through another mechanism","Re-model the command to return a different object type that does not use rules-based authorization"],"exampleFix":"# before\ntype_permissions:\n  object_type: MonthlyUsage\n  rules: [... ]   # rules-based; command returns MonthlyUsage\n\n# after\ntype_permissions:\n  object_type: MonthlyUsage\n  filter: [...]   # boolean-expression based; command return appears in GraphQL","handlingStrategy":"validation","validationCode":"fn warn_if_return_type_rules_based(cmd: &Command, types: &TypePermissions) -> Option<String> {\n    types.get(&cmd.return_type).filter(|p| p.is_rules_based())\n        .map(|_| format!(\"command {} return type uses rules-based auth; hidden from GraphQL\", cmd.name))\n}","typeGuard":null,"tryCatchPattern":"Treat as a warning: log it and continue; do not fail the pipeline, but mark the command as absent from the GraphQL schema in docs.","preventionTips":["Do not use rules-based authorization on object types that are command return types","Review auth model changes against all command return types before rollout","Document which types are GraphQL-exposed vs internal"],"tags":["hasura","commands","authorization","rules-based","graphql-schema"],"backgroundTag":"rules-based-auth-incompatible","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}