Property rules documentation #1076

HannesSandberg · 2023-10-09T06:10:12Z

No description provided.

neo-technology-commit-status-publisher · 2023-10-09T06:13:46Z

This PR includes documentation updates.

You can view the updated docs at https://neo4j-docs-operations-1076.surge.sh

phil198

review comments so far

modules/ROOT/pages/authentication-authorization/limitations.adoc

modules/ROOT/pages/authentication-authorization/manage-privileges.adoc

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

Hunterness

Just have the main file left to look at but you can have these comments for now XD

modules/ROOT/images/privileges_grant_and_deny_syntax.svg

modules/ROOT/images/privileges_on_graph_syntax.svg

modules/ROOT/pages/authentication-authorization/limitations.adoc

modules/ROOT/pages/authentication-authorization/privileges-reads.adoc

modules/ROOT/pages/authentication-authorization/limitations.adoc

Hunterness

Initial comments on main file

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

modules/ROOT/pages/authentication-authorization/limitations.adoc

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

renetapopova · 2023-10-13T08:21:26Z

@HannesSandberg, Which version does this PR apply to? I'll review it after you finish discussing it.

HannesSandberg · 2023-10-13T08:25:00Z

Hello! Thank you @renetapopova

it does not belong to any version yet. The feature is released behind a feature flag in 5.13 but we do not know yet when it will properly released.

modules/ROOT/pages/authentication-authorization/limitations.adoc

HannesSandberg · 2023-10-16T09:11:32Z

@renetapopova Therese have approved this now, feel free to take a look when you have time.

renetapopova

I added some editorial comments.

renetapopova · 2023-10-17T12:13:58Z

modules/ROOT/pages/authentication-authorization/limitations.adoc

@@ -332,3 +332,42 @@ Due to this, each node with the `:Person` label needs to be accessed and examine
 Due to the additional data accesses that the security checks need to do, this operation will be slower compared to executing the query as an unrestricted user.


There are repetitions of "due to" and "make sure", which would be good to address, but I can't add a suggestion there.

modules/ROOT/pages/authentication-authorization/limitations.adoc

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

renetapopova · 2023-10-18T13:15:49Z

modules/ROOT/pages/authentication-authorization/privileges-reads.adoc

@@ -148,6 +181,13 @@ For example if you want to grant the ability to read the properties `language` a
 GRANT MATCH { language, length } ON GRAPH neo4j NODES Message TO regularUsers
 ----

+The following query exemplifies how you can grant the ability to find nodes `Post` and `Likes` where property `secret` is set to `false`, as well as reading all their properties to the role `regularUsers`:


OK, now I remember why I've changed it - "grants" is too far from "the regularUsers role."

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

modules/ROOT/pages/authentication-authorization/limitations.adoc

HannesSandberg · 2023-10-23T06:11:47Z

Nice suggestions! Thanks @renetapopova

renetapopova

Thanks, @HannesSandberg and @Hunterness!

renetapopova · 2023-11-27T12:03:54Z

@HannesSandberg, when are we going to merge this one?

HannesSandberg · 2023-11-27T12:07:27Z

Hello @renetapopova! Not yet, this feature is still under early access and not yet publicly available.

I have a question for you as well. Me and @phil198 are making further improvements for this feature that must be documented as well.

Do you want that to be added to this pull request?

In that case I suggest that I squash all of the commits in this PR into one that are approved, and then we can add new ones on top of that one.

renetapopova · 2023-11-27T12:26:49Z

Hello @renetapopova! Not yet, this feature is still under early access and not yet publicly available.

I have a question for you as well. Me and @phil198 are making further improvements for this feature that must be documented as well.

Do you want that to be added to this pull request?

In that case I suggest that I squash all of the commits in this PR into one that are approved, and then we can add new ones on top of that one.

Sounds good to me. Thanks!

HannesSandberg · 2023-11-29T13:18:39Z

We have added the new syntax and an example in the last commit. Could you please re-review @Hunterness @renetapopova

Hunterness

updates looks good

Hunterness · 2023-11-29T13:30:03Z

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

+----
+([var][:label["|" ...]] "{" property: value "}")
+| (var[:label["|" ...]]) WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL }
+| (var[:label["|" ...]] WHERE [NOT] var.property { { = | <> | > | >= | < | <= } value | IS NULL | IS NOT NULL } )


one thing to keep in mind for when this is ready for merge/GA is that we'll need to update the additions, deprecations, removals section (currently in cypher manual, but I think there was some talk about making something for the operations manual/administration section as well since it moved manual so I guess wherever it is at time of GA)

renetapopova

Looks good to me 👍

Hunterness

Updates for IN looks good

HannesSandberg · 2024-01-16T07:02:37Z

Added new syntax in the last commit. Could you please review @renetapopova ?

renetapopova · 2024-01-19T10:53:31Z

Added new syntax in the last commit. Could you please review @renetapopova ?

It looks good!

add property rules example to limitations section add new section for property-based access control recomend to use Block Storage review fixes: limitations page update images for granting/denying privilege syntax Update modules/ROOT/pages/authentication-authorization/manage-privileges.adoc Co-authored-by: Phil Wright <[email protected]> review fixes review fixes review fix review fixes change header in limitations page Update modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc Co-authored-by: Phil Wright <[email protected]> Apply suggestions from code review Co-authored-by: Reneta Popova <[email protected]>

…roperty rule

…ffected

HannesSandberg · 2024-05-22T13:36:10Z

Made a small update, feel free to review @Hunterness and @renetapopova.

Also changing this from draft to PR now since the feature will be released in 5.21.

renetapopova

A minor suggestion from me. Also, please don't merge it into dev, as dev still refers to 5.20.

renetapopova · 2024-05-22T14:50:36Z

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

@@ -30,6 +30,8 @@ Some of the factors that can worsen the impact on performance when having proper
 For performance-critical scenarios, it is recommended to design privileges based on labels.
 For more information, see xref:authentication-authorization/privileges-reads.adoc[Read privileges].

+When using property-based access control, ensure the property used for the rule cannot be modified. Users who can change this property can affect granted property-based privileges.


One sentence per line and a small correction.

When using property-based access control, ensure the property used for the rule cannot be modified. Users who can change this property can affect the granted property-based privileges.

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc

neo-technology-commit-status-publisher · 2024-06-11T13:02:10Z

Thanks for the documentation updates.

The preview documentation has now been torn down - reopening this PR will republish it.

Co-authored-by: Reneta Popova <[email protected]>

HannesSandberg added the team-cypher-operations label Oct 9, 2023

HannesSandberg assigned Hunterness Oct 11, 2023

phil198 reviewed Oct 11, 2023

View reviewed changes

phil198 reviewed Oct 12, 2023

View reviewed changes

Hunterness reviewed Oct 12, 2023

View reviewed changes

Hunterness reviewed Oct 13, 2023

View reviewed changes

renetapopova self-requested a review October 13, 2023 08:21

Hunterness reviewed Oct 13, 2023

View reviewed changes

modules/ROOT/pages/authentication-authorization/limitations.adoc Outdated Show resolved Hide resolved

Hunterness approved these changes Oct 13, 2023

View reviewed changes

renetapopova requested changes Oct 18, 2023

View reviewed changes

renetapopova reviewed Oct 18, 2023

View reviewed changes

phil198 reviewed Oct 20, 2023

View reviewed changes

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc Show resolved Hide resolved

renetapopova reviewed Oct 20, 2023

View reviewed changes

renetapopova approved these changes Oct 25, 2023

View reviewed changes

renetapopova self-assigned this Oct 30, 2023

HannesSandberg force-pushed the property-rules branch 2 times, most recently from ed2372f to 547d12b Compare November 29, 2023 12:21

Hunterness approved these changes Nov 29, 2023

View reviewed changes

renetapopova approved these changes Nov 29, 2023

View reviewed changes

Hunterness reviewed Jan 15, 2024

View reviewed changes

HannesSandberg force-pushed the property-rules branch from aa2bd90 to f4c01be Compare January 16, 2024 06:59

HannesSandberg force-pushed the property-rules branch from f4c01be to 6b8607d Compare March 25, 2024 11:16

phil198 approved these changes Apr 5, 2024

View reviewed changes

HannesSandberg and others added 5 commits May 22, 2024 15:00

add inequalities to the property based access control page

36b93ba

add in a list to the property value access rule page

a2a18f5

note that the role does not need access to the property used in the p…

13940c0

…roperty rule

Make it clear that if you change property values the rules might be a…

9aed4a6

…ffected

HannesSandberg force-pushed the property-rules branch from 6b8607d to 9aed4a6 Compare May 22, 2024 13:00

HannesSandberg marked this pull request as ready for review May 22, 2024 13:36

renetapopova added the 5.21 label May 22, 2024

renetapopova approved these changes May 22, 2024

View reviewed changes

renetapopova added the DO NOT MERGE label May 22, 2024

review fix

2d57f25

Hunterness reviewed May 23, 2024

View reviewed changes

modules/ROOT/pages/authentication-authorization/property-based-access-control.adoc Show resolved Hide resolved

Add IMPORTAINT note to the new sentences

cf6f057

renetapopova removed the 5.21 label Jun 11, 2024

add missing curly brace

4352b84

renetapopova added 5.21 and removed DO NOT MERGE labels Jun 12, 2024

renetapopova merged commit 8fabf8d into neo4j:dev Jun 12, 2024
8 checks passed

renetapopova added a commit to renetapopova/docs-operations that referenced this pull request Jun 28, 2024

Property rules documentation (neo4j#1076)

db13e3d

Co-authored-by: Reneta Popova <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Property rules documentation #1076

Property rules documentation #1076

HannesSandberg commented Oct 9, 2023

neo-technology-commit-status-publisher commented Oct 9, 2023

phil198 left a comment

Hunterness left a comment

Hunterness left a comment

renetapopova commented Oct 13, 2023

HannesSandberg commented Oct 13, 2023

HannesSandberg commented Oct 16, 2023

renetapopova left a comment

renetapopova Oct 17, 2023

renetapopova Oct 18, 2023 •

edited

Loading

HannesSandberg commented Oct 23, 2023

renetapopova left a comment

renetapopova commented Nov 27, 2023

HannesSandberg commented Nov 27, 2023

renetapopova commented Nov 27, 2023

HannesSandberg commented Nov 29, 2023

Hunterness left a comment

Hunterness Nov 29, 2023

renetapopova left a comment

Hunterness left a comment

HannesSandberg commented Jan 16, 2024

renetapopova commented Jan 19, 2024

HannesSandberg commented May 22, 2024

renetapopova left a comment

renetapopova May 22, 2024

neo-technology-commit-status-publisher commented Jun 11, 2024 •

edited

Loading

		@@ -332,3 +332,42 @@ Due to this, each node with the `:Person` label needs to be accessed and examine
		Due to the additional data accesses that the security checks need to do, this operation will be slower compared to executing the query as an unrestricted user.

Property rules documentation #1076

Property rules documentation #1076

Conversation

HannesSandberg commented Oct 9, 2023

neo-technology-commit-status-publisher commented Oct 9, 2023

phil198 left a comment

Choose a reason for hiding this comment

Hunterness left a comment

Choose a reason for hiding this comment

Hunterness left a comment

Choose a reason for hiding this comment

renetapopova commented Oct 13, 2023

HannesSandberg commented Oct 13, 2023

HannesSandberg commented Oct 16, 2023

renetapopova left a comment

Choose a reason for hiding this comment

renetapopova Oct 17, 2023

Choose a reason for hiding this comment

renetapopova Oct 18, 2023 • edited Loading

Choose a reason for hiding this comment

HannesSandberg commented Oct 23, 2023

renetapopova left a comment

Choose a reason for hiding this comment

renetapopova commented Nov 27, 2023

HannesSandberg commented Nov 27, 2023

renetapopova commented Nov 27, 2023

HannesSandberg commented Nov 29, 2023

Hunterness left a comment

Choose a reason for hiding this comment

Hunterness Nov 29, 2023

Choose a reason for hiding this comment

renetapopova left a comment

Choose a reason for hiding this comment

Hunterness left a comment

Choose a reason for hiding this comment

HannesSandberg commented Jan 16, 2024

renetapopova commented Jan 19, 2024

HannesSandberg commented May 22, 2024

renetapopova left a comment

Choose a reason for hiding this comment

renetapopova May 22, 2024

Choose a reason for hiding this comment

neo-technology-commit-status-publisher commented Jun 11, 2024 • edited Loading

renetapopova Oct 18, 2023 •

edited

Loading

neo-technology-commit-status-publisher commented Jun 11, 2024 •

edited

Loading