{"record":{"id":"cb723453b4cfd094","repo":"apache/cassandra","slug":"resource-s-doesn-t-exist","errorCode":null,"errorMessage":"Resource %s doesn't exist","messagePattern":"Resource (.+?) doesn't exist","errorType":"validation","errorClass":"InvalidRequestException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/PermissionsManagementStatement.java","lineNumber":61,"sourceCode":"        this.permissions = permissions;\n        this.resource = resource;\n        this.grantee = RoleResource.role(grantee.getName());\n    }\n\n    public void validate(ClientState state) throws RequestValidationException\n    {\n        // validate login here before authorize to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(grantee))\n            throw new InvalidRequestException(String.format(\"Role %s doesn't exist\", grantee.getRoleName()));\n\n        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.\n        // called both here and in authorize(), as in some cases we do not call the latter.\n        resource = maybeCorrectResource(resource, state);\n\n        if (!resource.exists())\n            throw new InvalidRequestException(String.format(\"Resource %s doesn't exist\", resource));\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        // if a keyspace is omitted when GRANT/REVOKE ON TABLE <table>, we need to correct the resource.\n        resource = maybeCorrectResource(resource, state);\n\n        // check that the user has AUTHORIZE permission on the resource or its parents, otherwise reject GRANT/REVOKE.\n        state.ensurePermission(Permission.AUTHORIZE, resource);\n\n        // check that the user has [a single permission or all in case of ALL] on the resource or its parents.\n        for (Permission p : permissions)\n            state.ensurePermission(p, resource);\n    }\n\n    @Override\n    public String toString()\n    {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/PermissionsManagementStatement.java#L43-L79","documentation":"After correcting the resource (e.g. applying the current keyspace when 'ON TABLE t' omits a keyspace), PermissionsManagementStatement.validate() checks resource.exists(). Granting or revoking a permission on a nonexistent keyspace/table/function is rejected with this InvalidRequestException naming the resource.","triggerScenarios":"GRANT/REVOKE ... ON KEYSPACE <ks> / ON TABLE <ks.t> where the named keyspace or table does not exist.","commonSituations":"Granting on a table in the wrong keyspace; migration scripts run before schema creation; case-sensitivity mismatches in unquoted identifiers.","solutions":["Verify the resource exists (DESCRIBE KEYSPACES / system_schema) and fix the name.","Create the keyspace/table before granting permissions on it.","Check whether the statement relied on USE keyspace resolution and qualify the resource explicitly."],"exampleFix":"-- before\nGRANT SELECT ON KEYSPACE prod_data TO analyst; -- keyspace missing\n-- after\nCREATE KEYSPACE IF NOT EXISTS prod_data WITH replication = {'class':'SimpleStrategy','replication_factor':1};\nGRANT SELECT ON KEYSPACE prod_data TO analyst;","handlingStrategy":"validation","validationCode":"// verify resource exists before grant\nRow r = session.execute(\"SELECT keyspace_name FROM system_schema.keyspaces WHERE keyspace_name = ?\", ks).one();\nif (r == null) throw new IllegalStateException(\"Keyspace \" + ks + \" does not exist\");","typeGuard":null,"tryCatchPattern":"try { session.execute(grant); } catch (InvalidRequestException e) { if (e.getMessage().startsWith(\"Resource\")) { /* fix or create resource */ } else throw e; }","preventionTips":["Fully qualify keyspace.table in GRANT/REVOKE statements","Order migration scripts: schema first, permissions second","Watch identifier case sensitivity"],"tags":["cql","permissions","resource"],"backgroundTag":"resource-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}