{"record":{"id":"e9c9788dfddb80cb","repo":"prestodb/presto","slug":"cannot-drop-a-constraint-from-table-s-s","errorCode":null,"errorMessage":"Cannot drop a constraint from table %s%s","messagePattern":"Cannot drop a constraint from table (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":467,"sourceCode":"\n    public static void denyDropTag(String tableName)\n    {\n        denyDropTag(tableName, null);\n    }\n\n    public static void denyDropTag(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a tag from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyDropConstraint(String tableName)\n    {\n        denyDropConstraint(tableName, null);\n    }\n\n    public static void denyDropConstraint(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot drop a constraint from table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denyAddConstraint(String tableName)\n    {\n        denyAddConstraint(tableName, null);\n    }\n\n    public static void denyAddConstraint(String tableName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot add a constraint to table %s%s\", tableName, formatExtraInfo(extraInfo)));\n    }\n\n    private static Object formatExtraInfo(String extraInfo)\n    {\n        if (extraInfo == null || extraInfo.isEmpty()) {\n            return \"\";\n        }\n        return \": \" + extraInfo;","sourceCodeStart":449,"sourceCodeEnd":485,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L449-L485","documentation":"denyDropConstraint throws AccessDeniedException when the access control layer denies dropping a constraint (table constraint, e.g. primary key or check constraint in connectors that support them) from the given table. The optional extraInfo adds message context.","triggerScenarios":"A connector calls checkCanDropConstraint; its policy rejects the operation and calls denyDropConstraint(tableName, extraInfo), yielding 'Cannot drop a constraint from table <table><extraInfo>'.","commonSituations":"Schema-change workflows (dropping PKs before migrations) blocked by read-mostly access control; users with write privileges but not DDL/alter privileges; policy engines restricting constraint changes on governed tables.","solutions":["Grant the user/group table ALTER (or constraint-management) privilege in the access-control policy","Run the migration under a privileged service account or an admin-approved change window","Check whether the connector's catalog-level access control (not just system access control) also needs the grant","Confirm the constraint name and table match the policy scope"],"exampleFix":"// before\n{\"catalog\": \"iceberg\", \"user\": \"etl\", \"privileges\": [\"INSERT\"]}\n// after\n{\"catalog\": \"iceberg\", \"user\": \"etl\", \"privileges\": [\"INSERT\", \"DROP CONSTRAINT\"]}","handlingStrategy":"try-catch","validationCode":"// verify alter/constraint privileges before migration DDL\nif (!grants(user, catalog, table).contains(\"DROP CONSTRAINT\")) {\n    throw new IllegalStateException(\"Migration principal lacks DROP CONSTRAINT\");\n}","typeGuard":"boolean canAlterSchema(String user, String table, Map<String, Set<String>> grants) {\n    return grants.getOrDefault(user, Set.of()).stream().anyMatch(g -> g.endsWith(\"CONSTRAINT\"));\n}","tryCatchPattern":"try {\n    conn.execute(\"ALTER TABLE t DROP CONSTRAINT pk_t\");\n} catch (AccessDeniedException e) {\n    LOG.warn(\"DROP CONSTRAINT denied: %s\", e.getMessage());\n    throw e;\n}","preventionTips":["Use elevated migration accounts for schema changes, not app credentials","Grant constraint privileges at group level for data-engineering teams","Check both system and catalog-level access control layers","Stage migrations to catch authorization issues before production"],"tags":["presto","security","access-denied","constraints"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}