{"record":{"id":"f543a75feeb14cea","repo":"prestodb/presto","slug":"permission-denied-f543a7","errorCode":"PERMISSION_DENIED","errorMessage":"DROP TABLE is disabled in this catalog","messagePattern":"DROP TABLE is disabled in this catalog","errorType":"error_code","errorClass":"PrestoException","httpStatus":null,"severity":"warning","filePath":"presto-clickhouse/src/main/java/com/facebook/presto/plugin/clickhouse/ClickHouseMetadata.java","lineNumber":175,"sourceCode":"            }\n            catch (TableNotFoundException e) {\n                log.info(\"table disappeared during listing operation\");\n            }\n        }\n        return columns.build();\n    }\n\n    @Override\n    public ColumnMetadata getColumnMetadata(ConnectorSession session, ConnectorTableHandle tableHandle, ColumnHandle columnHandle)\n    {\n        return ((ClickHouseColumnHandle) columnHandle).getColumnMetadata();\n    }\n\n    @Override\n    public void dropTable(ConnectorSession session, ConnectorTableHandle tableHandle)\n    {\n        if (!allowDropTable) {\n            throw new PrestoException(PERMISSION_DENIED, \"DROP TABLE is disabled in this catalog\");\n        }\n        ClickHouseTableHandle handle = (ClickHouseTableHandle) tableHandle;\n        clickHouseClient.dropTable(ClickHouseIdentity.from(session), handle);\n    }\n\n    @Override\n    public ConnectorOutputTableHandle beginCreateTable(ConnectorSession session, ConnectorTableMetadata tableMetadata, Optional<ConnectorNewTableLayout> layout)\n    {\n        ClickHouseOutputTableHandle handle = clickHouseClient.beginCreateTable(session, tableMetadata);\n        setRollback(() -> clickHouseClient.rollbackCreateTable(ClickHouseIdentity.from(session), handle));\n        return handle;\n    }\n\n    @Override\n    public void createTable(ConnectorSession session, ConnectorTableMetadata tableMetadata, boolean ignoreExisting)\n    {\n        clickHouseClient.createTable(session, tableMetadata);\n    }","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-clickhouse/src/main/java/com/facebook/presto/plugin/clickhouse/ClickHouseMetadata.java#L157-L193","documentation":"ClickHouseMetadata.dropTable() checks the catalog's allowDropTable flag (presto-clickhouse.allow-drop-table) and refuses to drop tables when it is false, throwing PERMISSION_DENIED. This is an intentional safety guard, not an access-control failure.","triggerScenarios":"Executing DROP TABLE on any table in a ClickHouse catalog where allow-drop-table is not set to true (default is false).","commonSituations":"Default catalog configuration blocks destructive DDL; teams migrating from other connectors unaware the ClickHouse plugin disables DROP TABLE by default; CI pipelines that clean up tables.","solutions":["Set presto-clickhouse.allow-drop-table=true in the catalog properties file and restart/reload the connector","Use TRUNCATE TABLE or DELETE instead if row/data removal suffices","Drop the table directly in ClickHouse if that fits your workflow"],"exampleFix":"// before (clickhouse.properties)\nconnector.name=clickhouse\n// after\nconnector.name=clickhouse\npresto-clickhouse.allow-drop-table=true","handlingStrategy":"try-catch","validationCode":"// Check catalog session properties before attempting DDL\nboolean allowDrop = sessionProperties.get(\"allow_drop_table\", \"false\").equals(\"true\");\nif (!allowDrop) {\n    log.info(\"DROP TABLE disabled for this catalog; skipping\");\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    dropTable(connectorTableHandle);\n} catch (PrestoException e) {\n    if (e.getErrorCode().getCode() == PERMISSION_DENIED.toErrorCode().getCode()\n            && e.getMessage().contains(\"DROP TABLE is disabled\")) {\n        // enable allow-drop-table or drop via ClickHouse directly\n    } else throw e;\n}","preventionTips":["Set presto-clickhouse.allow-drop-table=true in catalogs that legitimately need DDL","Use TRUNCATE/DELETE for data-only cleanup","Centralize destructive DDL in a role/catalog where the flag is enabled","Check catalog properties in CI before running cleanup pipelines"],"tags":["permissions","configuration","ddl","clickhouse"],"backgroundTag":"operation-disabled-by-catalog-config","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}