hasura/graphql-engine · error · Error

{0}

Error message

{0}

What it means

Wrapper error that surfaces accumulated auth config warnings as a single error when warnings-as-errors behavior is active (controlled by OpenDD flags). The inner payload lists each Warning (deprecations, invalid headers, etc.) separated by a separator; the build fails because those warnings were promoted to errors.

Source

Thrown at v3/crates/auth/hasura-authn/src/lib.rs:291

    InvalidHeaderValue(String, String),
}

impl Warning {
    pub fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {
        match self {
            Warning::InvalidHeaderName(_) | Warning::InvalidHeaderValue(_, _) => {
                flags.contains(open_dds::flags::Flag::DisallowInvalidHeadersInAuthConfig)
            }
            _ => false,
        }
    }
}

#[derive(Debug, thiserror::Error, PartialEq)]
pub enum Error {
    #[error("Invalid URL for auth webhook: {0}")]
    InvalidAuthWebhookUrl(String),
    #[error("{0}")]
    AuthConfigWarningsAsErrors(SeparatedBy<Warning>),
    #[error("Duplicate alternative mode identifier: '{0}'")]
    DuplicateAlternativeModeIdentifier(String),
}

// A small utility type which exists for the sole purpose of displaying a vector with a certain
// separator.
#[derive(Debug, PartialEq)]
pub struct SeparatedBy<T> {
    pub lines_of: Vec<T>,
    pub separator: String,
}

impl<T: Display> Display for SeparatedBy<T> {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        for (index, elem) in self.lines_of.iter().enumerate() {
            elem.fmt(f)?;
            if index < self.lines_of.len() - 1 {

View on GitHub (pinned to 724551b9ae)

Solutions

1. Read the contained warnings and fix each one (upgrade auth config version, fix headers, etc.)
2. Alternatively disable the OpenDD flag that promotes these warnings to errors, if strictness is not required
3. Re-run the build; the error disappears once no warnings remain

Example fix

// before
flags: { promoteAuthWarningsToErrors: true }
// with authConfig: { version: 2 } 
// after
flags: { promoteAuthWarningsToErrors: true }
// with authConfig: { version: 4 }

let warnings = lint_auth_config(&metadata);
if !warnings.is_empty() && flags.promote_warnings() {
    return Err(warnings.iter().map(ToString::to_string).collect::<Vec<_>>().join("; "));
}

match build_auth_config(&metadata) {
    Err(Error::AuthConfigWarningsAsErrors(list)) => {
        for w in list.iter() { log::warn!("auth warning: {w}"); }
        return Err("fix auth warnings before deploy".into());
    }
    r => r,
}

When it happens

Trigger: The `should_be_an_error` flag mapping returns true for the collected warnings (e.g. strict metadata validation flags), so all warnings are aggregated into AuthConfigWarningsAsErrors and returned as a build failure.

Common situations: Enabling strict/CI validation flags on a project whose auth metadata still has deprecation warnings (v1/v2/v3 configs) or invalid header names/values.

Related errors

• Tried to combine a predicate with a literal in argument pres
• Header '{0}', used in the auth config, is not a valid header
• Header value '{0}' is not a valid header value for header '{
• Invalid URL for auth webhook: {0}
• Duplicate alternative mode identifier: '{0}'

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/f9358ae09006d95d. Report an issue: GitHub.