{"record":{"id":"5f751a9303aa5871","repo":"prestodb/presto","slug":"cannot-select-from-view-s-s","errorCode":null,"errorMessage":"Cannot select from view %s%s","messagePattern":"Cannot select from view (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":312,"sourceCode":"\n    public static void denyDropView(String viewName)\n    {\n        denyDropView(viewName, null);\n    }\n\n    public static void denyDropView(String viewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop view %s%s\", viewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySelectView(String viewName)\n    {\n        denySelectView(viewName, null);\n    }\n\n    public static void denySelectView(String viewName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot select from view %s%s\", viewName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyGrantTablePrivilege(String privilege, String tableName)\n    {\n        denyGrantTablePrivilege(privilege, tableName, null);\n    }\n\n    public static void denyGrantTablePrivilege(String privilege, String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot grant privilege %s on table %s%s\", privilege, tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyRevokeTablePrivilege(String privilege, String tableName)\n    {\n        denyRevokeTablePrivilege(privilege, tableName, null);\n    }\n\n    public static void denyRevokeTablePrivilege(String privilege, String tableName, String extraInfo)","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L294-L330","documentation":"Thrown when the identity lacks SELECT privilege on a view. denySelectView fires from AccessControlManager.checkCanSelectFromView during query planning when a query reads from a view. View SELECT grants are separate from underlying table grants in Presto.","triggerScenarios":"Any query selecting from a view where the session identity is not granted SELECT on the view; e.g. SELECT * FROM analytics.daily with no grant on the view itself.","commonSituations":"Users granted SELECT on base tables but not the view (or vice versa); revoking view access to hide data while exposing tables; system access control file missing view rules.","solutions":["GRANT SELECT ON the view to the user/role","Verify whether underlying table grants are needed too (connector semantics) and grant accordingly","Use a role with view SELECT and SET ROLE before querying"],"exampleFix":"// before\nSELECT * FROM analytics.daily; -- AccessDeniedException\n// after (as admin)\nGRANT SELECT ON analytics.daily TO USER analyst;","handlingStrategy":"try-catch","validationCode":"boolean canSelect = catalogAdmin.userHasPrivilege(user, viewName, \"SELECT\");","typeGuard":null,"tryCatchPattern":"try {\n    return query(\"SELECT * FROM \" + viewName);\n} catch (AccessDeniedException e) {\n    log.error(\"SELECT on view {} denied for {}: {}\", viewName, user, e.getMessage());\n    throw new SecurityException(\"Request SELECT grant on the view\", e);\n}","preventionTips":["Grant SELECT on both views and the base tables your consumers need (per connector semantics)","Use roles so view access can be managed in one place","Audit view grants after refactors that add new views"],"tags":["security","authorization","views","select"],"backgroundTag":"access-denied","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}