{"record":{"id":"3a71a445f626a6ee","repo":"apache/cassandra","slug":"s-doesn-t-exist-3a71a4","errorCode":null,"errorMessage":"%s doesn't exist","messagePattern":"(.+?) doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/ListRolesStatement.java","lineNumber":104,"sourceCode":"    public void authorize(ClientState state) throws InvalidRequestException\n    {\n        // Authorization is enforced in execute(): a caller without DESCRIBE on the root roles\n        // resource may only view roles granted to them, and is rejected with UnauthorizedException\n        // before any existence check is reached.\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        // If the executing user has DESCRIBE permission on the root roles resource, let them list any and all roles\n        boolean hasRootLevelSelect = DatabaseDescriptor.getAuthorizer()\n                                                       .authorize(state.getUser(), RoleResource.root())\n                                                       .contains(Permission.DESCRIBE);\n        if (hasRootLevelSelect)\n        {\n            if (grantee == null)\n                return resultMessage(DatabaseDescriptor.getRoleManager().getAllRoles());\n            if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))\n                throw new InvalidRequestException(String.format(\"%s doesn't exist\", grantee));\n            return resultMessage(DatabaseDescriptor.getRoleManager().getRoles(grantee, recursive));\n        }\n        else\n        {\n            RoleResource currentUser = RoleResource.role(state.getUser().getName());\n            if (grantee == null)\n                return resultMessage(DatabaseDescriptor.getRoleManager().getRoles(currentUser, recursive));\n            if (DatabaseDescriptor.getRoleManager().getRoles(currentUser, true).contains(grantee))\n                return resultMessage(DatabaseDescriptor.getRoleManager().getRoles(grantee, recursive));\n            else\n                throw new UnauthorizedException(String.format(\"You are not authorized to view roles granted to %s \", grantee.getRoleName()));\n        }\n    }\n\n    private ResultMessage resultMessage(Set<RoleResource> roles)\n    {\n        if (roles.isEmpty())\n            return new ResultMessage.Void();","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/ListRolesStatement.java#L86-L122","documentation":"LIST ROLES OF <grantee> throws InvalidRequestException when the named grantee role does not exist, but only on the path where the caller has root-level SELECT/DESCRIBE permission on 'all roles'. Non-privileged users get the (nonexistent) empty view via the other branch instead.","triggerScenarios":"A user with DESCRIBE permission on RoleResource.root() executes LIST ROLES OF <role> (optionally with RECURSIVE) where isExistingRole(grantee) is false.","commonSituations":"Operators auditing roles after offboarding/cleanup; typos in role names; scripts run against a cluster where the role was never created.","solutions":["Verify existing roles with LIST ROLES; and fix the name","Create the missing role if expected","Omit OF <grantee> to list all roles you can see"],"exampleFix":"// before\nLIST ROLES OF temp_contractor; // already dropped\n// after\nLIST ROLES; // confirm existing roles first","handlingStrategy":"validation","validationCode":"boolean exists = DatabaseDescriptor.getRoleManager().isExistingRole(RoleResource.role(grantee));\nif (!exists) throw new IllegalArgumentException(grantee + \" doesn't exist\");","typeGuard":null,"tryCatchPattern":"try { session.execute(\"LIST ROLES OF \" + grantee); } catch (InvalidRequestException e) { if (e.getMessage().endsWith(\"doesn't exist\")) log.warn(\"skip unknown role {}\", grantee); else throw e; }","preventionTips":["Run LIST ROLES first to confirm the grantee exists","Keep role-name references in sync across environments","Treat 'doesn't exist' as skippable in audit tooling"],"tags":["cassandra","cql","roles","invalid-request"],"backgroundTag":"entity-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}