{"record":{"id":"b6c0b9041fb525ee","repo":"apache/cassandra","slug":"role-s-was-not-granted-s-on-s","errorCode":null,"errorMessage":"Role '%s' was not granted %s on %s","messagePattern":"Role '(.+?)' was not granted (.+?) on (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/cql3/statements/RevokePermissionsStatement.java","lineNumber":61,"sourceCode":"        super(permissions, resource, grantee);\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        IAuthorizer authorizer = DatabaseDescriptor.getAuthorizer();\n        Set<Permission> revoked = authorizer.revoke(state.getUser(), permissions, resource, grantee);\n\n        // We want to warn the client if all the specified permissions have not been revoked and the client did\n        // not specify ALL in the query.\n        if (!revoked.equals(permissions) && !permissions.equals(Permission.ALL))\n        {\n            String permissionsStr = permissions.stream()\n                                               .filter(permission -> !revoked.contains(permission))\n                                               .sorted(Permission::compareTo) // guarantee the order for testing\n                                               .map(Permission::name)\n                                               .collect(Collectors.joining(\", \"));\n\n            ClientWarn.instance.warn(String.format(\"Role '%s' was not granted %s on %s\",\n                                                   grantee.getRoleName(),\n                                                   permissionsStr,\n                                                   resource));\n        }\n\n        return null;\n    }\n    \n    @Override\n    public String toString()\n    {\n        return ToStringBuilder.reflectionToString(this, ToStringStyle.SHORT_PREFIX_STYLE);\n    }\n\n    @Override\n    public AuditLogContext getAuditLogContext()\n    {\n        String keyspace = resource.hasParent() ? resource.getParent().getName() : resource.getName();","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/RevokePermissionsStatement.java#L43-L79","documentation":"REVOKE of permissions that the role does not hold warns instead of failing. RevokePermissionsStatement.execute computes the actually-revoked subset and warns for each requested permission that was never granted (directly or via inheritance).","triggerScenarios":"Running `REVOKE permission ON resource FROM role` where the role lacks that permission; warning raised via ClientWarn when the revoked set is a strict subset of the requested permissions.","commonSituations":"Teardown/cleanup scripts revoking grants that were never applied; revoking permissions that were inherited, not directly granted; typos in permission names resolving to a valid-but-unheld permission.","solutions":["Run LIST ALL PERMISSIONS OF role_name to confirm the grant exists before revoking","Make cleanup scripts tolerant of already-revoked state (treat the warning as success)","Revoke the role membership instead if the permission comes from an inherited role"],"exampleFix":"// before\nsession.execute(\"REVOKE MODIFY ON ks.tbl FROM old_role\"); // may never have been granted\n// after\nList<Row> perms = session.execute(\"LIST ALL PERMISSIONS OF old_role\").all();\nboolean has = perms.stream().anyMatch(p -> p.getString(\"permission\").equals(\"MODIFY\"));\nif (has) session.execute(\"REVOKE MODIFY ON ks.tbl FROM old_role\");","handlingStrategy":"validation","validationCode":"boolean has = session.execute(\"LIST ALL PERMISSIONS OF \" + role).all().stream()\n    .anyMatch(r -> r.getString(\"permission\").equals(perm));\nif (!has) { /* skip REVOKE, treat as no-op */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check grants before revoke in teardown scripts","Remember inherited permissions cannot be revoked directly","Treat this warning as success in cleanup jobs"],"tags":["cassandra","permissions","rbac","client-warning"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}