{"record":{"id":"ce1b686fd27d1f73","repo":"hasura/graphql-engine","slug":"model-permissions-for-model-model-name-not-found","errorCode":null,"errorMessage":"Model permissions for model {model_name} not found for role {role}","messagePattern":"Model permissions for model (.+?) not found for role (.+?)","errorType":"error_code","errorClass":"ArgumentPresetExecutionError","httpStatus":null,"severity":"error","filePath":"v3/crates/plan/src/query/arguments.rs","lineNumber":380,"sourceCode":"    #[error(\"expected {expected_type} but got a string\")]\n    GotString {\n        expected_type: QualifiedTypeReference,\n    },\n    #[error(\"expected {expected_type} but got an object\")]\n    GotObject {\n        expected_type: QualifiedTypeReference,\n    },\n    #[error(\"expected {expected_type} but got an array\")]\n    GotArray {\n        expected_type: QualifiedTypeReference,\n    },\n    #[error(\n        \"could not convert the provided header value to string as it contains non-visible ASCII characters\"\n    )]\n    IllegalCharactersInHeaderValue,\n    #[error(\"Model source not found for model '{model_name}'\")]\n    ModelSourceNotFound { model_name: Qualified<ModelName> },\n    #[error(\"Model permissions for model {model_name} not found for role {role}\")]\n    ModelArgumentPresetsNotFound {\n        role: Role,\n        model_name: Qualified<ModelName>,\n    },\n    #[error(\"command {command_name} does not have a source defined\")]\n    CommandSourceNotFound {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"command permissions for command {command_name} not found for role {role}\")]\n    CommandArgumentPresetsNotFound {\n        command_name: Qualified<CommandName>,\n        role: Role,\n    },\n    #[error(\"argument mapping not found for {argument_name}\")]\n    ArgumentMappingNotFound { argument_name: ArgumentName },\n    #[error(\"type mapping not found for object {object_type_name}\")]\n    TypeMappingNotFound {\n        object_type_name: Qualified<CustomTypeName>,","sourceCodeStart":362,"sourceCodeEnd":398,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plan/src/query/arguments.rs#L362-L398","documentation":"Thrown when the planner looks up per-role argument presets (model permissions) for a model and role combination and finds none. It means the current role has no permission/preset entry for the model being planned, so the planner cannot determine defaults or visibility for its arguments.","triggerScenarios":"Executing a query against a model under a role that has no permissions entry for that model — e.g. an anonymous or new role added to auth config without a matching model permission in metadata.","commonSituations":"Adding a new role to the auth configuration but forgetting its model permissions; restrictive role defaults after upgrading to a version that requires explicit per-role presets; typos in role names between auth headers and metadata.","solutions":["Add a permissions entry for the role and model in metadata (select/filter/argument presets as appropriate)","Check the exact role string sent by the client matches the role key in metadata (case-sensitive)","If the role should have no access, handle this error as an authorization failure rather than a bug","Reload metadata after permission changes"],"exampleFix":"// before\n{\"models\":{\"users\":{\"permissions\":{\"admin\":{}}}}}\n// after\n{\"models\":{\"users\":{\"permissions\":{\"admin\":{},\"user\":{}}}}}","handlingStrategy":"validation","validationCode":"// Check role has permissions for the model before planning\nfn role_has_model_permission(metadata: &Metadata, role: &Role, model: &Qualified<ModelName>) -> bool {\n    metadata.models.get(model)\n        .and_then(|m| m.permissions.as_ref())\n        .map(|p| p.contains_key(role)).unwrap_or(false)\n}","typeGuard":"fn is_model_presets_not_found(e: &ArgumentPresetExecutionError) -> bool {\n    matches!(e, ArgumentPresetExecutionError::ModelArgumentPresetsNotFound { .. })\n}","tryCatchPattern":"match result {\n    Err(PlanError::Arguments(ArgumentPresetExecutionError::ModelArgumentPresetsNotFound { role, model_name })) => {\n        respond_forbidden(format!(\"role {role} has no permissions on {model_name}\"));\n    }\n    other => other,\n}","preventionTips":["Define a fallback/default role permission for every model","Automate a checklist: new role -> add permissions for all models and commands","Test each role against a representative query in CI"],"tags":["rust","permissions","roles","plan"],"backgroundTag":"role-permission-not-found","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}