{"record":{"id":"e22f0d9f1e7135a2","repo":"risingwavelabs/risingwave","slug":"0-e22f0d","errorCode":null,"errorMessage":"{0}","messagePattern":"\\{0\\}","errorType":"error_code","errorClass":"MetaError::PermissionDenied","httpStatus":null,"severity":"error","filePath":"src/meta/src/error.rs","lineNumber":66,"sourceCode":"        #[backtrace]\n        MetadataModelError,\n    ),\n\n    #[error(\"Hummock error: {0}\")]\n    HummockError(\n        #[from]\n        #[backtrace]\n        HummockError,\n    ),\n\n    #[error(transparent)]\n    RpcError(\n        #[from]\n        #[backtrace]\n        RpcError,\n    ),\n\n    #[error(\"{0}\")]\n    PermissionDenied(String),\n\n    #[error(\"Invalid worker: {0}, {1}\")]\n    InvalidWorker(WorkerId, String),\n\n    #[error(\"Invalid parameter: {0}\")]\n    InvalidParameter(#[message] String),\n\n    // Used for catalog errors.\n    #[error(\"{0} id not found: {1}\")]\n    #[construct(skip)]\n    CatalogIdNotFound(&'static str, String),\n\n    #[error(\"table_fragment does not exist: id={0}\")]\n    FragmentNotFound(FragmentId),\n\n    #[error(\"{0} named {1} already exists{under_creation}\", under_creation = (.2).map(|_| \" and is still being created\").unwrap_or(\"\"))]\n    Duplicated(","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/meta/src/error.rs#L48-L84","documentation":"MetaError::PermissionDenied carries a human-readable rejection message verbatim ('{0}'). It is thrown when an operation is not permitted — typically worker/privilege related checks in the meta service — and the message itself explains what was denied.","triggerScenarios":"A meta-service call whose permission check fails, e.g. a worker or user attempting an operation reserved for another role, producing `Err(MetaError::permission_denied(msg))`.","commonSituations":"Connecting a worker with wrong identity/registration state; RBAC-restricted SQL operations executed by a user lacking privileges against RisingWave's permission model; stale worker registrations after cluster re-provisioning.","solutions":["Read the message payload — it names the denied action/subject.","Retry the operation with credentials/identity that have the required privileges.","For SQL-level denials, GRANT the needed privileges to the role (e.g. GRANT ... TO ...).","For worker registration issues, deregister and re-register the worker node."],"exampleFix":"// before (non-superuser runs a restricted statement)\nALTER SYSTEM ...; -- PermissionDenied\n// after\nGRANT appropriate_role TO current_user;  -- or run as a privileged user\nALTER SYSTEM ...;","handlingStrategy":"try-catch","validationCode":"-- Before running the operation, check privileges\nSELECT has_privs_of(current_user, 'admin') AS can_alter_system;","typeGuard":"fn is_permission_denied(e: &MetaError) -> bool {\n    matches!(e, MetaError::PermissionDenied(_))\n}","tryCatchPattern":"match run_statement(sql).await {\n    Err(e @ MetaError::PermissionDenied(msg)) => {\n        // read `msg` to see exactly what was denied; elevate privileges or re-authenticate\n        Err(anyhow!(\"denied: {msg}\"))\n    }\n    other => other,\n}","preventionTips":["Run monitoring/ops scripts with a role that has the privileges they need.","Read the error message payload — it names the denied subject/action.","Audit RBAC grants (SHOW GRANTS) before deploying tooling against a new cluster."],"tags":["permission","rbac","error-wrapper","risingwave"],"backgroundTag":"permission-denied","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}