Repository navigation
MySQL error 1143 (column-level SELECT denied) is not translated to AccessError #1586
Description
On MySQL, a query that names a column the user has no privilege on fails with error 1143. DataJoint
passes that error through as a raw pymysql.err.OperationalError. The table-level equivalent, 1142, is
translated to dj.errors.AccessError. Code that catches AccessError to handle a missing privilege
therefore misses column-level grants.
Reproduction
import datajoint as dj
admin = dj.Connection("127.0.0.1", "root", "simple", 3306)
schema = dj.Schema("demo_access", connection=admin)
@schema
class Measurement(dj.Manual):
definition = """
measurement_id: int32
---
value: float64
operator: varchar(32)
"""
@schema
class Note(dj.Manual):
definition = """
note_id: int32
---
text: varchar(64)
"""
# '%%' because Connection.query formats its arguments
admin.query("CREATE USER 'reader'@'%%' IDENTIFIED BY 'pw'")
admin.query("GRANT SELECT (measurement_id, value) ON demo_access.measurement TO 'reader'@'%%'")
reader = dj.Connection("127.0.0.1", "reader", "pw", 3306)
reader.query("SELECT text FROM demo_access.note")
# datajoint.errors.AccessError: ('Insufficient privileges.', "SELECT command denied ... for table 'note'", ...)
reader.query("SELECT operator FROM demo_access.measurement")
# pymysql.err.OperationalError: (1143, "SELECT command denied ... for column 'operator' in table 'measurement'")Observed on MySQL 8.0 with master at b9ace66.
Expected behavior
1143 raises dj.errors.AccessError, like 1044 and 1142. The PostgreSQL adapter already maps
insufficient_privilege (42501) to AccessError for table and column denials alike, so the change also
makes the two backends agree.
Where
src/datajoint/adapters/mysql.py, translate_error: case 1044 | 1142: becomes case 1044 | 1142 | 1143:.
A test beside the existing access-error tests would need a user with a column-level grant.
Activity
Bhanu73120 commentedon Oct 14, 2026
Hi, I'd like to work on this issue as my first contribution to DataJoint.
I'll investigate the MySQL error translation, add support for error 1143, and look into adding a regression test for column-level permission errors.
Please let me know if there are any additional requirements. Thanks!