hasura/graphql-engine · error · ModelPermissionError

in select filter permissions: {error}

Error message

in select filter permissions: {error}

What it means

SelectFilterPermissionTypePredicateError: the `filter` expression in a model's select permission failed to compile as a type predicate. The inner TypePredicateError explains the specific failure (unknown field, type mismatch in comparison, invalid operator usage). The select filter is typechecked against the model's underlying type.

Source

Thrown at v3/crates/metadata-resolve/src/stages/model_permissions/error.rs:50

        model_name: Spanned<Qualified<ModelName>>,
    },

    #[error("preset argument '{argument_name}' value has a type error: {type_error}")]
    ModelArgumentValuePresetTypeError {
        argument_name: Spanned<ArgumentName>,
        value_path: JSONPath,
        type_error: typecheck::TypecheckError,
    },

    #[error(
        "a preset argument '{argument_name}' has been set for the model '{model_name}' but no such argument exists for this model"
    )]
    ModelArgumentPresetArgumentNotFound {
        model_name: Spanned<Qualified<ModelName>>,
        argument_name: Spanned<ArgumentName>,
    },

    #[error("in select filter permissions: {error}")]
    SelectFilterPermissionTypePredicateError { error: TypePredicateError },

    #[error("unknown type {custom_type_name}")]
    UnknownType {
        custom_type_name: Qualified<CustomTypeName>,
    },

    #[error("model source is required to resolve relational permissions")]
    ModelSourceRequiredForRelationalPermissions,
    #[error("unknown collection {collection} in data connector {data_connector}")]
    UnknownModelCollection {
        data_connector: Qualified<DataConnectorName>,
        collection: open_dds::data_connector::CollectionName,
    },
    #[error("relational insert is not supported for this model")]
    RelationalInsertNotSupported,
    #[error("relational update is not supported for this model")]
    RelationalUpdateNotSupported,

View on GitHub (pinned to 724551b9ae)

Solutions

1. Read the inner {error} (TypePredicateError) to see which field/comparison failed
2. Fix the filter to reference existing fields with type-compatible values, casting session variables where supported
3. Re-run `ddn build` to validate filters against the current type definitions

Example fix

# before (id is Int)
filter:
  id:
    eq: X-Hasura-User-Id   # string session variable

# after
filter:
  id:
    eq: $X-Hasura-User-Id  # or cast/configure session variable as Int via claims map

null

// In Rust, when resolving metadata for a subgraph:
if let Err(e) = resolve_subgraph(subgraph) {
    if let Some(np) = e.downcast_ref::<NamedModelPermissionError>() {
        if matches!(np.error, ModelPermissionError::SelectFilterPermissionTypePredicateError { .. }) {
            // surface inner TypePredicateError + role span to the metadata author
        }
    }
}

When it happens

Trigger: Writing a select `filter` in model permissions that references a field not on the model's type, compares incompatible types, or uses a session variable/expression whose type doesn't match the field, during metadata resolution.

Common situations: Hand-writing filter YAML, session-variable based filters (X-Hasura-User-Id string vs Int column), schema evolution removing/renaming fields used in filters.

Related errors

• model source is required for model '{model_name:}' to resolv
• preset argument '{argument_name}' value has a type error: {t
• Type error in preset argument {argument_name:} {}in command
• Error in model permission for model '{model_name}'{}: {error
• preset argument '{argument_name}' is defined more than once

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/d5afea5e15f4abd8. Report an issue: GitHub.