{"record":{"id":"5471e815e7e9a02d","repo":"prestodb/presto","slug":"cannot-drop-view-s-s","errorCode":null,"errorMessage":"Cannot drop view %s%s","messagePattern":"Cannot drop view (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":302,"sourceCode":"\n    public static void denyRenameView(String viewName, String newViewName)\n    {\n        denyRenameView(viewName, newViewName, null);\n    }\n\n    public static void denyRenameView(String viewName, String newViewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot rename view from %s to %s%s\", viewName, newViewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropView(String viewName)\n    {\n        denyDropView(viewName, null);\n    }\n\n    public static void denyDropView(String viewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop view %s%s\", viewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySelectView(String viewName)\n    {\n        denySelectView(viewName, null);\n    }\n\n    public static void denySelectView(String viewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from view %s%s\", viewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyGrantTablePrivilege(String privilege, String tableName)\n    {\n        denyGrantTablePrivilege(privilege, tableName, null);\n    }\n\n    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L284-L320","documentation":"Thrown when the identity lacks the DROP_VIEW privilege on a view. denyDropView is invoked from AccessControlManager.checkCanDropView when the connector authorizer rejects the operation. View drops are typically restricted to owners/admins.","triggerScenarios":"DROP VIEW <name> where checkCanDropView dispatches to the authorizer and denies the current identity.","commonSituations":"Cleanup scripts run by a service account without ownership; views created by departed employees; strict access-control configs requiring explicit DROP grants.","solutions":["Run DROP VIEW as the view owner or an admin","Change view ownership to the requesting principal (SET AUTHORIZATION)","Grant DROP_VIEW privilege in the access control configuration"],"exampleFix":"// before\nDROP VIEW analytics.daily; -- AccessDeniedException\n// after (as admin)\nALTER VIEW analytics.daily SET AUTHORIZATION cleanup_svc;\n-- run DROP VIEW as cleanup_svc","handlingStrategy":"try-catch","validationCode":"boolean canDrop = viewOwner.equals(requestingUser) || catalogAdmin.userHasPrivilege(requestingUser, view, \"DROP\");","typeGuard":null,"tryCatchPattern":"try {\n    execute(\"DROP VIEW \" + viewName);\n} catch (AccessDeniedException e) {\n    log.error(\"DROP VIEW denied for {}: {}\", currentUser, e.getMessage());\n    throw new SecurityException(\"Request DROP VIEW via the view owner or an admin\", e);\n}","preventionTips":["Track view ownership in metadata and route drops through owners","Give cleanup pipelines a dedicated principal that owns the views it drops","Document ownership transfer (SET AUTHORIZATION) in runbooks"],"tags":["security","authorization","views","drop"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}