{"record":{"id":"d14b26fe3038053f","repo":"hasura/graphql-engine","slug":"no-permission-to-select-from-type-object-type-nam","errorCode":null,"errorMessage":"no permission to select from type {object_type_name:}","messagePattern":"no permission to select from type (.+?)","errorType":"exception","errorClass":"PermissionError::ObjectTypeNotAccessible","httpStatus":null,"severity":"error","filePath":"v3/crates/plan/src/types.rs","lineNumber":74,"sourceCode":"        command_name: Qualified<CommandName>,\n    },\n    #[error(\"no permission to select from command {command_name:}\")]\n    CommandNotAccessible {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"model {model_name:} could not be found\")]\n    ModelNotFound { model_name: Qualified<ModelName> },\n    #[error(\"model {model_name:} has no source\")]\n    ModelHasNoSource { model_name: Qualified<ModelName> },\n\n    #[error(\"no permission to select from model {model_name:}\")]\n    ModelNotAccessible { model_name: Qualified<ModelName> },\n\n    #[error(\"object type {object_type_name:} could not be found\")]\n    ObjectTypeNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"no permission to select from type {object_type_name:}\")]\n    ObjectTypeNotAccessible {\n        object_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"no permission to select from field {field_name:} in type {object_type_name:}\")]\n    ObjectFieldNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n        field_name: FieldName,\n    },\n    #[error(\"Object boolean expression type {boolean_expression_type_name} could not be found\")]\n    ObjectBooleanExpressionTypeNotFound {\n        boolean_expression_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"Relationship {relationship_name} not found for object type {object_type_name}\")]\n    RelationshipNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n        relationship_name: RelationshipName,\n    },\n    #[error(","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plan/src/types.rs#L56-L92","documentation":"PermissionError::ObjectTypeNotAccessible is thrown when the role has no permission to select the named object type (a custom/structured type). Permission evaluation for the type-level selection fails, blocking queries that return that object type.","triggerScenarios":"Selecting fields of an object type (or a model whose output type is that object type) under a role that has no type-level select permission granted for the object type in metadata.","commonSituations":"Custom object types added without type permissions for non-admin roles; roles granted model permissions but missing the accompanying object-type permission; role name mismatches; metadata migrations dropping type permissions.","solutions":["Add select permission for the object type for the requesting role","Ensure every role that can query models returning this type also has permission on the type itself","Verify role names between session variables and metadata","Re-run metadata consistency checks/apply after permission edits"],"exampleFix":"// before\n// object type \"Address\": no permissions for role \"user\"\n// after\nobject_type_permissions: [ { type: \"Address\", role: \"user\", actions: [\"select\"] } ]","handlingStrategy":"try-catch","validationCode":"fn can_select_type(perms: &[TypePermission], role: &str, ty: &str) -> bool {\n    perms.iter().any(|p| p.type_name == ty && p.role == role)\n}","typeGuard":null,"tryCatchPattern":"Match PermissionError::ObjectTypeNotAccessible and map to a 403 authorization response naming the object type for admins only.","preventionTips":["Grant type-level permissions alongside model permissions","Run metadata consistency checks after permission edits","Automate permission rollout with metadata migrations"],"tags":["rust","authorization","permissions","object-types","hasura"],"backgroundTag":"authorization-denied","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}