{"record":{"id":"7804181cbcba5422","repo":"apache/superset","slug":"database-doesn-t-exist-and-user-doesn-t-have-permi","errorCode":null,"errorMessage":"Database doesn't exist and user doesn't have permission to create databases","messagePattern":"Database doesn't exist and user doesn't have permission to create databases","errorType":"exception","errorClass":"ImportFailedError","httpStatus":500,"severity":"error","filePath":"superset/commands/database/importers/v1/utils.py","lineNumber":55,"sourceCode":"logger = logging.getLogger(__name__)\n\n\ndef import_database(  # noqa: C901\n    config: dict[str, Any],\n    overwrite: bool = False,\n    ignore_permissions: bool = False,\n) -> Database:\n    can_write = ignore_permissions or security_manager.can_access(\n        \"can_write\",\n        \"Database\",\n    )\n    existing = db.session.query(Database).filter_by(uuid=config[\"uuid\"]).first()\n    if existing:\n        if not overwrite or not can_write:\n            return existing\n        config[\"id\"] = existing.id\n    elif not can_write:\n        raise ImportFailedError(\n            \"Database doesn't exist and user doesn't have permission to create databases\"  # noqa: E501\n        )\n    # Check if this URI is allowed (skip for system imports like examples)\n    if app.config[\"PREVENT_UNSAFE_DB_CONNECTIONS\"] and not ignore_permissions:\n        try:\n            check_sqlalchemy_uri(make_url_safe(config[\"sqlalchemy_uri\"]))\n        except SupersetSecurityException as exc:\n            raise ImportFailedError(exc.message) from exc\n    # https://github.com/apache/superset/pull/16756 renamed ``csv`` to ``file``.\n    # Handle both old and new field names, defaulting to True for examples database\n    if \"allow_csv_upload\" in config:\n        config[\"allow_file_upload\"] = config.pop(\"allow_csv_upload\")\n    elif \"allow_file_upload\" not in config:\n        # Default to True for backward compatibility\n        config[\"allow_file_upload\"] = True\n\n    if \"schemas_allowed_for_csv_upload\" in config.get(\"extra\", {}):\n        config[\"extra\"][\"schemas_allowed_for_file_upload\"] = config[\"extra\"].pop(","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/database/importers/v1/utils.py#L37-L73","documentation":"ImportFailedError raised in superset/commands/database/importers/v1/utils.py (create_from_yaml / database config resolution) when the bundle's database UUID does not match any existing Database row and the current user lacks the 'can_write' permission on Database. Since the database must be created new but the user cannot create databases, the import aborts. Note can_write can be bypassed only when ignore_permissions is set (system/example imports), which normal REST imports do not set.","triggerScenarios":"POST /api/v1/database/import/ by a user without can_write on Database, where the bundle contains a database UUID that does not exist in the target instance.","commonSituations":"Non-admin users importing dashboard bundles that embed a database not present in the target workspace; RBAC-hardened deployments where only Admins hold can_write on Database; importing into a fresh environment before the databases were set up.","solutions":["Have an Admin (or a role holding can_write on Database) perform the import.","Or pre-create the database with the same UUID in the target environment (import just the database bundle first as Admin), so the user's import resolves an existing row and needs no create rights.","Verify the user's effective permissions via their roles before handing them import workflows."],"exampleFix":"# before: Gamma-like user imports bundle with unknown database uuid\nPOST /api/v1/dashboard/import/ ...\n# -> ImportFailedError: Database doesn't exist and user doesn't have permission to create databases\n\n# after: admin pre-imports the database bundle once\nPOST /api/v1/database/import/ (as Admin)\n# then the user's dashboard import resolves the existing database","handlingStrategy":"validation","validationCode":"from superset import security_manager\n\ndef can_import_databases() -> bool:\n    return security_manager.can_access(\"can_write\", \"Database\")","typeGuard":null,"tryCatchPattern":"from superset.commands.importers.exceptions import ImportFailedError\n\ntry:\n    dispatcher.run()\nexcept ImportFailedError as ex:\n    if \"doesn't have permission to create databases\" in str(ex):\n        # escalate to an Admin or pre-create the database by UUID\n        ...","preventionTips":["Route database-bearing imports through users holding can_write on Database.","Pre-import the database bundle (as Admin) so later imports resolve an existing UUID and need no create rights.","Check security_manager.can_access('can_write', 'Database') before offering the import button."],"tags":["import-export","permissions","rbac","database","uuid"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}