{"record":{"id":"70c8db21ebef1322","repo":"phacility/phabricator","slug":"1044-1142-1143-1227","errorCode":"1044, 1142, 1143, 1227","errorMessage":"#%d: %s\n\nThis error usually indicates that you need to \"GRANT\" the MySQL user additional permissions. See \"GRANT\" in the MySQL manual for help.","messagePattern":"#(.+?): (.+?)\n\nThis error usually indicates that you need to \"GRANT\" the MySQL user additional permissions\\. See \"GRANT\" in the MySQL manual for help\\.","errorType":"exception","errorClass":"AphrontAccessDeniedQueryException","httpStatus":null,"severity":"error","filePath":"src/infrastructure/storage/connection/mysql/AphrontBaseMySQLDatabaseConnection.php","lineNumber":360,"sourceCode":"        // NOTE: In some versions of MySQL we get a key name back here, but\n        // older versions just give us a key index (\"key 2\") so it's not\n        // portable to parse the key out of the error and attach it to the\n        // exception.\n        throw new AphrontDuplicateKeyQueryException($message);\n      case 1044: // Access denied to database\n      case 1142: // Access denied to table\n      case 1143: // Access denied to column\n      case 1227: // Access denied (e.g., no SUPER for SHOW SLAVE STATUS).\n\n        // See T13622. Try to help users figure out that this is a GRANT\n        // problem.\n\n        $more = pht(\n          'This error usually indicates that you need to \"GRANT\" the '.\n          'MySQL user additional permissions. See \"GRANT\" in the MySQL '.\n          'manual for help.');\n\n        throw new AphrontAccessDeniedQueryException(\"{$message}\\n\\n{$more}\");\n      case 1045: // Access denied (auth)\n        throw new AphrontInvalidCredentialsQueryException($message);\n      case 1146: // No such table\n      case 1049: // No such database\n      case 1054: // Unknown column \"...\" in field list\n        throw new AphrontSchemaQueryException($message);\n    }\n\n    // TODO: 1064 is syntax error, and quite terrible in production.\n\n    return null;\n  }\n\n  protected function throwConnectionException($errno, $error, $user, $host) {\n    $this->throwCommonException($errno, $error);\n\n    $message = pht(\n      'Attempt to connect to %s@%s failed with error #%d: %s.',","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/infrastructure/storage/connection/mysql/AphrontBaseMySQLDatabaseConnection.php#L342-L378","documentation":"The connected MySQL user is missing a privilege the statement needs: 1044 (database-level), 1142 (table-level), 1143 (column-level), or 1227 (statement-level, e.g. SUPER for SHOW SLAVE STATUS). The library maps all four to AphrontAccessDeniedQueryException and appends explicit 'run GRANT' guidance (task T13622) because the raw MySQL 'access denied' text routinely gets misdiagnosed as an auth failure. The connection itself is fine; only authorization for this statement failed.","triggerScenarios":"Querying a table or column outside the user's grants; running replication/cluster code that executes SHOW SLAVE STATUS / SHOW MASTER STATUS without SUPER or REPLICATION CLIENT; running bin/storage upgrade when the user cannot ALTER tables; accessing a database not covered by the grant pattern.","commonSituations":"Shared or managed MySQL where the DBA granted only specific databases/tables; a production account provisioned with just SELECT/INSERT; a new Phabricator feature touching INFORMATION_SCHEMA or replication status for the first time; grant pattern like user@'10.0.%' not matching the client host.","solutions":["Identify the failing statement, then grant the missing privilege: GRANT ALL PRIVILEGES ON `phabricator\\_%`.* TO 'user'@'host'; or the specific one (e.g. REPLICATION CLIENT, SUPER) and FLUSH PRIVILEGES if you edited grant tables directly","Compare reality vs expectation with SHOW GRANTS FOR CURRENT_USER(); from a Phabricator shell (bin/storage shell or a probe script)","Align the credentials in your Phabricator database configuration with an account that has the required grants","If you cannot widen grants, disable or reconfigure the feature issuing the privileged query"],"exampleFix":"-- before: user only has grants on one database\nGRANT SELECT, INSERT ON phabricator_worker.* TO 'phab'@'%';\n-- ...but code runs: SHOW SLAVE STATUS  => error 1227\n\n-- after: grant what the application actually needs\nGRANT ALL PRIVILEGES ON `phabricator\\_%`.* TO 'phab'@'%';\nGRANT REPLICATION CLIENT ON *.* TO 'phab'@'%';\nFLUSH PRIVILEGES;","handlingStrategy":"validation","validationCode":"// Preflight at deploy time: assert the grants the application needs.\n$grants = queryfx_all($conn, 'SHOW GRANTS FOR CURRENT_USER()');\n// Require coverage of `phabricator\\_%`.*, plus REPLICATION CLIENT (or SUPER)\n// on *.* if replication/cluster status queries run in this deployment.","typeGuard":null,"tryCatchPattern":"try {\n  queryfx($conn_w, '%s', $sql);\n} catch (AphrontAccessDeniedQueryException $ex) {\n  // The appended message names the GRANT fix; log it verbatim and alert ops —\n  // this is a deployment mismatch, not something to retry.","preventionTips":["Provision the MySQL account with grants over the whole application namespace (phabricator_%.*) before first deploy","When adding replication/cluster features, check the feature's documented privilege needs and grant them up front","Run SHOW GRANTS FOR CURRENT_USER() from a Phabricator shell after any account change","Include a privileges probe (bin/storage probe) in deployment smoke tests"],"tags":["mysql","permissions","grants","privileges","access-denied"],"backgroundTag":"database-access-denied","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}