cube-js/cube · error · UserError

Cube references are not allowed when evaluating RLS conditio

Error message

Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}

What it means

While evaluating a security context function (RLS context or filter values), the resolver encountered a reference to a cube symbol. This evaluation path intentionally resolves only the securityContext object — referencing cube members, measures or dimensions there is unsupported because resolveSymbolsCall runs synchronously without cube scope.

Source

Thrown at packages/cubejs-schema-compiler/src/compiler/CubeSymbols.ts:1181

      return [memberRef.name || path[path.length - 1], memberDefinition];
    });
  }

  /**
   * This method is mainly used for evaluating RLS conditions and filters.
   * It allows referencing security_context (lowercase) in dynamic conditions or filter values.
   *
   * It currently does not support async calls because inner resolveSymbol and
   * resolveSymbolsCall are sync. Async support may be added later with deeper
   * refactoring.
   */
  public evaluateContextFunction(cube: any, contextFn: any, context: any = {}) {
    return this.resolveSymbolsCall(contextFn, (name: string) => {
      const resolvedSymbol = this.resolveSymbol(cube, name);
      if (resolvedSymbol) {
        return resolvedSymbol;
      }
      throw new UserError(
        `Cube references are not allowed when evaluating RLS conditions or filters. Found: ${name} in ${cube.name}`
      );
    }, {
      contextSymbols: {
        securityContext: context.securityContext,
      }
    });
  }

  public evaluateReferences<T extends ToString | Array<ToString>>(
    cube: string | null,
    referencesFn: (...args: Array<unknown>) => T,
    options: { collectJoinHints?: boolean, originalSorting?: boolean } = {}
  ):
  T extends Array<ToString> ? Array<string> : T extends ToString ? string : string | Array<string> {
    const cubeEvaluator = this;

    const fullPath = (joinHints, path) => {

View on GitHub (pinned to 7d981676b3)

Solutions

1. Reference only security_context properties inside securityContext functions, e.g. securityContext.userId
2. Move logic that needs cube members into the member's own SQL or definition instead of the security context

When it happens

Trigger: Thrown at packages/cubejs-schema-compiler/src/compiler/CubeSymbols.ts:1181 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/1d4a8bd66c70b07b. Report an issue: GitHub.