{"record":{"id":"1ae5f9e59232bef7","repo":"prestodb/presto","slug":"cannot-truncate-table-s-s","errorCode":null,"errorMessage":"Cannot truncate table %s%s","messagePattern":"Cannot truncate table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":247,"sourceCode":"\n    public static void denyDeleteTable(String tableName)\n    {\n        denyDeleteTable(tableName, null);\n    }\n\n    public static void denyDeleteTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot delete from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyTruncateTable(String tableName)\n    {\n        denyTruncateTable(tableName, null);\n    }\n\n    public static void denyTruncateTable(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot truncate table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames)\n    {\n        denyUpdateTableColumns(tableName, updatedColumnNames, null);\n    }\n\n    public static void denyUpdateTableColumns(String tableName, Set<String> updatedColumnNames, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot update columns [%s] in table %s%s\", updatedColumnNames, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyCreateView(String viewName)\n    {\n        denyCreateView(viewName, null);\n    }\n\n    public static void denyCreateView(String viewName, String extraInfo)","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L229-L265","documentation":"Presto throws this AccessDeniedException (PERMISSION_DENIED / ACCESS_DENIED) when the identity is not authorized to truncate a table. The connector's AccessControl.checkCanTruncateTable implementation denied TRUNCATE TABLE via denyTruncateTable. Truncation removes all rows, so most connectors restrict it to owners/admins or deny it entirely.","triggerScenarios":"Executing TRUNCATE TABLE t where the connector's checkCanTruncateTable(Identity, SchemaTableName) denies the user; some connectors deny truncation unconditionally because the underlying store cannot support it.","commonSituations":"Test-data reset scripts as non-owner users; connectors (e.g. read-only or append-only stores) that deny truncate by design; revoked admin roles after permission audits.","solutions":["Grant TRUNCATE/DELETE-style privilege or table ownership to the executing principal.","Run the truncate as an owner/admin account.","If the connector does not support truncation, drop and recreate the table instead (with DROP privilege).","Connector authors: implement checkCanTruncateTable with real authorization rather than unconditional denyTruncateTable."],"exampleFix":"// before\nTRUNCATE TABLE staging.t; -- Access Denied: Cannot truncate table staging.t\n\n// after\n-- as owner/admin\nTRUNCATE TABLE staging.t; -- OK\n","handlingStrategy":"validation","validationCode":"boolean canTruncate = grantsContain(showGrants(table), currentUser, \"DELETE\") || isOwner(table, currentUser);\nif (!canTruncate) {\n    throw new IllegalStateException(\"Principal lacks truncate privileges on \" + table);\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use drop-and-recreate instead of TRUNCATE when the connector denies truncation.","Restrict truncate-capable credentials to ops/admin accounts only.","Confirm connector support for TRUNCATE before including it in reset scripts.","Keep table ownership assigned to the owning team's principal."],"tags":["presto","security","authorization","truncate","ddl"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}