{"record":{"id":"1103a32052f77683","repo":"apache/cassandra","slug":"s-is-not-a-member-of-s","errorCode":null,"errorMessage":"%s is not a member of %s","messagePattern":"(.+?) is not a member of (.+?)","errorType":"exception","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraRoleManager.java","lineNumber":433,"sourceCode":"        if (getRoles(role, true).contains(grantee))\n            throw new InvalidRequestException(String.format(\"%s is a member of %s\",\n                                                            role.getRoleName(),\n                                                            grantee.getRoleName()));\n\n        modifyRoleMembership(grantee.getRoleName(), role.getRoleName(), \"+\");\n        process(String.format(\"INSERT INTO %s.%s (role, member) values ('%s', '%s')\",\n                              SchemaConstants.AUTH_KEYSPACE_NAME,\n                              AuthKeyspace.ROLE_MEMBERS,\n                              escapeCqlLiteral(role.getRoleName()),\n                              escapeCqlLiteral(grantee.getRoleName())),\n                consistencyForRoleWrite(role.getRoleName()));\n    }\n\n    public void revokeRole(AuthenticatedUser performer, RoleResource role, RoleResource revokee)\n    throws RequestValidationException, RequestExecutionException\n    {\n        if (!getRoles(revokee, false).contains(role))\n            throw new InvalidRequestException(String.format(\"%s is not a member of %s\",\n                                                            revokee.getRoleName(),\n                                                            role.getRoleName()));\n\n        modifyRoleMembership(revokee.getRoleName(), role.getRoleName(), \"-\");\n        process(String.format(\"DELETE FROM %s.%s WHERE role = '%s' and member = '%s'\",\n                              SchemaConstants.AUTH_KEYSPACE_NAME,\n                              AuthKeyspace.ROLE_MEMBERS,\n                              escapeCqlLiteral(role.getRoleName()),\n                              escapeCqlLiteral(revokee.getRoleName())),\n                consistencyForRoleWrite(role.getRoleName()));\n    }\n\n    public Set<RoleResource> getRoles(RoleResource grantee, boolean includeInherited)\n    throws RequestValidationException, RequestExecutionException\n    {\n        return collectRoles(getRole(grantee.getRoleName()),\n                            includeInherited,\n                            filter(),","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraRoleManager.java#L415-L451","documentation":"InvalidRequestException from revokeRole when attempting to revoke a membership that does not exist: the grantee role is not currently a member of the named role. The manager checks current membership (including via getRoles with inherited membership) before deleting the row in system_auth.role_members, and this guard rejects the no-op revoke.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/CassandraRoleManager.java:433 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm current memberships with LIST ROLES or by querying system_auth.role_members","Revoke membership using the exact role/member pair that exists (roles and member direction are easy to swap)","Create the membership with GRANT before trying to REVOKE it"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}