{"record":{"id":"576d49bdc0c3adeb","repo":"prestodb/presto","slug":"missing-role","errorCode":"MISSING_ROLE","errorMessage":"Role '%s' does not exist","messagePattern":"Role '(.+?)' does not exist","errorType":"error_code","errorClass":"SemanticException","httpStatus":null,"severity":"error","filePath":"presto-main-base/src/main/java/com/facebook/presto/execution/CreateRoleTask.java","lineNumber":59,"sourceCode":"    @Override\n    public String getName()\n    {\n        return \"CREATE ROLE\";\n    }\n\n    @Override\n    public ListenableFuture<?> execute(CreateRole statement, TransactionManager transactionManager, Metadata metadata, AccessControl accessControl, Session session, List<Expression> parameters, WarningCollector warningCollector, String query)\n    {\n        String catalog = createCatalogName(session, statement);\n        String role = statement.getName().getValueLowerCase();\n        Optional<PrestoPrincipal> grantor = statement.getGrantor().map(specification -> createPrincipal(session, specification));\n        accessControl.checkCanCreateRole(session.getRequiredTransactionId(), session.getIdentity(), session.getAccessControlContext(), role, grantor, catalog);\n        Set<String> existingRoles = metadata.listRoles(session, catalog);\n        if (existingRoles.contains(role)) {\n            throw new SemanticException(ROLE_ALREADY_EXIST, statement, \"Role '%s' already exists\", role);\n        }\n        if (grantor.isPresent() && grantor.get().getType() == ROLE && !existingRoles.contains(grantor.get().getName())) {\n            throw new SemanticException(MISSING_ROLE, statement, \"Role '%s' does not exist\", grantor.get().getName());\n        }\n        metadata.createRole(session, role, grantor, catalog);\n        return immediateFuture(null);\n    }\n}\n","sourceCodeStart":41,"sourceCodeEnd":65,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-main-base/src/main/java/com/facebook/presto/execution/CreateRoleTask.java#L41-L65","documentation":"CreateRoleTask.execute throws SemanticException(MISSING_ROLE) when the CREATE ROLE statement specifies a GRANTOR that is a ROLE type but that grantor role does not exist in the catalog's role set. The grantor must be an existing principal for authorization to be meaningful, so Presto rejects the statement before creating the new role.","triggerScenarios":"CREATE ROLE new_role GRANTOR ROLE some_role where some_role is not in metadata.listRoles for the target catalog (grantor type == ROLE and name not in existingRoles).","commonSituations":"Typo in the grantor role name; grantor role defined in a different catalog; provisioning scripts that reference roles not yet created; case sensitivity mistakes (names are lowercased).","solutions":["Create the grantor role first (CREATE ROLE grantor_role) before referencing it as GRANTOR.","Correct the grantor role name (check spelling and that it exists via SHOW ROLES / listRoles).","Omit the GRANTOR clause so the current user becomes the grantor.","Ensure the grantor role exists in the same catalog the new role is being created in."],"exampleFix":"-- before\nCREATE ROLE data_scientist GRANTOR ROLE data_eng; -- data_eng missing\n\n-- after\nCREATE ROLE data_eng;\nCREATE ROLE data_scientist GRANTOR ROLE data_eng;","handlingStrategy":"validation","validationCode":"Optional<PrestoPrincipal> grantor = statement.getGrantor().map(spec -> createPrincipal(session, spec));\nif (grantor.isPresent() && grantor.get().getType() == ROLE\n        && !metadata.listRoles(session, catalog).contains(grantor.get().getName())) {\n    throw new IllegalStateException(\"Grantor role \" + grantor.get().getName() + \" must be created first\");\n}","typeGuard":"boolean grantorRoleMissing(Session session, String catalog, Metadata metadata, PrestoPrincipal grantor) {\n    return grantor.getType() == ROLE && !metadata.listRoles(session, catalog).contains(grantor.getName());\n}","tryCatchPattern":"try {\n    createRole(session, statement);\n} catch (SemanticException e) {\n    if (e.getCode() == MISSING_ROLE) {\n        // create the referenced grantor role, then retry\n    } else {\n        throw e;\n    }\n}","preventionTips":["Order provisioning so grantor roles are created before roles granted by them","Validate GRANTOR role names against SHOW ROLES in the same catalog","Avoid cross-catalog assumptions: grantor must exist in the target catalog","Omit GRANTOR when the current user should simply be the grantor"],"tags":["presto","role","ddl","missing-role","access-control"],"backgroundTag":"missing-grantor-role","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}