hasura/graphql-engine · warning · CommandPermissionIssue::CommandArgumentTypeUsesRulesBasedAuthorization

the object type {argument_type} used in arguments for the co

Error message

the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema

What it means

CommandArgumentTypeUsesRulesBasedAuthorization warns that an object type used in a command's arguments is rules-based-authorized. Because argument presets are applied through GraphQL input coercion backed by authorization, presets on such arguments cannot be applied in the GraphQL schema; the command may still exist but its presets for those object arguments are ignored.

Source

Thrown at v3/crates/metadata-resolve/src/stages/command_permissions/types.rs:76

        role: Option<Role>,
        command_name: Qualified<CommandName>,
        argument_name: ArgumentName,
        typecheck_issue: typecheck::TypecheckIssue,
    },
    #[error(
        "the object type {data_type} used as a return type for command {command_name} uses rules-based authorization so will not appear in the GraphQL schema"
    )]
    CommandReturnTypeUsesRulesBasedAuthorization {
        command_name: Qualified<CommandName>,
        data_type: Qualified<CustomTypeName>,
    },
    #[error(
        "the command {command_name} uses rules-based authorization so will not appear in the GraphQL schema"
    )]
    CommandUsesRulesBasedAuthorization {
        command_name: Qualified<CommandName>,
    },
    #[error(
        "the object type {argument_type} used in arguments for the command {command_name} uses rules-based authorization so any presets will not be applied in the GraphQL schema"
    )]
    CommandArgumentTypeUsesRulesBasedAuthorization {
        command_name: Qualified<CommandName>,
        argument_type: Qualified<CustomTypeName>,
    },
}

impl ShouldBeAnError for CommandPermissionIssue {
    fn should_be_an_error(&self, flags: &open_dds::flags::OpenDdFlags) -> bool {
        match self {
            CommandPermissionIssue::CommandArgumentPresetTypecheckIssue {
                typecheck_issue, ..
            } => typecheck_issue.should_be_an_error(flags),
            CommandPermissionIssue::CommandReturnTypeUsesRulesBasedAuthorization { .. }
            | CommandPermissionIssue::CommandUsesRulesBasedAuthorization { .. }
            | CommandPermissionIssue::CommandArgumentTypeUsesRulesBasedAuthorization { .. } => {
                false

View on GitHub (pinned to 724551b9ae)

Solutions

Move the argument object type to boolean-expression-based or backend-only authorization so presets apply
Verify at runtime that the intended preset restriction is actually enforced; if presets are skipped, enforce the restriction inside the command handler instead
Avoid rules-based authorization on types used as command arguments

Example fix

# before
object_type: UserFilterInput  # rules-based authorized
command_permissions:
  search:
    presets:
      filter: { tenant_id: $session.tenant_id }  # silently not applied

# after
# authorize UserFilterInput with boolean expressions/backend_only so presets apply

Defensive patterns

Strategy: validation

Validate before calling

for arg_type in command.argument_object_types() {
    if type_permissions[arg_type].is_rules_based() {
        log::warn!("presets on argument type {arg_type} of {} will not be applied in GraphQL", command.name);
    }
}

Try / catch

Log as a warning and, because presets may be skipped, enforce the equivalent restriction inside the command handler as a defense-in-depth check.

Prevention

Avoid rules-based auth on object types used as command arguments
Never rely solely on presets for security when argument types are rules-based; enforce in the handler
Test preset behavior end-to-end after changing type authorization

When it happens

Trigger: Declaring a command with an object-typed argument where that object type uses rules-based authorization, and also configuring argument presets for it during the command permissions stage.

Common situations: Using object types as command arguments (e.g. filter/input objects) with rules-based auth enabled on those types; presets silently not applying, causing unexpected authorization behavior in production.

Related errors

AI-assisted analysis of hasura/graphql-engine@724551b9ae (2026-08-28). Data as JSON: /api/errors/aedd4e4531687026. Report an issue: GitHub.