{"record":{"id":"eb05d9cfdbaf20e5","repo":"hasura/graphql-engine","slug":"no-permission-to-select-from-model-model-name","errorCode":null,"errorMessage":"no permission to select from model {model_name:}","messagePattern":"no permission to select from model (.+?)","errorType":"exception","errorClass":"PermissionError::ModelNotAccessible","httpStatus":null,"severity":"error","filePath":"v3/crates/plan/src/types.rs","lineNumber":67,"sourceCode":"}\n\n#[derive(Debug, thiserror::Error)]\n// errors thrown during permissions evaluation, but not necessary errors due to permisssions\npub enum PermissionError {\n    #[error(\"command {command_name:} could not be found\")]\n    CommandNotFound {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"no permission to select from command {command_name:}\")]\n    CommandNotAccessible {\n        command_name: Qualified<CommandName>,\n    },\n    #[error(\"model {model_name:} could not be found\")]\n    ModelNotFound { model_name: Qualified<ModelName> },\n    #[error(\"model {model_name:} has no source\")]\n    ModelHasNoSource { model_name: Qualified<ModelName> },\n\n    #[error(\"no permission to select from model {model_name:}\")]\n    ModelNotAccessible { model_name: Qualified<ModelName> },\n\n    #[error(\"object type {object_type_name:} could not be found\")]\n    ObjectTypeNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"no permission to select from type {object_type_name:}\")]\n    ObjectTypeNotAccessible {\n        object_type_name: Qualified<CustomTypeName>,\n    },\n    #[error(\"no permission to select from field {field_name:} in type {object_type_name:}\")]\n    ObjectFieldNotFound {\n        object_type_name: Qualified<CustomTypeName>,\n        field_name: FieldName,\n    },\n    #[error(\"Object boolean expression type {boolean_expression_type_name} could not be found\")]\n    ObjectBooleanExpressionTypeNotFound {\n        boolean_expression_type_name: Qualified<CustomTypeName>,","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/plan/src/types.rs#L49-L85","documentation":"PermissionError::ModelNotAccessible means permission evaluation found the model but the current role has no permission to select from it. The request is rejected at the permissions stage before any data source query is planned.","triggerScenarios":"Querying a model under a role with no select permission for that model — e.g. anonymous access to a table where only 'admin' has select granted, or a role whose permission entry was removed.","commonSituations":"New tables tracked but no permissions granted; role mismatch between JWT claims and metadata roles; environment drift where prod metadata lacks permissions present in dev; relying on admin-only defaults while testing with another role.","solutions":["Grant select permission on the model for the requesting role in metadata","Confirm the effective role from the session variables matches the role the permission is defined for","Audit permissions with the CLI/console for the failing model","If intentional, return a 403-style response to the client instead of treating it as an error"],"exampleFix":"// before\n// model \"users\": no select permission for role \"anon\"\n// after\nselect_permissions: [ { role: \"anon\", permission: { filter: {} } } ]","handlingStrategy":"try-catch","validationCode":"fn can_select_model(perms: &[ModelPermission], role: &str, model: &str) -> bool {\n    perms.iter().any(|p| p.model == model && p.role == role)\n}","typeGuard":null,"tryCatchPattern":"Match PermissionError::ModelNotAccessible, return 403 with the model name; never leak it to untrusted clients if the model is hidden.","preventionTips":["Grant select permissions when tracking new models","Keep dev/prod metadata permissions in sync via versioned metadata","Test queries under each real role, not only admin"],"tags":["rust","authorization","permissions","models","hasura"],"backgroundTag":"authorization-denied","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}