{"record":{"id":"62b96d03b0dd302e","repo":"apache/cassandra","slug":"s-doesn-t-exist-62b96d","errorCode":null,"errorMessage":"%s doesn't exist","messagePattern":"(.+?) doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/RoleManagementStatement.java","lineNumber":53,"sourceCode":"    protected final RoleResource grantee;\n\n    public RoleManagementStatement(RoleName name, RoleName grantee)\n    {\n        this.role = RoleResource.role(name.getName());\n        this.grantee = RoleResource.role(grantee.getName());\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        super.checkPermission(state, Permission.AUTHORIZE, role);\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        state.ensureNotAnonymous();\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            throw new InvalidRequestException(String.format(\"%s doesn't exist\", role.getRoleName()));\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))\n            throw new InvalidRequestException(String.format(\"%s doesn't exist\", grantee.getRoleName()));\n    }\n    \n    @Override\n    public String toString()\n    {\n        return ToStringBuilder.reflectionToString(this, ToStringStyle.SHORT_PREFIX_STYLE);\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":65,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/RoleManagementStatement.java#L35-L65","documentation":"RoleManagementStatement.validate() (GRANT/REVOKE family) verifies both the target role and the grantee exist in the configured IRoleManager before executing. This throw is the case where the ROLE side of the statement (the role being granted on) does not exist, raising InvalidRequestException '<role> doesn't exist'.","triggerScenarios":"GRANT <permission> ON resource TO role; where role (the first check) is not a registered role, e.g. GRANT SELECT ON ks.t TO analyst_role when analyst_role was never CREATE ROLEd or was DROPped.","commonSituations":"Typo in the role name; role dropped in another environment/cluster; running role statements before role management is set up (default RoleManager with no roles created); scripts replayed against a fresh cluster.","solutions":["CREATE ROLE analyst_role (with password/login as needed) before granting","Re-check spelling/case of the role name in the statement","List existing roles (system_auth.roles or LIST ROLES) to confirm the name","Re-create roles that were dropped when replaying setup scripts"],"exampleFix":"// before\nGRANT SELECT ON KEYSPACE ks TO analyst_role;\n// after\nCREATE ROLE analyst_role WITH login = true;\nGRANT SELECT ON KEYSPACE ks TO analyst_role;","handlingStrategy":"validation","validationCode":"const roles = await runCql('LIST ROLES'); if (!roles.includes(roleName)) throw new Error(`Role ${roleName} must be created before GRANT`);","typeGuard":null,"tryCatchPattern":"try { runCql(grant); } catch (e) { if (e.message.includes(\"doesn't exist\")) { await runCql(`CREATE ROLE ${roleName} WITH login = true`); await runCql(grant); } else throw e; }","preventionTips":["Run CREATE ROLE before any GRANT referencing the role in provisioning scripts","Keep role setup scripts idempotent and ordered","LIST ROLES to verify names before granting"],"tags":["cql","roles","authorization"],"backgroundTag":"resource-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}