{"record":{"id":"c4ff132bd33bb092","repo":"apache/cassandra","slug":"s-doesn-t-exist","errorCode":null,"errorMessage":"%s doesn't exist","messagePattern":"(.+?) doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/DropRoleStatement.java","lineNumber":67,"sourceCode":"    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        super.checkPermission(state, Permission.DROP, role);\n\n        // We only check superuser status for existing roles to avoid\n        // caching info about roles which don't exist (CASSANDRA-9189)\n        if (DatabaseDescriptor.getRoleManager().isExistingRole(role)\n            && Roles.hasSuperuserStatus(role)\n            && !state.getUser().isSuper())\n            throw new UnauthorizedException(\"Only superusers can drop a role with superuser status\");\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        // validate login here before authorize to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n\n        if (!ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            throw new InvalidRequestException(String.format(\"%s doesn't exist\", role.getRoleName()));\n\n        AuthenticatedUser user = state.getUser();\n        if (user != null && user.getName().equals(role.getRoleName()))\n            throw new InvalidRequestException(\"Cannot DROP primary role for current login\");\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        // not rejected in validate()\n        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            return null;\n\n        // clean up grants and permissions of/on the dropped role.\n        DatabaseDescriptor.getRoleManager().dropRole(state.getUser(), role);\n        DatabaseDescriptor.getAuthorizer().revokeAllFrom(role);\n        DatabaseDescriptor.getAuthorizer().revokeAllOn(role);\n        DatabaseDescriptor.getNetworkAuthorizer().drop(role);\n        DatabaseDescriptor.getCIDRAuthorizer().dropCidrPermissionsForRole(role);","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/DropRoleStatement.java#L49-L85","documentation":"Cassandra throws InvalidRequestException when DROP ROLE targets a role that does not exist in the RoleManager and IF EXISTS was not specified. The check is done in validate() with ensureNotAnonymous so anonymous users cannot probe role existence. With IF EXISTS the statement silently no-ops instead.","triggerScenarios":"Executing DROP ROLE <name> (without IF EXISTS) where DatabaseDescriptor.getRoleManager().isExistingRole(role) is false — the role was never created, was already dropped, or is spelled differently (case/whitespace).","commonSituations":"Typos in role names; role dropped by another operator concurrently; migrations re-running DROP statements; environments (dev vs prod) where the role was never provisioned.","solutions":["Use DROP ROLE IF EXISTS <name> to make the statement idempotent","Verify the role exists: LIST ROLES; or query system_auth.roles","Correct the role name spelling/case in the statement","Create the role first with CREATE ROLE if it should exist"],"exampleFix":"// before\nDROP ROLE app_user; // InvalidRequestException if missing\n// after\nDROP ROLE IF EXISTS app_user;","handlingStrategy":"validation","validationCode":"boolean exists = DatabaseDescriptor.getRoleManager().isExistingRole(RoleResource.role(name));\nif (!exists && !ifExists) throw new IllegalArgumentException(name + \" doesn't exist\");","typeGuard":null,"tryCatchPattern":"try { session.execute(\"DROP ROLE \" + name); } catch (InvalidRequestException e) { if (e.getMessage().endsWith(\"doesn't exist\")) log.info(\"already gone: {}\", name); else throw e; }","preventionTips":["Always use DROP ROLE IF EXISTS in idempotent scripts","Validate role names against LIST ROLES output before dropping","Watch for case sensitivity in quoted role identifiers"],"tags":["cassandra","cql","roles","invalid-request"],"backgroundTag":"entity-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}