From fd3ca3cb888acd8e712e54c9002a7dcb7bacf6ab Mon Sep 17 00:00:00 2001 From: Therese Magnusson Date: Fri, 18 Jul 2025 15:01:02 +0200 Subject: [PATCH 1/6] Add documentation for the alter database privileges on database level Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`) --- ...nt_and_deny_syntax_database_privileges.svg | 100 +------- .../images/privileges_hierarchy_database.svg | 10 +- .../database-administration.adoc | 227 +++++++++++++++++- .../dbms-administration.adoc | 20 ++ 4 files changed, 243 insertions(+), 114 deletions(-) diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg index 4e0babc35..1e23e1a6d 100644 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg @@ -1,99 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg index 0ccfd067d..4e921e9a1 100644 --- a/modules/ROOT/images/privileges_hierarchy_database.svg +++ b/modules/ROOT/images/privileges_hierarchy_database.svg @@ -1,9 +1 @@ - - - - - - - - - + \ No newline at end of file diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index b90723fd5..7a0ddfc52 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -5,8 +5,10 @@ [source, cypher, role=test-setup] ---- CREATE ROLE regularUsers; +CREATE ROLE alterDbUsers; CREATE ROLE databaseAdminUsers; CREATE DATABASE `remote-db`; +CREATE COMPOSITE DATABASE `composite`; CREATE USER jake SET PASSWORD 'abcd1234' CHANGE NOT REQUIRED; ---- //// @@ -184,7 +186,8 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not The hierarchy between the different database privileges is shown in the image below. -image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure +image::privileges_hierarchy_database.svg[width="800", title="Database privileges hierarchy"] @@ -237,6 +240,52 @@ GRANT [IMMUTABLE] { START \| STOP } |=== +// TODO: mark this as available only in Cypher 25, and from 2025.07 +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER DATABASE \| SET DATABASE ACCESS \| SET DATABASE DEFAULT LANGUAGE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify everything, database access or default language of the home database, specific database(s), or all databases. +Only applies to standard databases. + +|=== + +// TODO: mark this as available only in Cypher 25, and from 2025.08 +.Database privilege syntax +[cols="<15s,<85"] +|=== + +| Command +m| +GRANT { ALTER COMPOSITE DATABASE }+ + +| Syntax +a| +[source, syntax, role="noheader", indent=0] +---- +GRANT [IMMUTABLE] { ALTER COMPOSITE DATABASE } + ON { HOME DATABASE \| DATABASE[S] {* \| name[, ...] } } + TO role[, ...] +---- + +| Description +| Grants the specified roles the privilege to modify the home database, specific database(s), or all databases. +Only applies to composite databases. + +|=== + .Database privilege syntax [cols="<15s,<85"] @@ -479,8 +528,8 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] |=== - -image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] +// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure +image::privileges_grant_and_deny_syntax_database_privileges.svg[width="800", title="Syntax of GRANT and DENY Database Privileges"] [[access-control-database-administration-access]] @@ -564,7 +613,7 @@ DENY [IMMUTABLE] START TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to start to the database `system`, use: [source, cypher, role=noplay] ---- @@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP TO role[, ...] ---- -For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use: +For example, to deny the role `regularUsers` the ability to stop the database `system`, use: [source, cypher, role=noplay] ---- @@ -628,6 +677,172 @@ a|Rows: 6 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. ==== +// TODO: mark this as available only in Cypher 25, and from 2025.07 (`ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`) and 2025.08 (`ALTER COMPOSITE DATABASE`) +[[access-control-database-administration-alter-db]] +== The alter database related privileges + +The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the DBMS privilege versions, see the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[`DATABASE MANAGEMENT` privileges]. + + +The `ALTER DATABASE` privilege can be used to enable the ability to modify a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER DATABASE ON DATABASE neo4j TO alterDbUsers +---- + +The `ALTER DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER DATABASE ON DATABASE system TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can be used to enable the ability to modify access, read-only or read-write, to a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database. + +For example, to grant the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE ACCESS` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE ACCESS + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the access of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE ACCESS ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can be used to enable the ability to modify the default language of a standard database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the default language of the database `neo4j`, use: + +[source, cypher, role=noplay] +---- +GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE neo4j TO alterDbUsers +---- + +The `SET DATABASE DEFAULT LANGUAGE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify the default language of the database `system`, use: + +[source, cypher, role=noplay] +---- +DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE system TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can be used to enable the ability to modify a composite database: + +[source, syntax, role="noheader"] +---- +GRANT [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to grant the role `alterDbUsers` the ability to modify the home database as long as it's a composite database, use: + +[source, cypher, role=noplay] +---- +GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO alterDbUsers +---- + +The `ALTER COMPOSITE DATABASE` privilege can also be denied: + +[source, syntax, role="noheader"] +---- +DENY [IMMUTABLE] ALTER COMPOSITE DATABASE + ON { HOME DATABASE | DATABASE[S] { * | name[, ...] } } + TO role[, ...] +---- + +For example, to deny the role `alterDbUsers` the ability to modify to the composite database `composite`, use: + +[source, cypher, role=noplay] +---- +DENY ALTER COMPOSITE DATABASE ON DATABASE composite TO alterDbUsers +---- + +The privileges granted can be seen using the `SHOW PRIVILEGES` command: + +[source, cypher, role=noplay] +---- +SHOW ROLE alterDbUsers PRIVILEGES AS COMMANDS +---- + +.Result +[options="header,footer", width="100%", cols="m"] +|=== +|command +|"DENY ALTER COMPOSITE DATABASE ON DATABASE `composite` TO `alterDbUsers`" +|"DENY ALTER DATABASE ON DATABASE `system` TO `alterDbUsers`" +|"DENY SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"DENY SET DATABASE DEFAULT LANGUAGE ON DATABASE `system` TO `alterDbUsers`" +|"GRANT ALTER COMPOSITE DATABASE ON HOME DATABASE TO `alterDbUsers`" +|"GRANT ALTER DATABASE ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE ACCESS ON DATABASE `neo4j` TO `alterDbUsers`" +|"GRANT SET DATABASE DEFAULT LANGUAGE ON DATABASE `neo4j` TO `alterDbUsers`" +a|Rows: 8 +|=== + +[NOTE] +==== +Note that `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. +==== + [[access-control-database-administration-index]] == The `INDEX MANAGEMENT` privileges @@ -873,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] [NOTE] ==== -Note that the privileges for starting and stopping all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. +Note that the privileges for starting, stopping and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. These privileges are associated with administrators while other database privileges are of use to domain and application developers. ==== diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index c0d7206ff..cf7f986c4 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT |=== +From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege versions, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to create standard databases You can grant the privilege to create standard databases using the `CREATE DATABASE` privilege. + @@ -1200,6 +1204,10 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to modify access to standard databases You can grant the privilege to modify access to standard databases using the `SET DATABASE ACCESS` privilege. + @@ -1226,6 +1234,10 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + [rol=label--new-2025.06] === Grant privilege to modify the default language of standard databases @@ -1253,6 +1265,10 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + [rol=label--new-2025.06] [[grant-privilege-alter-composite-database]] === Grant privilege to modify composite databases @@ -1281,6 +1297,10 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== +From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. + === Grant privilege to manage composite databases You can grant the privilege to create, delete, and modify composite databases using the `COMPOSITE DATABASE MANAGEMENT` privilege. + From c60974494fa530a7acdcede6dc5212ed1ad0627a Mon Sep 17 00:00:00 2001 From: Therese Magnusson Date: Mon, 21 Jul 2025 11:33:56 +0200 Subject: [PATCH 2/6] Add role labels for introduced version Still need to figure out if/how to mark them as cypher 25 as well --- .../database-administration.adoc | 6 +++--- .../authentication-authorization/dbms-administration.adoc | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index 7a0ddfc52..256e691e6 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -240,7 +240,7 @@ GRANT [IMMUTABLE] { START \| STOP } |=== -// TODO: mark this as available only in Cypher 25, and from 2025.07 +[role=label--new-2025.08] .Database privilege syntax [cols="<15s,<85"] |=== @@ -263,7 +263,7 @@ Only applies to standard databases. |=== -// TODO: mark this as available only in Cypher 25, and from 2025.08 +[role=label--new-2025.08] .Database privilege syntax [cols="<15s,<85"] |=== @@ -677,7 +677,7 @@ a|Rows: 6 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. ==== -// TODO: mark this as available only in Cypher 25, and from 2025.07 (`ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`) and 2025.08 (`ALTER COMPOSITE DATABASE`) +[role=label--new-2025.08] [[access-control-database-administration-alter-db]] == The alter database related privileges diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index cf7f986c4..317b03b85 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1238,7 +1238,7 @@ From Cypher 25, this privilege can be granted both as database privilege and as The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. -[rol=label--new-2025.06] +[role=label--new-2025.06] === Grant privilege to modify the default language of standard databases You can grant the privilege to modify the default language of standard databases using the `SET DATABASE DEFAULT LANGUAGE` privilege. + @@ -1269,7 +1269,7 @@ From Cypher 25, this privilege can be granted both as database privilege and as The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. -[rol=label--new-2025.06] +[role=label--new-2025.06] [[grant-privilege-alter-composite-database]] === Grant privilege to modify composite databases From f5a5ee09b1a2e62359c4155a7a3f06c736e73a6d Mon Sep 17 00:00:00 2001 From: Therese Magnusson Date: Tue, 22 Jul 2025 16:04:00 +0200 Subject: [PATCH 3/6] Apply suggestions from code review Co-authored-by: Mark Dixon <1756429+mnd999@users.noreply.github.com> --- .../database-administration.adoc | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index 256e691e6..9d86bfa03 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -682,11 +682,11 @@ Note that `START` and `STOP` privileges are not included in the xref:authenticat == The alter database related privileges The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. -The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. +The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`. For more information on the DBMS privilege versions, see the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[`DATABASE MANAGEMENT` privileges]. -The `ALTER DATABASE` privilege can be used to enable the ability to modify a standard database: +The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database: [source, syntax, role="noheader"] ---- @@ -761,7 +761,7 @@ GRANT [IMMUTABLE] SET DATABASE DEFAULT LANGUAGE TO role[, ...] ---- -For example, to grant the role `alterDbUsers` the ability to modify the default language of the database `neo4j`, use: +For example, to grant the role `alterDbUsers` the ability to modify the default Cypher language version of the database `neo4j`, use: [source, cypher, role=noplay] ---- From ee8824456e0755afc5d135879a19c1619de75e08 Mon Sep 17 00:00:00 2001 From: Therese Magnusson Date: Tue, 22 Jul 2025 16:10:39 +0200 Subject: [PATCH 4/6] Update image sizes --- .../privileges_grant_and_deny_syntax_database_privileges.svg | 2 +- modules/ROOT/images/privileges_hierarchy_database.svg | 2 +- .../authentication-authorization/database-administration.adoc | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg index 1e23e1a6d..59ffa7f49 100644 --- a/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg +++ b/modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/modules/ROOT/images/privileges_hierarchy_database.svg b/modules/ROOT/images/privileges_hierarchy_database.svg index 4e921e9a1..dbdf28cfb 100644 --- a/modules/ROOT/images/privileges_hierarchy_database.svg +++ b/modules/ROOT/images/privileges_hierarchy_database.svg @@ -1 +1 @@ - \ No newline at end of file + \ No newline at end of file diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index 9d86bfa03..0377bf483 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -187,7 +187,7 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not The hierarchy between the different database privileges is shown in the image below. // TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure -image::privileges_hierarchy_database.svg[width="800", title="Database privileges hierarchy"] +image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] @@ -529,7 +529,7 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] |=== // TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure -image::privileges_grant_and_deny_syntax_database_privileges.svg[width="800", title="Syntax of GRANT and DENY Database Privileges"] +image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] [[access-control-database-administration-access]] From fb23651a42005cd6805d4e8a9173b319d652af7e Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 13 Aug 2025 13:22:01 +0100 Subject: [PATCH 5/6] Add Cypher 25 label and udpate some syntax headings --- .../database-administration.adoc | 60 +++++++++---------- .../dbms-administration.adoc | 7 ++- 2 files changed, 35 insertions(+), 32 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/database-administration.adoc b/modules/ROOT/pages/authentication-authorization/database-administration.adoc index 0377bf483..0582e255d 100644 --- a/modules/ROOT/pages/authentication-authorization/database-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/database-administration.adoc @@ -74,7 +74,7 @@ This can be quite powerful as it allows permissions to be switched from one data For more details about the syntax descriptions, see xref:database-administration/syntax.adoc[]. ==== -.General grant +ON DATABASE+ privilege syntax +.`GRANT ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -94,7 +94,7 @@ GRANT [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| na |=== -.General deny +ON DATABASE+ privilege syntax +.`DENY ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -114,7 +114,7 @@ DENY [IMMUTABLE] database-privilege ON { HOME DATABASE \| DATABASE[S] { * \| nam |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE GRANT ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -134,7 +134,7 @@ REVOKE [IMMUTABLE] GRANT database-privilege ON { HOME DATABASE \| DATABASE[S] { |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE DENY ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -154,7 +154,7 @@ REVOKE [IMMUTABLE] DENY database-privilege ON { HOME DATABASE \| DATABASE[S] { * |=== -.General revoke +ON DATABASE+ privilege syntax +.`REVOKE ON DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -192,7 +192,7 @@ image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"] -.Database privilege syntax +.`GRANT ACCESS` privilege syntax [cols="<15s,<85"] |=== @@ -219,7 +219,7 @@ Grants the specified roles the privilege to access: |=== -.Database privilege syntax +.`GRANT START | STOP` privilege syntax [cols="<15s,<85"] |=== @@ -240,8 +240,8 @@ GRANT [IMMUTABLE] { START \| STOP } |=== -[role=label--new-2025.08] -.Database privilege syntax +[role=label--new-2025.08 label--cypher-25] +.`GRANT ALTER DATABASE | SET DATABASE ACCESS | SET DATABASE DEFAULT LANGUAGE` privilege syntax [cols="<15s,<85"] |=== @@ -263,8 +263,8 @@ Only applies to standard databases. |=== -[role=label--new-2025.08] -.Database privilege syntax +[role=label--new-2025.08 label--cypher-25] +.`GRANT ALTER COMPOSITE DATABASE` privilege syntax [cols="<15s,<85"] |=== @@ -287,7 +287,7 @@ Only applies to composite databases. |=== -.Database privilege syntax +.`GRANT CREATE | DROP | SHOW INDEX` privilege syntax [cols="<15s,<85"] |=== @@ -309,7 +309,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } INDEX[ES] |=== -.Database privilege syntax +.`GRANT INDEX` privilege syntax [cols="<15s,<85"] |=== @@ -331,7 +331,7 @@ GRANT [IMMUTABLE] INDEX[ES] [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT CREATE | DROP | SHOW CONSTRAINT` privilege syntax [cols="<15s,<85"] |=== @@ -353,7 +353,7 @@ GRANT [IMMUTABLE] { CREATE \| DROP \| SHOW } CONSTRAINT[S] |=== -.Database privilege syntax +.`GRANT CONSTRAINT` privilege syntax [cols="<15s,<85"] |=== @@ -375,7 +375,7 @@ GRANT [IMMUTABLE] CONSTRAINT[S] [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT CREATE NEW LABEL` privilege syntax [cols="<15s,<85"] |=== @@ -397,7 +397,7 @@ GRANT [IMMUTABLE] CREATE NEW [NODE] LABEL[S] |=== -.Database privilege syntax +.`GRANT CREATE NEW TYPE` privilege syntax [cols="<15s,<85"] |=== @@ -419,7 +419,7 @@ GRANT [IMMUTABLE] CREATE NEW [RELATIONSHIP] TYPE[S] |=== -.Database privilege syntax +.`GRANT CREATE NEW NAME` privilege syntax [cols="<15s,<85"] |=== @@ -441,7 +441,7 @@ GRANT [IMMUTABLE] CREATE NEW [PROPERTY] NAME[S] |=== -.Database privilege syntax +.`GRANT NAME` privilege syntax [cols="<15s,<85"] |=== @@ -463,7 +463,7 @@ GRANT [IMMUTABLE] NAME [MANAGEMENT] |=== -.Database privilege syntax +.`GRANT ALL` privilege syntax [cols="<15s,<85"] |=== @@ -485,7 +485,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] |=== -.Database privilege syntax +.`GRANT { SHOW \| TERMINATE } TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -507,7 +507,7 @@ GRANT [IMMUTABLE] { SHOW \| TERMINATE } TRANSACTION[S] [( { * \| user[, ...] } ) |=== -.Database privilege syntax +.`GRANT TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -529,7 +529,7 @@ GRANT [IMMUTABLE] TRANSACTION [MANAGEMENT] [( { * \| user[, ...] } )] |=== // TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure -image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"] +image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of `GRANT` and `DENY` database privileges"] [[access-control-database-administration-access]] @@ -677,13 +677,13 @@ a|Rows: 6 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`]. ==== -[role=label--new-2025.08] +[role=label--new-2025.08 label--cypher-25] [[access-control-database-administration-alter-db]] -== The alter database related privileges +== The alter database-related privileges The `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege is equivalent to granting the database privilege for all databases, `DATABASE *`. -For more information on the DBMS privilege versions, see the xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[`DATABASE MANAGEMENT` privileges]. +For more information on the DBMS privilege versions, see xref:authentication-authorization/dbms-administration.adoc#access-control-dbms-administration-database-management[The `DBMS DATABASE MANAGEMENT` privileges]. The `ALTER DATABASE` privilege is used to enable the ability to modify a standard database: @@ -1088,7 +1088,7 @@ GRANT [IMMUTABLE] ALL [[DATABASE] PRIVILEGES] [NOTE] ==== -Note that the privileges for starting, stopping and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. +Note that the privileges for starting, stopping, and modifying all databases, and transaction management, are not included in the `ALL DATABASE PRIVILEGES` grant. These privileges are associated with administrators while other database privileges are of use to domain and application developers. ==== @@ -1121,7 +1121,7 @@ a|Rows: 1 The right to run the commands `SHOW TRANSACTIONS`, `TERMINATE TRANSACTIONS`, and the deprecated procedures `dbms.listTransactions`, `dbms.listQueries`, `dbms.killQuery`, `dbms.killQueries`, `dbms.killTransaction` and `dbms.killTransactions` is now managed through the `SHOW TRANSACTION` and `TERMINATE TRANSACTION` privileges. -.Database privilege syntax +.`GRANT SHOW TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -1143,7 +1143,7 @@ GRANT [IMMUTABLE] SHOW TRANSACTION[S] [( { * \| user[, ...] } )] |=== -.Database privilege syntax +.`GRANT TERMINATE TRANSACTION` privilege syntax [cols="<15s,<85"] |=== @@ -1165,7 +1165,7 @@ GRANT [IMMUTABLE] TERMINATE TRANSACTION[S] [( { * \| user[, ...] } )] |=== -.Database privilege syntax +.`GRANT TRANSACTION` privilege syntax [cols="<15s,<85"] |=== diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index 317b03b85..28924dd32 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1070,9 +1070,12 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT |=== -From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege versions, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database- related privileges]. +==== === Grant privilege to create standard databases From 990d7dd2576099995096ea463766c4b6c413a047 Mon Sep 17 00:00:00 2001 From: Reneta Popova Date: Wed, 13 Aug 2025 14:15:33 +0100 Subject: [PATCH 6/6] change all mentions to a note --- .../dbms-administration.adoc | 30 +++++++++++++------ 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc index 28924dd32..4869f4a6f 100644 --- a/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc +++ b/modules/ROOT/pages/authentication-authorization/dbms-administration.adoc @@ -1074,7 +1074,7 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT ==== From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database- related privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. ==== === Grant privilege to create standard databases @@ -1207,9 +1207,12 @@ SHOW ROLE databaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER DATABASE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== === Grant privilege to modify access to standard databases @@ -1237,9 +1240,12 @@ SHOW ROLE accessModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE ACCESS` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== [role=label--new-2025.06] === Grant privilege to modify the default language of standard databases @@ -1268,9 +1274,12 @@ SHOW ROLE languageModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `SET DATABASE DEFAULT LANGUAGE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== [role=label--new-2025.06] [[grant-privilege-alter-composite-database]] @@ -1300,9 +1309,12 @@ SHOW ROLE compositeDatabaseModifier PRIVILEGES AS COMMANDS; a|Rows: 1 |=== -From Cypher 25, this privilege can be granted both as database privilege and as DBMS privilege. +[NOTE] +==== +From Cypher 25 (Neo4j server 2025.08), the `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges. The DBMS privilege version is equivalent to granting the privilege for all databases, `DATABASE *`. -For more information on the database privilege version, see the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[alter database privileges]. +For more information on the database privilege versions, see xref:authentication-authorization/database-administration.adoc#access-control-database-administration-alter-db[The alter database-related privileges]. +==== === Grant privilege to manage composite databases