{"record":{"id":"4e4ffe06c0fbe283","repo":"prestodb/presto","slug":"missing-role-4e4ffe","errorCode":"MISSING_ROLE","errorMessage":"Role '%s' does not exist","messagePattern":"Role '(.+?)' does not exist","errorType":"error_code","errorClass":"SemanticException","httpStatus":null,"severity":"error","filePath":"presto-main-base/src/main/java/com/facebook/presto/execution/RevokeRolesTask.java","lineNumber":74,"sourceCode":"                .collect(toImmutableSet());\n        boolean adminOptionFor = statement.isAdminOptionFor();\n        Optional<PrestoPrincipal> grantor = statement.getGrantor().map(specification -> createPrincipal(session, specification));\n        String catalog = createCatalogName(session, statement);\n\n        Set<String> availableRoles = metadata.listRoles(session, catalog);\n        Set<String> specifiedRoles = new LinkedHashSet<>();\n        specifiedRoles.addAll(roles);\n        grantees.stream()\n                .filter(principal -> principal.getType() == ROLE)\n                .map(PrestoPrincipal::getName)\n                .forEach(specifiedRoles::add);\n        if (grantor.isPresent() && grantor.get().getType() == ROLE) {\n            specifiedRoles.add(grantor.get().getName());\n        }\n\n        for (String role : specifiedRoles) {\n            if (!availableRoles.contains(role)) {\n                throw new SemanticException(MISSING_ROLE, statement, \"Role '%s' does not exist\", role);\n            }\n        }\n\n        accessControl.checkCanRevokeRoles(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), roles, grantees, adminOptionFor, grantor, catalog);\n        metadata.revokeRoles(session, roles, grantees, adminOptionFor, grantor, catalog);\n\n        return immediateFuture(null);\n    }\n}\n","sourceCodeStart":56,"sourceCodeEnd":84,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main-base/src/main/java/com/facebook/presto/execution/RevokeRolesTask.java#L56-L84","documentation":"Thrown by REVOKE ROLE statements when a role named in the statement (or used as grantor) is not defined in the catalog. Presto validates all referenced roles against the available roles from the metadata/access-control layer before performing any revocation, so nothing is modified when this fires. It is a semantic SQL error, not a runtime failure.","triggerScenarios":"Executing REVOKE roles FROM grantees (or ADMIN OPTION FOR / grantor of type ROLE) where a role name in the statement is not in the catalog's availableRoles set for the given catalog.","commonSituations":"Typo in the role name; role was dropped or never created; statement run against the wrong catalog where the role does not exist; case-sensitivity assumptions about role names.","solutions":["List existing roles (e.g. via the catalog's role metadata or SHOW-style tooling) and correct the role name in the REVOKE statement","Create the missing role first if it is genuinely needed","Verify you connected to the catalog where the role exists (roles are catalog-scoped)"],"exampleFix":"// before\nREVOKE role adming FROM USER bob;\n// after\nREVOKE role admin FROM USER bob;","handlingStrategy":"validation","validationCode":"// Before running REVOKE, confirm each role exists\nSet<String> available = metadata.listRoles(session, catalog); // or your connector's role listing\nfor (String role : roles) {\n    if (!available.contains(role)) {\n        throw new IllegalArgumentException(\"Role not found in \" + catalog + \": \" + role);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    metadata.revokeRoles(session, roles, grantees, adminOptionFor, grantor, catalog);\n} catch (SemanticException e) {\n    if (e.getCode() == SemanticErrorCode.MISSING_ROLE) {\n        // log and skip unknown role\n    } else {\n        throw e;\n    }\n}","preventionTips":["Keep role definitions in version-controlled provisioning scripts","Validate role names against listRoles before any GRANT/REVOKE","Remember roles are catalog-scoped; verify the session catalog"],"tags":["sql","security","roles","semantic-error"],"backgroundTag":"role-does-not-exist","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}