Privilege

Privileges are the basic content of user authentication. Privileges are categorized into Command Privileges and Property Privileges.

Command Privileges allow users to execute particular UQL commands. According to the scope of the UQL command, they are divided into:

• Graph privilege:
  • Allow users to execute UQLs related to the schema, property, index, metadata, path, algorithm and backend task of a specific GraphSet
  • GraphSet name should be appointed when granting graph privileges
• System privilege:
  • Allow users to execute UQLs related to the privilege, policy, user, GraphSet and UQL process of an Ultipa Graph database

NOTE

Refer to the Table of Privileges at the end of this article for all the command privileges and their corresponding UQL commands.

Property Privileges allow or refuse users to read (query and return) and write (insert, update and delete) particular custom properties. GraphSet and schema should be appointed:

• READ: Allow users to read particular custom properties
• WRITE：Allow users to read and write particular custom properties
• DENY：Do NOT allow users to read or write particular custom properties

NOTE

DENY has a higher priority than READ and WRITE. If a user or a policy is granted with DENY and READ (or WRITE) at the same time, the effective one is DENY.

Show Privilege

Returned table name: _privilege
Returned table header: graphPrivileges | systemPrivileges (graph privileges, system privileges)

Syntax:

Syntax
// To list all command privileges supported by Ultipa system
show().privilege()

Grant Privilege

Grant Property Privilege

Syntax:

Syntax
// To grant node and edge property privileges to a user/policy
grant().privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")

// To grant node property privileges to a user/policy
grant().node_privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")
        
// To grant edge property privileges to a user/policy
grant().edge_privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")

Example: Grant READ of property @product.price of GraphSet supplychain to policy sales

UQL
grant().node_privilege(["READ"]).on(
  "supplychain",
  @product,
  "price"
).policy("sales")

Example: Grant WRITE of all properties of all GraphSets to user admin002

UQL
grant().privilege(["WRITE"]).on(
  "*",
  @*,
  "*"
).user("admin002")

Analysis: The parameter on() in this example can be shortened as on("*")

Grant System Privilege

Syntax：

Syntax
// To grant system privileges to a user/policy
grant().system().privilege(<[]system_privileges>).<user|policy>("<name>")

Example: Grant system privileges TOP and KILL to user admin002

UQL
grant().system().privilege(["TOP","KILL"]).user("admin002")

Grant Multi-type Privilege

Syntax：

Syntax
// To grant privileges of different types to a user/policy
grant().user("<username>").params({
  graph_privileges: <{}graph_privileges?>, 
  system_privileges: <[]system_privileges?>, 
  property_privileges: <{}property_privileges?>, 
  policies: <[]policies?>
})

Where the data structures are:

Syntax
// <{}graph_privileges>
{
  "<graph1>":["<graph_privilege>", "<graph_privilege>", ...],
  "<graph2>":["<graph_privilege>", "<graph_privilege>", ...],
  ...
}

// <{}property_privileges>
{
  "node": {
    "read": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
    "write": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
    "deny": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
  },
  "edge": {
    "read": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
    "write": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
    "deny": [
      ["<graph>", "<@schema?>", "<property?>"],
      ["<graph>", "<@schema?>", "<property?>"],
      ...
    ],
  }
}

Example: Grant UPDATE of all GraphSets, system privilege STAT, WRITE of all properties of all GraphSets, and policy management to user Ultipa

UQL
grant().user("Ultipa").params({
  graph_privileges: {"*": ["UPDATE"]}, 
  system_privileges: ["STAT"],
  property_privileges: {
    "node": {
      "write": [["*", "*", "*"]]
    },
    "edge": {
      "write": [["*", "*", "*"]]
    }
  },
  policies: ["management"]
})

Revoke Privilege

Revoke Property Privilege

Syntax:

Syntax
// To revoke node and edge property privileges from a user/policy
revoke().privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")

// To revoke node property privileges from a user/policy
revoke().node_privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")
        
// To revoke edge property privileges from a user/policy
revoke().edge_privilege(["READ" | "WRITE" | "DENY"]).on(
  "<graph>", 
  <@schema?>, 
  "<property?>"
).<user|policy>("<name>")

Example: Revoke READ of property @product.price of GraphSet supplychain from policy sales

UQL
revoke().node_privilege(["READ"]).on(
  "supplychain",
  @product,
  "price"
).policy("sales")

Example: Revoke WRITE of all properties of all GraphSets from user admin002

UQL
revoke().privilege(["WRITE"]).on(
  "*",
  @*,
  "*"
).user("admin002")

Analysis: The parameter on() in this example can be shortened as on("*")

Revoke System Privilege

Syntax：

Syntax
// To revoke system privileges from a user/policy
revoke().system().privilege(<[]system_privileges>).<user|policy>("<name>")

Example: Revoke system privileges TOP and KILL from user admin002

UQL
revoke().system().privilege(["TOP","KILL"]).user("admin002")

Revoke Multi-type Privilege

Syntax：

Syntax
// To revoke privileges of different types from a user/policy
revoke().user("<username>").params({
  graph_privileges: <{}graph_privileges?>, 
  system_privileges: <[]system_privileges?>, 
  property_privileges: <{}property_privileges?>, 
  policies: <[]policies?>
})

Where the data structures <{}graph_privileges> and <{}property_privileges> are same as those in command grant().

Example: Revoke UPDATE of all GraphSets, system privilege STAT, WRITE of all properties of all GraphSets, and policy management from user Ultipa

UQL
revoke().user("Ultipa").params({
  graph_privileges: {"*": ["UPDATE"]}, 
  system_privileges: ["STAT"],
  property_privileges: {
    "node": {
      "write": [["*", "*", "*"]]
    },
    "edge": {
      "write": [["*", "*", "*"]]
    }
  },
  policies: ["management"]
})

Table of Privileges

User Related Privileges

Note: Command show().self() can be legally used by any user without authorization.

Graph Model Related Privileges

Graph Data Related Privileges

Advanced Privileges