{"record":{"id":"64159b3bc413959c","repo":"prestodb/presto","slug":"cannot-add-a-constraint-to-table-s-s","errorCode":null,"errorMessage":"Cannot add a constraint to table %s%s","messagePattern":"Cannot add a constraint to table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":477,"sourceCode":"\n    public static void denyDropConstraint(String tableName)\n    {\n        denyDropConstraint(tableName, null);\n    }\n\n    public static void denyDropConstraint(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a constraint from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyAddConstraint(String tableName)\n    {\n        denyAddConstraint(tableName, null);\n    }\n\n    public static void denyAddConstraint(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot add a constraint to table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    private static Object formatExtraInfo(String extraInfo)\n    {\n        if (extraInfo == null || extraInfo.isEmpty()) {\n            return \"\";\n        }\n        return \": \" + extraInfo;\n    }\n}\n","sourceCodeStart":459,"sourceCodeEnd":488,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L459-L488","documentation":"denyAddConstraint throws AccessDeniedException when the access control layer denies adding a constraint to the given table. Adding constraints (e.g. primary keys, check constraints) is authorized via checkCanAddConstraint before the connector applies the change.","triggerScenarios":"A connector calls checkCanAddConstraint; its policy rejects the operation and calls denyAddConstraint(tableName, extraInfo), producing 'Cannot add a constraint to table <table><extraInfo>'.","commonSituations":"Enforcing data-integrity constraints in governance-heavy environments where DDL is locked down; users with table write but not alter privileges; policies enumerating privileges and missing ADD CONSTRAINT.","solutions":["Grant ADD CONSTRAINT / ALTER privilege to the principal in the access-control policy","Confirm the DDL targets a table covered by an existing allow rule (wildcards vs explicit names)","Use a privileged migration account for schema governance changes","If the connector/catalog does not support the constraint type, use an alternative mechanism instead of forcing policy changes"],"exampleFix":"// before\n{\"catalog\": \"hive\", \"group\": \"data-eng\", \"privileges\": [\"SELECT\", \"INSERT\"]}\n// after\n{\"catalog\": \"hive\", \"group\": \"data-eng\", \"privileges\": [\"SELECT\", \"INSERT\", \"ADD CONSTRAINT\"]}","handlingStrategy":"try-catch","validationCode":"// confirm ADD CONSTRAINT grant before DDL\nif (!grants(user, catalog, table).contains(\"ADD CONSTRAINT\")) {\n    throw new IllegalStateException(\"ADD CONSTRAINT not granted\");\n}","typeGuard":"boolean canAddConstraint(String user, String table, Map<String, Set<String>> grants) {\n    return grants.getOrDefault(user, Set.of()).stream().anyMatch(g -> g.contains(\"ADD CONSTRAINT\"));\n}","tryCatchPattern":"try {\n    conn.execute(\"ALTER TABLE t ADD CONSTRAINT pk_t PRIMARY KEY (id)\");\n} catch (AccessDeniedException e) {\n    LOG.warn(\"ADD CONSTRAINT denied: %s\", e.getMessage());\n    throw e;\n}","preventionTips":["Add ADD CONSTRAINT to policy privilege lists for governed DDL users","Keep table-name rules (wildcards vs explicit) aligned with the DDL targets","Test constraint DDL against staging policies before rollout","Review audit logs of denied constraint operations"],"tags":["presto","security","access-denied","constraints"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}