diff --git a/src/auth/models.cpp b/src/auth/models.cpp index e51b000b0..7a4481447 100644 --- a/src/auth/models.cpp +++ b/src/auth/models.cpp @@ -115,7 +115,7 @@ FineGrainedPermission PermissionToFineGrainedPermission(const uint64_t permissio return FineGrainedPermission::READ; } - return FineGrainedPermission::NO_PERMISSION; + return FineGrainedPermission::NOTHING; } std::string FineGrainedPermissionToString(const FineGrainedPermission level) { @@ -126,8 +126,8 @@ std::string FineGrainedPermissionToString(const FineGrainedPermission level) { return "UPDATE"; case FineGrainedPermission::READ: return "READ"; - case FineGrainedPermission::NO_PERMISSION: - return "NO_PERMISSION"; + case FineGrainedPermission::NOTHING: + return "NOTHING"; } } @@ -137,9 +137,9 @@ FineGrainedAccessPermissions Merge(const FineGrainedAccessPermissions &first, std::optional global_permission; if (second.GetGlobalPermission().has_value()) { - global_permission = second.GetGlobalPermission().value(); + global_permission = *second.GetGlobalPermission(); } else if (first.GetGlobalPermission().has_value()) { - global_permission = first.GetGlobalPermission().value(); + global_permission = *first.GetGlobalPermission(); } for (const auto &[label_name, permission] : second.GetPermissions()) { @@ -267,7 +267,7 @@ void FineGrainedAccessPermissions::Grant(const std::string &permission, if (permission == kAsterisk) { global_permission_ = CalculateGrant(fine_grained_permission); } else { - permissions_[permission] |= CalculateGrant(fine_grained_permission); + permissions_[permission] = CalculateGrant(fine_grained_permission); } } @@ -280,15 +280,6 @@ void FineGrainedAccessPermissions::Revoke(const std::string &permission) { } } -void FineGrainedAccessPermissions::Deny(const std::string &permission, - const FineGrainedPermission fine_grained_permission) { - if (permission == kAsterisk) { - global_permission_ = CalculateDeny(fine_grained_permission); - } else { - permissions_[permission] = CalculateDeny(fine_grained_permission); - } -} - nlohmann::json FineGrainedAccessPermissions::Serialize() const { if (!memgraph::utils::license::global_license_checker.IsValidLicenseFast()) { return {}; @@ -334,19 +325,6 @@ uint64_t FineGrainedAccessPermissions::CalculateGrant(FineGrainedPermission fine return result; } -uint64_t FineGrainedAccessPermissions::CalculateDeny(FineGrainedPermission fine_grained_permission) { - uint64_t shift{1}; - uint64_t result{0}; - auto uint_fine_grained_permission = static_cast(fine_grained_permission); - - while (uint_fine_grained_permission <= kLabelPermissionMax) { - result |= uint_fine_grained_permission; - uint_fine_grained_permission <<= shift; - } - - return kLabelPermissionAll - result; -} - bool operator==(const FineGrainedAccessPermissions &first, const FineGrainedAccessPermissions &second) { return first.GetPermissions() == second.GetPermissions() && first.GetGlobalPermission() == second.GetGlobalPermission(); diff --git a/src/auth/models.hpp b/src/auth/models.hpp index f273f84f9..726586bdb 100644 --- a/src/auth/models.hpp +++ b/src/auth/models.hpp @@ -47,9 +47,9 @@ enum class Permission : uint64_t { #ifdef MG_ENTERPRISE // clang-format off enum class FineGrainedPermission : uint64_t { - NO_PERMISSION = 0, + NOTHING = 0, READ = 1, - UPDATE = 1U << 1U, + UPDATE = 1U << 1U, CREATE_DELETE = 1U << 2U }; // clang-format on @@ -145,8 +145,6 @@ class FineGrainedAccessPermissions final { void Revoke(const std::string &permission); - void Deny(const std::string &permission, FineGrainedPermission fine_grained_permission); - nlohmann::json Serialize() const; /// @throw AuthException if unable to deserialize. @@ -160,7 +158,6 @@ class FineGrainedAccessPermissions final { std::optional global_permission_; static uint64_t CalculateGrant(FineGrainedPermission fine_grained_permission); - static uint64_t CalculateDeny(FineGrainedPermission fine_grained_permission); }; bool operator==(const FineGrainedAccessPermissions &first, const FineGrainedAccessPermissions &second); diff --git a/src/glue/auth.cpp b/src/glue/auth.cpp index c78ec3950..639f722c4 100644 --- a/src/glue/auth.cpp +++ b/src/glue/auth.cpp @@ -65,6 +65,8 @@ auth::Permission PrivilegeToPermission(query::AuthQuery::Privilege privilege) { auth::FineGrainedPermission FineGrainedPrivilegeToFineGrainedPermission( const query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) { switch (fine_grained_privilege) { + case query::AuthQuery::FineGrainedPrivilege::NOTHING: + return auth::FineGrainedPermission::NOTHING; case query::AuthQuery::FineGrainedPrivilege::READ: return auth::FineGrainedPermission::READ; case query::AuthQuery::FineGrainedPrivilege::UPDATE: diff --git a/src/glue/auth_handler.cpp b/src/glue/auth_handler.cpp index ae07b411f..a66193458 100644 --- a/src/glue/auth_handler.cpp +++ b/src/glue/auth_handler.cpp @@ -135,7 +135,7 @@ std::vector GetFineGrainedPermissionFor std::stringstream permission_representation; permission_representation << "ALL " << permission_type << "S"; const auto &permission_level_representation = - permission_level == memgraph::auth::FineGrainedPermission::NO_PERMISSION ? "DENIED" : "GRANTED"; + permission_level == memgraph::auth::FineGrainedPermission::NOTHING ? "DENIED" : "GRANTED"; const auto permission_description = fmt::format("GLOBAL {0} PERMISSION {1} TO {2}", permission_type, permission_level_representation, user_or_role); @@ -151,7 +151,7 @@ std::vector GetFineGrainedPermissionFor permission_representation << permission_type << " :" << label; const auto &permission_level_representation = - permission_level == memgraph::auth::FineGrainedPermission::NO_PERMISSION ? "DENIED" : "GRANTED"; + permission_level == memgraph::auth::FineGrainedPermission::NOTHING ? "DENIED" : "GRANTED"; const auto permission_description = fmt::format("{0} PERMISSION {1} TO {2}", permission_type, permission_level_representation, user_or_role); @@ -531,20 +531,12 @@ void AuthQueryHandler::GrantPrivilege( ); } // namespace memgraph::glue -void AuthQueryHandler::DenyPrivilege( - const std::string &user_or_role, const std::vector &privileges -#ifdef MG_ENTERPRISE - , - const std::vector>> - &label_privileges, - const std::vector>> - &edge_type_privileges -#endif -) { +void AuthQueryHandler::DenyPrivilege(const std::string &user_or_role, + const std::vector &privileges) { EditPermissions( user_or_role, privileges, #ifdef MG_ENTERPRISE - label_privileges, edge_type_privileges, + {}, {}, #endif [](auto &permissions, const auto &permission) { // TODO (mferencevic): should we first check that the @@ -554,17 +546,10 @@ void AuthQueryHandler::DenyPrivilege( } #ifdef MG_ENTERPRISE , - [](auto &fine_grained_permissions, const auto &privilege_collection) { - for (const auto &[privilege, entities] : privilege_collection) { - const auto &permission = memgraph::glue::FineGrainedPrivilegeToFineGrainedPermission(privilege); - for (const auto &entity : entities) { - fine_grained_permissions.Deny(entity, permission); - } - } - } + [](auto &fine_grained_permissions, const auto &privilege_collection) {} #endif ); -} // namespace memgraph::glue +} void AuthQueryHandler::RevokePrivilege( const std::string &user_or_role, const std::vector &privileges diff --git a/src/glue/auth_handler.hpp b/src/glue/auth_handler.hpp index e1e75d472..440e9a835 100644 --- a/src/glue/auth_handler.hpp +++ b/src/glue/auth_handler.hpp @@ -68,17 +68,8 @@ class AuthQueryHandler final : public memgraph::query::AuthQueryHandler { #endif ) override; - void DenyPrivilege( - const std::string &user_or_role, const std::vector &privileges -#ifdef MG_ENTERPRISE - , - const std::vector>> - &label_privileges, - - const std::vector>> - &edge_type_privileges -#endif - ) override; + void DenyPrivilege(const std::string &user_or_role, + const std::vector &privileges) override; void RevokePrivilege( const std::string &user_or_role, const std::vector &privileges diff --git a/src/query/frontend/ast/ast.lcp b/src/query/frontend/ast/ast.lcp index d34096a16..5ced6ee2f 100644 --- a/src/query/frontend/ast/ast.lcp +++ b/src/query/frontend/ast/ast.lcp @@ -2260,7 +2260,7 @@ cpp<# websocket) (:serialize)) (lcp:define-enum fine-grained-privilege - (read update create_delete) + (nothing read update create_delete) (:serialize)) #>cpp AuthQuery() = default; diff --git a/src/query/frontend/ast/cypher_main_visitor.cpp b/src/query/frontend/ast/cypher_main_visitor.cpp index 038148e1f..01486cae2 100644 --- a/src/query/frontend/ast/cypher_main_visitor.cpp +++ b/src/query/frontend/ast/cypher_main_visitor.cpp @@ -1278,11 +1278,11 @@ antlrcpp::Any CypherMainVisitor::visitGrantPrivilege(MemgraphCypher::GrantPrivil AuthQuery *auth = storage_->Create(); auth->action_ = AuthQuery::Action::GRANT_PRIVILEGE; auth->user_or_role_ = std::any_cast(ctx->userOrRole->accept(this)); - if (ctx->privilegesList()) { + if (ctx->grantPrivilegesList()) { const auto [label_privileges, edge_type_privileges, privileges] = std::any_cast< std::tuple>>, std::vector>>, - std::vector>>(ctx->privilegesList()->accept(this)); + std::vector>>(ctx->grantPrivilegesList()->accept(this)); auth->label_privileges_ = label_privileges; auth->edge_type_privileges_ = edge_type_privileges; auth->privileges_ = privileges; @@ -1301,10 +1301,7 @@ antlrcpp::Any CypherMainVisitor::visitDenyPrivilege(MemgraphCypher::DenyPrivileg auth->action_ = AuthQuery::Action::DENY_PRIVILEGE; auth->user_or_role_ = std::any_cast(ctx->userOrRole->accept(this)); if (ctx->privilegesList()) { - std::tie(auth->label_privileges_, auth->edge_type_privileges_, auth->privileges_) = std::any_cast< - std::tuple>>, - std::vector>>, - std::vector>>(ctx->privilegesList()->accept(this)); + auth->privileges_ = std::any_cast>(ctx->privilegesList()->accept(this)); } else { /* deny all privileges */ auth->privileges_ = kPrivilegesAll; @@ -1312,12 +1309,24 @@ antlrcpp::Any CypherMainVisitor::visitDenyPrivilege(MemgraphCypher::DenyPrivileg return auth; } +/** + * @return AuthQuery* + */ +antlrcpp::Any CypherMainVisitor::visitPrivilegesList(MemgraphCypher::PrivilegesListContext *ctx) { + std::vector privileges{}; + for (const auto &privilege : ctx->privilege()) { + privileges.push_back(std::any_cast(privilege->accept(this))); + } + + return privileges; +} + /** * @return std::tuple>>, std::vector>>, std::vector> */ -antlrcpp::Any CypherMainVisitor::visitPrivilegesList(MemgraphCypher::PrivilegesListContext *ctx) { +antlrcpp::Any CypherMainVisitor::visitGrantPrivilegesList(MemgraphCypher::GrantPrivilegesListContext *ctx) { std::vector>> label_privileges; std::vector>> edge_type_privileges; std::vector privileges; @@ -1449,10 +1458,11 @@ antlrcpp::Any CypherMainVisitor::visitPrivilege(MemgraphCypher::PrivilegeContext * @return AuthQuery::FineGrainedPrivilege */ antlrcpp::Any CypherMainVisitor::visitGranularPrivilege(MemgraphCypher::GranularPrivilegeContext *ctx) { + if (ctx->NOTHING()) return AuthQuery::FineGrainedPrivilege::NOTHING; if (ctx->READ()) return AuthQuery::FineGrainedPrivilege::READ; if (ctx->UPDATE()) return AuthQuery::FineGrainedPrivilege::UPDATE; if (ctx->CREATE_DELETE()) return AuthQuery::FineGrainedPrivilege::CREATE_DELETE; - LOG_FATAL("Should not get here - unknown label privilege!"); + LOG_FATAL("Should not get here - unknown fine grained privilege!"); } /** diff --git a/src/query/frontend/ast/cypher_main_visitor.hpp b/src/query/frontend/ast/cypher_main_visitor.hpp index 719e526f6..c6cb125da 100644 --- a/src/query/frontend/ast/cypher_main_visitor.hpp +++ b/src/query/frontend/ast/cypher_main_visitor.hpp @@ -465,6 +465,11 @@ class CypherMainVisitor : public antlropencypher::MemgraphCypherBaseVisitor { */ antlrcpp::Any visitDenyPrivilege(MemgraphCypher::DenyPrivilegeContext *ctx) override; + /** + * @return AuthQuery* + */ + antlrcpp::Any visitGrantPrivilegesList(MemgraphCypher::GrantPrivilegesListContext *ctx) override; + /** * @return AuthQuery* */ diff --git a/src/query/frontend/opencypher/grammar/MemgraphCypher.g4 b/src/query/frontend/opencypher/grammar/MemgraphCypher.g4 index 6e8064bfd..22b11ab61 100644 --- a/src/query/frontend/opencypher/grammar/MemgraphCypher.g4 +++ b/src/query/frontend/opencypher/grammar/MemgraphCypher.g4 @@ -66,6 +66,7 @@ memgraphCypherKeyword : cypherKeyword | MODE | NEXT | NO + | NOTHING | PASSWORD | PULSAR | PORT @@ -231,7 +232,7 @@ setRole : SET ROLE FOR user=userOrRoleName TO role=userOrRoleName; clearRole : CLEAR ROLE FOR user=userOrRoleName ; -grantPrivilege : GRANT ( ALL PRIVILEGES | privileges=privilegesList ) TO userOrRole=userOrRoleName ; +grantPrivilege : GRANT ( ALL PRIVILEGES | privileges=grantPrivilegesList ) TO userOrRole=userOrRoleName ; denyPrivilege : DENY ( ALL PRIVILEGES | privileges=privilegesList ) TO userOrRole=userOrRoleName ; @@ -260,13 +261,13 @@ privilege : CREATE | WEBSOCKET ; -granularPrivilege : READ | UPDATE | CREATE_DELETE ; +granularPrivilege : NOTHING | READ | UPDATE | CREATE_DELETE ; entityType : LABELS | EDGE_TYPES ; privilegeOrEntityPrivileges : privilege | entityPrivileges=entityPrivilegeList ; -privilegesList : privilegeOrEntityPrivileges ( ',' privilegeOrEntityPrivileges )* ; +grantPrivilegesList : privilegeOrEntityPrivileges ( ',' privilegeOrEntityPrivileges )* ; entityPrivilegeList : entityPrivilege ( ',' entityPrivilege )* ; @@ -276,6 +277,8 @@ privilegeOrEntities : privilege | entityType entities=entitiesList ; revokePrivilegesList : privilegeOrEntities ( ',' privilegeOrEntities )* ; +privilegesList : privilege ( ',' privilege )* ; + entitiesList : ASTERISK | listOfEntities ; listOfEntities : entity ( ',' entity )* ; diff --git a/src/query/frontend/opencypher/grammar/MemgraphCypherLexer.g4 b/src/query/frontend/opencypher/grammar/MemgraphCypherLexer.g4 index acbbcc08e..fbe6f7725 100644 --- a/src/query/frontend/opencypher/grammar/MemgraphCypherLexer.g4 +++ b/src/query/frontend/opencypher/grammar/MemgraphCypherLexer.g4 @@ -77,6 +77,7 @@ MODULE_READ : M O D U L E UNDERSCORE R E A D ; MODULE_WRITE : M O D U L E UNDERSCORE W R I T E ; NEXT : N E X T ; NO : N O ; +NOTHING : N O T H I N G ; PASSWORD : P A S S W O R D ; PORT : P O R T ; PRIVILEGES : P R I V I L E G E S ; diff --git a/src/query/interpreter.cpp b/src/query/interpreter.cpp index deb098075..76970992b 100644 --- a/src/query/interpreter.cpp +++ b/src/query/interpreter.cpp @@ -427,18 +427,8 @@ Callback HandleAuthQuery(AuthQuery *auth_query, AuthQueryHandler *auth, const Pa }; return callback; case AuthQuery::Action::DENY_PRIVILEGE: - callback.fn = [auth, user_or_role, privileges -#ifdef MG_ENTERPRISE - , - label_privileges, edge_type_privileges -#endif - ] { - auth->DenyPrivilege(user_or_role, privileges -#ifdef MG_ENTERPRISE - , - label_privileges, edge_type_privileges -#endif - ); + callback.fn = [auth, user_or_role, privileges] { + auth->DenyPrivilege(user_or_role, privileges); return std::vector>(); }; return callback; diff --git a/src/query/interpreter.hpp b/src/query/interpreter.hpp index 0f423f245..c74304773 100644 --- a/src/query/interpreter.hpp +++ b/src/query/interpreter.hpp @@ -112,17 +112,7 @@ class AuthQueryHandler { ) = 0; /// @throw QueryRuntimeException if an error ocurred. - virtual void DenyPrivilege( - const std::string &user_or_role, const std::vector &privileges -#ifdef MG_ENTERPRISE - , - const std::vector>> - &label_privileges, - - const std::vector>> - &edge_type_privileges -#endif - ) = 0; + virtual void DenyPrivilege(const std::string &user_or_role, const std::vector &privileges) = 0; /// @throw QueryRuntimeException if an error ocurred. virtual void RevokePrivilege( diff --git a/tests/e2e/fine_grained_access/create_delete_filtering_tests.py b/tests/e2e/fine_grained_access/create_delete_filtering_tests.py index 1eb607715..a97d69550 100644 --- a/tests/e2e/fine_grained_access/create_delete_filtering_tests.py +++ b/tests/e2e/fine_grained_access/create_delete_filtering_tests.py @@ -31,7 +31,7 @@ def test_create_node_all_labels_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "CREATE (n:label1) RETURN n;") @@ -51,7 +51,7 @@ def test_create_node_specific_label_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label1 TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "CREATE (n:label1) RETURN n;") @@ -73,7 +73,7 @@ def test_delete_node_all_labels_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n:test_delete) DELETE n") @@ -95,7 +95,7 @@ def test_delete_node_specific_label_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :test_delete TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :test_delete TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n:test_delete) DELETE n;") @@ -120,8 +120,8 @@ def test_create_edge_all_labels_all_edge_types_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -134,8 +134,8 @@ def test_create_edge_all_labels_denied_all_edge_types_granted(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -149,7 +149,7 @@ def test_create_edge_all_labels_granted_all_edge_types_denied(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -165,7 +165,7 @@ def test_create_edge_all_labels_granted_specific_edge_types_denied(): common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") common.execute_and_fetch_all( admin_connection.cursor(), - "DENY CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", + "GRANT UPDATE ON EDGE_TYPES :edge_type TO user;", ) with pytest.raises(DatabaseError): @@ -180,7 +180,7 @@ def test_create_edge_first_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS :label1 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label2 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", @@ -198,7 +198,7 @@ def test_create_edge_second_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS :label2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label1 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", @@ -215,7 +215,7 @@ def test_delete_edge_all_labels_denied_all_edge_types_granted(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY UPDATE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS * TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): @@ -230,7 +230,7 @@ def test_delete_edge_all_labels_granted_all_edge_types_denied(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -246,7 +246,7 @@ def test_delete_edge_all_labels_granted_specific_edge_types_denied(): common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") common.execute_and_fetch_all( admin_connection.cursor(), - "DENY CREATE_DELETE ON EDGE_TYPES :edge_type_delete TO user;", + "GRANT UPDATE ON EDGE_TYPES :edge_type_delete TO user;", ) with pytest.raises(DatabaseError): @@ -261,7 +261,7 @@ def test_delete_edge_first_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :test_delete_1 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY UPDATE ON LABELS :test_delete_2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :test_delete_2 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type_delete TO user;", @@ -279,7 +279,7 @@ def test_delete_edge_second_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :test_delete_2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY UPDATE ON LABELS :test_delete_1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :test_delete_1 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type_delete TO user;", @@ -298,7 +298,7 @@ def test_delete_node_with_edge_label_denied(): common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all( admin_connection.cursor(), - "DENY CREATE_DELETE ON LABELS :test_delete_1 TO user;", + "GRANT UPDATE ON LABELS :test_delete_1 TO user;", ) with pytest.raises(DatabaseError): @@ -335,7 +335,7 @@ def test_merge_node_all_labels_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "MERGE (n:label1) RETURN n;") @@ -355,7 +355,7 @@ def test_merge_node_specific_label_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label1 TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all(user_connnection.cursor(), "MERGE (n:label1) RETURN n;") @@ -379,8 +379,8 @@ def test_merge_edge_all_labels_all_edge_types_denied(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -393,7 +393,7 @@ def test_merge_edge_all_labels_denied_all_edge_types_granted(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS * TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): @@ -408,7 +408,7 @@ def test_merge_edge_all_labels_granted_all_edge_types_denied(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON EDGE_TYPES * TO user;") with pytest.raises(DatabaseError): common.execute_and_fetch_all( @@ -424,7 +424,7 @@ def test_merge_edge_all_labels_granted_specific_edge_types_denied(): common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS * TO user;") common.execute_and_fetch_all( admin_connection.cursor(), - "DENY CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", + "GRANT UPDATE ON EDGE_TYPES :edge_type TO user;", ) with pytest.raises(DatabaseError): @@ -439,7 +439,7 @@ def test_merge_edge_first_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS :label1 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label2 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", @@ -457,7 +457,7 @@ def test_merge_edge_second_node_label_granted(): user_connnection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT CREATE_DELETE ON LABELS :label2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :label1 TO user;") common.execute_and_fetch_all( admin_connection.cursor(), "GRANT CREATE_DELETE ON EDGE_TYPES :edge_type TO user;", @@ -484,7 +484,7 @@ def test_set_label_when_label_denied(): user_connection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :update_label_2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :update_label_2 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :test_delete TO user;") with pytest.raises(DatabaseError): @@ -506,7 +506,7 @@ def test_remove_label_when_label_denied(): user_connection = common.connect(username="user", password="test") common.reset_and_prepare(admin_connection.cursor()) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY CREATE_DELETE ON LABELS :update_label_2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT UPDATE ON LABELS :update_label_2 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :test_delete TO user;") with pytest.raises(DatabaseError): diff --git a/tests/e2e/fine_grained_access/edge_type_filtering_tests.py b/tests/e2e/fine_grained_access/edge_type_filtering_tests.py index e2f0003d0..9a190af8b 100644 --- a/tests/e2e/fine_grained_access/edge_type_filtering_tests.py +++ b/tests/e2e/fine_grained_access/edge_type_filtering_tests.py @@ -17,8 +17,8 @@ def test_all_edge_types_all_labels_granted(): def test_deny_all_edge_types_and_all_labels(): admin_connection = common.connect(username="admin", password="test") user_connnection = common.connect(username="user", password="test") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n)-[r]->(m) RETURN n,r,m;") @@ -41,7 +41,7 @@ def test_deny_edge_type(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edgeType2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edgeType1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edgeType1 TO user;") results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n)-[r]->(m) RETURN n,r,m;") @@ -53,7 +53,7 @@ def test_denied_node_label(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :label1,:label3 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edgeType1, :edgeType2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label2 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label2 TO user;") results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n)-[r]->(m) RETURN n,r,m;") @@ -65,7 +65,7 @@ def test_denied_one_of_node_label(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON LABELS :label1,:label2 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edgeType1, :edgeType2 TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label3 TO user;") results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH (n)-[r]->(m) RETURN n,r,m;") diff --git a/tests/e2e/fine_grained_access/path_filtering_tests.py b/tests/e2e/fine_grained_access/path_filtering_tests.py index 311168408..f69b9188c 100644 --- a/tests/e2e/fine_grained_access/path_filtering_tests.py +++ b/tests/e2e/fine_grained_access/path_filtering_tests.py @@ -52,8 +52,8 @@ def test_weighted_shortest_path_all_edge_types_all_labels_denied(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE LABELS * FROM user;") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE EDGE_TYPES * FROM user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") results = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n)-[r *wShortest (r, n | r.weight)]->(m) RETURN p;" @@ -71,7 +71,7 @@ def test_weighted_shortest_path_denied_start(): admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3, :label4 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label0 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label0 TO user;") path_length_result = common.execute_and_fetch_all( user_connnection.cursor(), @@ -90,7 +90,7 @@ def test_weighted_shortest_path_denied_destination(): admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label1, :label2, :label3 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label4 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label4 TO user;") path_length_result = common.execute_and_fetch_all( user_connnection.cursor(), @@ -108,7 +108,7 @@ def test_weighted_shortest_path_denied_label_1(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label2, :label3, :label4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label1 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") total_paths_results = common.execute_and_fetch_all( @@ -152,7 +152,7 @@ def test_weighted_shortest_path_denied_edge_type_3(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edge_type_1, :edge_type_2, :edge_type_4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edge_type_3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edge_type_3 TO user;") path_result = common.execute_and_fetch_all( user_connnection.cursor(), @@ -215,8 +215,8 @@ def test_dfs_all_edge_types_all_labels_denied(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE LABELS * FROM user;") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE EDGE_TYPES * FROM user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") total_paths_results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH p=(n)-[*]->(m) RETURN p;") @@ -232,7 +232,7 @@ def test_dfs_denied_start(): admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3, :label4 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label0 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label0 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n:label0)-[*]->(m:label4) RETURN p;" @@ -250,7 +250,7 @@ def test_dfs_denied_destination(): admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label1, :label2, :label3 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label4 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label4 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n:label0)-[*]->(m:label4) RETURN p;" @@ -267,7 +267,7 @@ def test_dfs_denied_label_1(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label2, :label3, :label4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label1 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") source_destination_paths = common.execute_and_fetch_all( user_connnection.cursor(), @@ -290,7 +290,7 @@ def test_dfs_denied_edge_type_3(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edge_type_1, :edge_type_2, :edge_type_4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edge_type_3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edge_type_3 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), @@ -327,8 +327,8 @@ def test_bfs_sts_all_edge_types_all_labels_denied(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE LABELS * FROM user;") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE EDGE_TYPES * FROM user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") total_paths_results = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH (n), (m) WITH n, m MATCH p=(n)-[r *BFS]->(m) RETURN p;" @@ -346,7 +346,7 @@ def test_bfs_sts_denied_start(): admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3, :label4 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label0 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label0 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH (n), (m) WITH n, m MATCH p=(n:label0)-[r *BFS]->(m:label4) RETURN p;" @@ -364,7 +364,7 @@ def test_bfs_sts_denied_destination(): admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label1, :label2, :label3 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label4 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label4 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH (n), (m) WITH n, m MATCH p=(n:label0)-[r *BFS]->(m:label4) RETURN p;" @@ -381,7 +381,7 @@ def test_bfs_sts_denied_label_1(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label2, :label3, :label4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label1 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), @@ -402,7 +402,7 @@ def test_bfs_sts_denied_edge_type_3(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edge_type_1, :edge_type_2, :edge_type_4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edge_type_3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edge_type_3 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), @@ -438,8 +438,8 @@ def test_bfs_single_source_all_edge_types_all_labels_denied(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE LABELS * FROM user;") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE EDGE_TYPES * FROM user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") total_paths_results = common.execute_and_fetch_all(user_connnection.cursor(), "MATCH p=(n)-[r *BFS]->(m) RETURN p;") @@ -455,7 +455,7 @@ def test_bfs_single_source_denied_start(): admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3, :label4 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label0 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label0 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n:label0)-[r *BFS]->(m:label4) RETURN p;" @@ -473,7 +473,7 @@ def test_bfs_single_source_denied_destination(): admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label1, :label2, :label3 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label4 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label4 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n:label0)-[r *BFS]->(m:label4) RETURN p;" @@ -490,7 +490,7 @@ def test_bfs_single_source_denied_label_1(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label2, :label3, :label4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label1 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), @@ -512,7 +512,7 @@ def test_bfs_single_source_denied_edge_type_3(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edge_type_1, :edge_type_2, :edge_type_4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edge_type_3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edge_type_3 TO user;") source_destination_path = common.execute_and_fetch_all( user_connnection.cursor(), @@ -574,8 +574,8 @@ def test_all_shortest_paths_when_all_edge_types_all_labels_denied(): user_connnection = common.connect(username="user", password="test") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE LABELS * FROM user;") common.execute_and_fetch_all(admin_connection.cursor(), "REVOKE EDGE_TYPES * FROM user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS * TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES * TO user;") results = common.execute_and_fetch_all( user_connnection.cursor(), "MATCH p=(n)-[r *allShortest (r, n | r.weight)]->(m) RETURN p;" @@ -593,7 +593,7 @@ def test_all_shortest_paths_when_denied_start(): admin_connection.cursor(), "GRANT READ ON LABELS :label1, :label2, :label3, :label4 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label0 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label0 TO user;") path_length_result = common.execute_and_fetch_all( user_connnection.cursor(), @@ -612,7 +612,7 @@ def test_all_shortest_paths_when_denied_destination(): admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label1, :label2, :label3 TO user;" ) common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label4 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label4 TO user;") path_length_result = common.execute_and_fetch_all( user_connnection.cursor(), @@ -630,7 +630,7 @@ def test_all_shortest_paths_when_denied_label_1(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON LABELS :label0, :label2, :label3, :label4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON LABELS :label1 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON LABELS :label1 TO user;") common.execute_and_fetch_all(admin_connection.cursor(), "GRANT READ ON EDGE_TYPES * TO user;") total_paths_results = common.execute_and_fetch_all( @@ -674,7 +674,7 @@ def test_all_shortest_paths_when_denied_edge_type_3(): common.execute_and_fetch_all( admin_connection.cursor(), "GRANT READ ON EDGE_TYPES :edge_type_1, :edge_type_2, :edge_type_4 TO user;" ) - common.execute_and_fetch_all(admin_connection.cursor(), "DENY READ ON EDGE_TYPES :edge_type_3 TO user;") + common.execute_and_fetch_all(admin_connection.cursor(), "GRANT NOTHING ON EDGE_TYPES :edge_type_3 TO user;") path_result = common.execute_and_fetch_all( user_connnection.cursor(), diff --git a/tests/e2e/lba_procedures/read_permission_queries.py b/tests/e2e/lba_procedures/read_permission_queries.py index 9b31a290c..42b8ab240 100644 --- a/tests/e2e/lba_procedures/read_permission_queries.py +++ b/tests/e2e/lba_procedures/read_permission_queries.py @@ -49,23 +49,23 @@ read_node_with_index_operation_cases_expected_sizes = [1, 3, 1, 3, 1, 3] not_read_node_without_index_operation_cases = [ [], - ["DENY READ ON LABELS :read_label TO user;"], - ["DENY READ ON LABELS * TO user;"], + ["GRANT NOTHING ON LABELS :read_label TO user;"], + ["GRANT NOTHING ON LABELS * TO user;"], [ "GRANT UPDATE ON LABELS :read_label TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT UPDATE ON LABELS * TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT CREATE_DELETE ON LABELS :read_label TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT CREATE_DELETE ON LABELS * TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], ] @@ -73,23 +73,23 @@ not_read_node_without_index_operation_cases_expected_sizes = [0, 0, 0, 0, 2, 0, not_read_node_with_index_operation_cases = [ [], - ["DENY READ ON LABELS :read_label TO user;"], - ["DENY READ ON LABELS * TO user;"], + ["GRANT NOTHING ON LABELS :read_label TO user;"], + ["GRANT NOTHING ON LABELS * TO user;"], [ "GRANT UPDATE ON LABELS :read_label TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT UPDATE ON LABELS * TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT CREATE_DELETE ON LABELS :read_label TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], [ "GRANT CREATE_DELETE ON LABELS * TO user;", - "DENY READ ON LABELS :read_label TO user", + "GRANT NOTHING ON LABELS :read_label TO user", ], ] diff --git a/tests/e2e/lba_procedures/read_query_modules.py b/tests/e2e/lba_procedures/read_query_modules.py index 7882ef9d2..9760be5b4 100644 --- a/tests/e2e/lba_procedures/read_query_modules.py +++ b/tests/e2e/lba_procedures/read_query_modules.py @@ -67,7 +67,7 @@ def test_can_not_read_vertex_through_c_api_when_given_deny_on_label(): admin_cursor = connect(username="admin", password="test").cursor() reset_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY READ ON LABELS :read_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON LABELS :read_label TO user;") test_cursor = connect(username="user", password="test").cursor() result = execute_and_fetch_all(test_cursor, get_number_of_vertices_query) @@ -79,7 +79,7 @@ def test_can_read_partial_vertices_through_c_api_when_given_global_read_but_deny admin_cursor = connect(username="admin", password="test").cursor() reset_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY READ ON LABELS :read_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON LABELS :read_label TO user;") execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -92,7 +92,7 @@ def test_can_read_partial_vertices_through_c_api_when_given_global_update_but_de admin_cursor = connect(username="admin", password="test").cursor() reset_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY READ ON LABELS :read_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON LABELS :read_label TO user;") execute_and_fetch_all(admin_cursor, "GRANT UPDATE ON LABELS * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -105,7 +105,7 @@ def test_can_read_partial_vertices_through_c_api_when_given_global_create_delete admin_cursor = connect(username="admin", password="test").cursor() reset_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY READ ON LABELS :read_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON LABELS :read_label TO user;") execute_and_fetch_all(admin_cursor, "GRANT CREATE_DELETE ON LABELS * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -132,7 +132,7 @@ def test_can_not_read_edge_through_c_api_when_given_deny_on_edge_type(): reset_permissions(admin_cursor) execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :read_label_1, :read_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY READ ON EDGE_TYPES :read_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON EDGE_TYPES :read_edge_type TO user;") test_cursor = connect(username="user", password="test").cursor() result = execute_and_fetch_all(test_cursor, get_number_of_edges_query) @@ -184,7 +184,7 @@ def test_can_not_read_edge_through_c_api_when_given_read_global_but_deny_on_edge reset_permissions(admin_cursor) execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :read_label_1, :read_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY READ ON EDGE_TYPES :read_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON EDGE_TYPES :read_edge_type TO user;") execute_and_fetch_all(admin_cursor, "GRANT READ ON EDGE_TYPES * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -198,7 +198,7 @@ def test_can_not_read_edge_through_c_api_when_given_update_global_but_deny_on_ed reset_permissions(admin_cursor) execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :read_label_1, :read_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY READ ON EDGE_TYPES :read_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON EDGE_TYPES :read_edge_type TO user;") execute_and_fetch_all(admin_cursor, "GRANT UPDATE ON EDGE_TYPES * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -212,7 +212,7 @@ def test_can_not_read_edge_through_c_api_when_given_create_delete_global_but_den reset_permissions(admin_cursor) execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :read_label_1, :read_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY READ ON EDGE_TYPES :read_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT NOTHING ON EDGE_TYPES :read_edge_type TO user;") execute_and_fetch_all(admin_cursor, "GRANT CREATE_DELETE ON EDGE_TYPES * TO user;") test_cursor = connect(username="user", password="test").cursor() diff --git a/tests/e2e/lba_procedures/show_privileges.py b/tests/e2e/lba_procedures/show_privileges.py index ddd84d065..6e3c85572 100644 --- a/tests/e2e/lba_procedures/show_privileges.py +++ b/tests/e2e/lba_procedures/show_privileges.py @@ -47,12 +47,12 @@ def test_lba_procedures_show_privileges_first_user(): "GLOBAL EDGE_TYPE PERMISSION GRANTED TO USER", ), ("LABEL :Label1", "READ", "LABEL PERMISSION GRANTED TO USER"), - ("LABEL :Label2", "NO_PERMISSION", "LABEL PERMISSION DENIED TO USER"), + ("LABEL :Label2", "NOTHING", "LABEL PERMISSION DENIED TO USER"), ("LABEL :Label3", "UPDATE", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label4", "READ", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label5", "CREATE_DELETE", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label6", "UPDATE", "LABEL PERMISSION GRANTED TO USER"), - ("LABEL :Label7", "NO_PERMISSION", "LABEL PERMISSION DENIED TO USER"), + ("LABEL :Label7", "NOTHING", "LABEL PERMISSION DENIED TO USER"), ] cursor = connect(username="Josip", password="").cursor() @@ -70,12 +70,12 @@ def test_lba_procedures_show_privileges_second_user(): expected_assertions_boris = [ ("AUTH", "GRANT", "GRANTED TO USER"), ("LABEL :Label1", "READ", "LABEL PERMISSION GRANTED TO USER"), - ("LABEL :Label2", "NO_PERMISSION", "LABEL PERMISSION DENIED TO USER"), + ("LABEL :Label2", "NOTHING", "LABEL PERMISSION DENIED TO USER"), ("LABEL :Label3", "UPDATE", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label4", "READ", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label5", "CREATE_DELETE", "LABEL PERMISSION GRANTED TO USER"), ("LABEL :Label6", "UPDATE", "LABEL PERMISSION GRANTED TO USER"), - ("LABEL :Label7", "NO_PERMISSION", "LABEL PERMISSION DENIED TO USER"), + ("LABEL :Label7", "NOTHING", "LABEL PERMISSION DENIED TO USER"), ] cursor = connect(username="Boris", password="").cursor() diff --git a/tests/e2e/lba_procedures/update_permission_queries.py b/tests/e2e/lba_procedures/update_permission_queries.py index 6c96d9938..05c23256f 100644 --- a/tests/e2e/lba_procedures/update_permission_queries.py +++ b/tests/e2e/lba_procedures/update_permission_queries.py @@ -51,7 +51,7 @@ def test_can_update_node_when_given_update_grant(): def test_can_not_update_node_when_given_deny(): admin_cursor = connect(username="admin", password="test").cursor() reset_update_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON LABELS :update_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label TO user;") test_cursor = connect(username="user", password="test").cursor() diff --git a/tests/e2e/lba_procedures/update_query_modules.py b/tests/e2e/lba_procedures/update_query_modules.py index b62286e7a..6d33cd8b8 100644 --- a/tests/e2e/lba_procedures/update_query_modules.py +++ b/tests/e2e/lba_procedures/update_query_modules.py @@ -86,7 +86,7 @@ def test_can_not_update_vertex_when_denied_update_and_granted_global_update_on_l admin_cursor = connect(username="admin", password="test").cursor() reset_update_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON LABELS :update_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label TO user;") execute_and_fetch_all(admin_cursor, "GRANT UPDATE ON LABELS * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -99,7 +99,7 @@ def test_can_not_update_vertex_when_denied_update_and_granted_global_create_dele admin_cursor = connect(username="admin", password="test").cursor() reset_update_permissions(admin_cursor) - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON LABELS :update_label TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label TO user;") execute_and_fetch_all(admin_cursor, "GRANT CREATE_DELETE ON LABELS * TO user;") test_cursor = connect(username="user", password="test").cursor() @@ -156,8 +156,8 @@ def test_can_not_update_edge_when_denied_update_edge_type_but_granted_global_upd execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label_1 TO user;") execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON EDGE_TYPES :update_edge_type TO user;") - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON EDGE_TYPES * TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON EDGE_TYPES :update_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON EDGE_TYPES * TO user;") test_cursor = connect(username="user", password="test").cursor() result = execute_and_fetch_all(test_cursor, set_edge_property_query) @@ -171,8 +171,8 @@ def test_can_not_update_edge_when_denied_update_edge_type_but_granted_global_cre execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label_1 TO user;") execute_and_fetch_all(admin_cursor, "GRANT READ ON LABELS :update_label_2 TO user;") - execute_and_fetch_all(admin_cursor, "DENY UPDATE ON EDGE_TYPES :update_edge_type TO user;") - execute_and_fetch_all(admin_cursor, "DENY CREATE_DELETE ON EDGE_TYPES * TO user;") + execute_and_fetch_all(admin_cursor, "GRANT READ ON EDGE_TYPES :update_edge_type TO user;") + execute_and_fetch_all(admin_cursor, "GRANT UPDATE ON EDGE_TYPES * TO user;") test_cursor = connect(username="user", password="test").cursor() result = execute_and_fetch_all(test_cursor, set_edge_property_query) diff --git a/tests/e2e/lba_procedures/workloads.yaml b/tests/e2e/lba_procedures/workloads.yaml index 8b849721d..1e7030fa9 100644 --- a/tests/e2e/lba_procedures/workloads.yaml +++ b/tests/e2e/lba_procedures/workloads.yaml @@ -30,33 +30,33 @@ show_privileges_cluster: &show_privileges_cluster setup_queries: - "Create User Josip;" - "Grant Read On Labels :Label1 to Josip;" - - "Deny Read On Labels :Label2 to Josip;" + - "Grant Nothing On Labels :Label2 to Josip;" - "Grant Update On Labels :Label3 to Josip;" - - "Deny Update On Labels :Label4 to Josip;" + - "Grant Read On Labels :Label4 to Josip;" - "Grant Create_Delete On Labels :Label5 to Josip;" - - "Deny Create_Delete On Labels :Label6 to Josip;" + - "Grant Update On Labels :Label6 to Josip;" - "Grant Create_Delete On Labels :Label7 to Josip;" - - "Deny Read On Labels :Label7 to Josip;" + - "Grant Nothing On Labels :Label7 to Josip;" - "Create User Boris;" - "Grant Auth to Boris;" - "Grant Read On Labels :Label1 to Boris;" - - "Deny Read On Labels :Label2 to Boris;" + - "Grant Nothing On Labels :Label2 to Boris;" - "Grant Update On Labels :Label3 to Boris;" - - "Deny Update On Labels :Label4 to Boris;" + - "Grant Read On Labels :Label4 to Boris;" - "Grant Create_Delete On Labels :Label5 to Boris;" - - "Deny Create_Delete On Labels :Label6 to Boris;" + - "Grant Update On Labels :Label6 to Boris;" - "Grant Create_Delete On Labels :Label7 to Boris;" - - "Deny Read On Labels :Label7 to Boris;" + - "Grant Nothing On Labels :Label7 to Boris;" - "Create User Niko;" - "Grant Auth to Niko;" - "Grant Create_Delete On Labels * to Niko" - - "Deny Update On Labels * to Niko" + - "Grant Read On Labels * to Niko" - "Create User Bruno;" - "Grant Auth to Bruno;" - - "Deny Create_Delete On Labels * to Bruno" + - "Grant Update On Labels * to Bruno" validation_queries: [] read_permission_queries: &read_permission_queries diff --git a/tests/unit/auth.cpp b/tests/unit/auth.cpp index 61ea5313d..9091d8fac 100644 --- a/tests/unit/auth.cpp +++ b/tests/unit/auth.cpp @@ -193,11 +193,6 @@ TEST_F(AuthWithStorage, UserRoleFineGrainedAccessHandler) { ASSERT_EQ(user->fine_grained_access_handler().edge_type_permissions(), user->GetFineGrainedAccessEdgeTypePermissions()); - // Deny one label to user . - user->fine_grained_access_handler().label_permissions().Deny("labelTest1", FineGrainedPermission::READ); - // Deny one edge type to user . - user->fine_grained_access_handler().edge_type_permissions().Deny("edgeTypeTest1", FineGrainedPermission::READ); - // Check permissions. ASSERT_EQ(user->fine_grained_access_handler().label_permissions().Has("labelTest1", FineGrainedPermission::READ), PermissionLevel::DENY); @@ -227,9 +222,6 @@ TEST_F(AuthWithStorage, UserRoleFineGrainedAccessHandler) { PermissionLevel::GRANT); } - // Deny label and edge type to role and role to user. - role->fine_grained_access_handler().label_permissions().Deny("roleLabelTest1", FineGrainedPermission::READ); - role->fine_grained_access_handler().edge_type_permissions().Deny("roleEdgeTypeTest1", FineGrainedPermission::READ); user->SetRole(*role); // Check permissions. @@ -520,21 +512,12 @@ TEST(AuthWithoutStorage, FineGrainedAccessPermissions) { ASSERT_FALSE(fga_permissions.GetPermissions().empty()); } - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(any_label, FineGrainedPermission::CREATE_DELETE); - - ASSERT_EQ(fga_permissions.GetGlobalPermission(), std::nullopt); - ASSERT_FALSE(fga_permissions.GetPermissions().empty()); - } - { FineGrainedAccessPermissions fga_permissions; fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(any_label, FineGrainedPermission::CREATE_DELETE); ASSERT_EQ(fga_permissions.GetGlobalPermission(), kLabelPermissionAll); - ASSERT_FALSE(fga_permissions.GetPermissions().empty()); + ASSERT_TRUE(fga_permissions.GetPermissions().empty()); } { @@ -564,43 +547,6 @@ TEST(AuthWithoutStorage, FineGrainedAccessPermissions) { ASSERT_TRUE(fga_permissions.GetPermissions().empty()); } - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Revoke(any_label); - - ASSERT_EQ(fga_permissions.GetGlobalPermission(), FineGrainedPermission::UPDATE | FineGrainedPermission::READ); - ASSERT_TRUE(fga_permissions.GetPermissions().empty()); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(any_label, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Revoke(any_label); - - ASSERT_EQ(fga_permissions.GetGlobalPermission(), std::nullopt); - ASSERT_TRUE(fga_permissions.GetPermissions().empty()); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(any_label, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Revoke(asterisk); - - ASSERT_EQ(fga_permissions.GetGlobalPermission(), std::nullopt); - ASSERT_TRUE(fga_permissions.GetPermissions().empty()); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(check_label, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(non_check_label, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Revoke(asterisk); - - ASSERT_EQ(fga_permissions.GetGlobalPermission(), std::nullopt); - ASSERT_TRUE(fga_permissions.GetPermissions().empty()); - } - { FineGrainedAccessPermissions fga_permissions; fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); @@ -628,33 +574,6 @@ TEST(AuthWithoutStorage, FineGrainedAccessPermissions) { ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::GRANT); } - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(asterisk, FineGrainedPermission::CREATE_DELETE); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(asterisk, FineGrainedPermission::UPDATE); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Deny(asterisk, FineGrainedPermission::READ); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::DENY); - } - { FineGrainedAccessPermissions fga_permissions; fga_permissions.Grant(asterisk, FineGrainedPermission::READ); @@ -667,117 +586,6 @@ TEST(AuthWithoutStorage, FineGrainedAccessPermissions) { ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::READ); - fga_permissions.Deny(check_label, FineGrainedPermission::CREATE_DELETE); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(check_label, FineGrainedPermission::UPDATE); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(check_label, FineGrainedPermission::CREATE_DELETE); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(asterisk, FineGrainedPermission::CREATE_DELETE); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::GRANT); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(asterisk, FineGrainedPermission::UPDATE); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::GRANT); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(asterisk, FineGrainedPermission::READ); - - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(any_label, FineGrainedPermission::READ), PermissionLevel::DENY); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(check_label, FineGrainedPermission::READ); - fga_permissions.Revoke(asterisk); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(check_label, FineGrainedPermission::UPDATE); - fga_permissions.Revoke(asterisk); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - } - - { - FineGrainedAccessPermissions fga_permissions; - fga_permissions.Grant(asterisk, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Deny(check_label, FineGrainedPermission::CREATE_DELETE); - fga_permissions.Revoke(asterisk); - - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::CREATE_DELETE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::UPDATE), PermissionLevel::DENY); - ASSERT_EQ(fga_permissions.Has(non_check_label, FineGrainedPermission::READ), PermissionLevel::DENY); - } } TEST_F(AuthWithStorage, FineGrainedAccessCheckerMerge) { diff --git a/tests/unit/auth_checker.cpp b/tests/unit/auth_checker.cpp index 05c29c425..90d0ed234 100644 --- a/tests/unit/auth_checker.cpp +++ b/tests/unit/auth_checker.cpp @@ -81,7 +81,7 @@ TEST_F(FineGrainedAuthCheckerFixture, GrantedAllEdgeTypes) { TEST_F(FineGrainedAuthCheckerFixture, DeniedAllLabels) { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_FALSE( @@ -100,7 +100,7 @@ TEST_F(FineGrainedAuthCheckerFixture, DeniedAllLabels) { TEST_F(FineGrainedAuthCheckerFixture, DeniedAllEdgeTypes) { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_FALSE(auth_checker.Has(r1, memgraph::query::AuthQuery::FineGrainedPrivilege::READ)); @@ -123,7 +123,7 @@ TEST_F(FineGrainedAuthCheckerFixture, GrantLabel) { TEST_F(FineGrainedAuthCheckerFixture, DenyLabel) { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("l3", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_FALSE( @@ -138,7 +138,7 @@ TEST_F(FineGrainedAuthCheckerFixture, GrantAndDenySpecificLabels) { memgraph::auth::FineGrainedPermission::CREATE_DELETE); user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("l3", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_TRUE( @@ -161,7 +161,7 @@ TEST_F(FineGrainedAuthCheckerFixture, MultipleVertexLabels) { memgraph::auth::FineGrainedPermission::CREATE_DELETE); user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("l3", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_TRUE(v1.AddLabel(dba.NameToLabel("l3")).HasValue()); ASSERT_TRUE(v2.AddLabel(dba.NameToLabel("l1")).HasValue()); @@ -188,8 +188,8 @@ TEST_F(FineGrainedAuthCheckerFixture, GrantEdgeType) { TEST_F(FineGrainedAuthCheckerFixture, DenyEdgeType) { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_1", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", + memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_FALSE(auth_checker.Has(r1, memgraph::query::AuthQuery::FineGrainedPrivilege::READ)); @@ -199,8 +199,8 @@ TEST_F(FineGrainedAuthCheckerFixture, GrantAndDenySpecificEdgeTypes) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant( "edge_type_1", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_2", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", + memgraph::auth::FineGrainedPermission::NOTHING); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; ASSERT_TRUE(auth_checker.Has(r1, memgraph::query::AuthQuery::FineGrainedPrivilege::READ)); diff --git a/tests/unit/auth_handler.cpp b/tests/unit/auth_handler.cpp index 267056635..fad55447f 100644 --- a/tests/unit/auth_handler.cpp +++ b/tests/unit/auth_handler.cpp @@ -647,7 +647,7 @@ TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedGlobalAllPrivilegesOnEdgeTyp TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnLabelThenNoPermission) { auto read_permission = memgraph::auth::FineGrainedAccessPermissions(); read_permission.Grant(label_repr, memgraph::auth::FineGrainedPermission::READ); - read_permission.Deny(label_repr, memgraph::auth::FineGrainedPermission::READ); + read_permission.Grant(label_repr, memgraph::auth::FineGrainedPermission::NOTHING); handler = memgraph::auth::FineGrainedAccessHandler{ memgraph::auth::FineGrainedAccessPermissions{read_permission}, @@ -667,7 +667,7 @@ TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnLabelThenNoPermis ASSERT_EQ(result[0].ValueString(), "LABEL :Label1"); ASSERT_TRUE(result[1].IsString()); - ASSERT_EQ(result[1].ValueString(), "NO_PERMISSION"); + ASSERT_EQ(result[1].ValueString(), "NOTHING"); ASSERT_TRUE(result[2].IsString()); ASSERT_EQ(result[2].ValueString(), "LABEL PERMISSION DENIED TO USER"); @@ -676,7 +676,7 @@ TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnLabelThenNoPermis TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnEdgeTypeThenNoPermission) { auto read_permission = memgraph::auth::FineGrainedAccessPermissions(); read_permission.Grant(edge_type_repr, memgraph::auth::FineGrainedPermission::READ); - read_permission.Deny(edge_type_repr, memgraph::auth::FineGrainedPermission::READ); + read_permission.Grant(edge_type_repr, memgraph::auth::FineGrainedPermission::NOTHING); handler = memgraph::auth::FineGrainedAccessHandler{ memgraph::auth::FineGrainedAccessPermissions{}, @@ -696,7 +696,7 @@ TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnEdgeTypeThenNoPer ASSERT_EQ(result[0].ValueString(), "EDGE_TYPE :EdgeType1"); ASSERT_TRUE(result[1].IsString()); - ASSERT_EQ(result[1].ValueString(), "NO_PERMISSION"); + ASSERT_EQ(result[1].ValueString(), "NOTHING"); ASSERT_TRUE(result[2].IsString()); ASSERT_EQ(result[2].ValueString(), "EDGE_TYPE PERMISSION DENIED TO USER"); @@ -705,7 +705,7 @@ TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedAndDeniedOnEdgeTypeThenNoPer TEST_F(AuthQueryHandlerFixture, GivenUserWhenGrantedReadAndDeniedUpdateThenOneIsDisplayed) { auto read_permission = memgraph::auth::FineGrainedAccessPermissions(); read_permission.Grant(edge_type_repr, memgraph::auth::FineGrainedPermission::READ); - read_permission.Deny(edge_type_repr, memgraph::auth::FineGrainedPermission::UPDATE); + read_permission.Grant(edge_type_repr, memgraph::auth::FineGrainedPermission::READ); handler = memgraph::auth::FineGrainedAccessHandler{ memgraph::auth::FineGrainedAccessPermissions{}, diff --git a/tests/unit/bfs_common.hpp b/tests/unit/bfs_common.hpp index 3c3114654..431ab9214 100644 --- a/tests/unit/bfs_common.hpp +++ b/tests/unit/bfs_common.hpp @@ -492,15 +492,13 @@ void BfsTestWithFineGrainedFiltering(Database *db, int lower_bound, int upper_bo edges_in_result = GetEdgeList(kEdges, direction, {"a", "b"}); break; case FineGrainedTestType::ALL_DENIED: - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - break; case FineGrainedTestType::EDGE_TYPE_A_DENIED: user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant("b", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("a", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("a", + memgraph::auth::FineGrainedPermission::NOTHING); edges_in_result = GetEdgeList(kEdges, direction, {"b"}); break; @@ -508,7 +506,8 @@ void BfsTestWithFineGrainedFiltering(Database *db, int lower_bound, int upper_bo user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant("a", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("b", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("b", + memgraph::auth::FineGrainedPermission::NOTHING); edges_in_result = GetEdgeList(kEdges, direction, {"a"}); break; @@ -519,7 +518,7 @@ void BfsTestWithFineGrainedFiltering(Database *db, int lower_bound, int upper_bo user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("3", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("4", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("0", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::NOTHING); edges_in_result = GetEdgeList(kEdges, direction, {"a", "b"}); edges_in_result.erase( @@ -533,7 +532,7 @@ void BfsTestWithFineGrainedFiltering(Database *db, int lower_bound, int upper_bo user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("4", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("3", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("3", memgraph::auth::FineGrainedPermission::NOTHING); edges_in_result = GetEdgeList(kEdges, direction, {"a", "b"}); edges_in_result.erase( diff --git a/tests/unit/cypher_main_visitor.cpp b/tests/unit/cypher_main_visitor.cpp index 9e009fa83..6ead1a7ad 100644 --- a/tests/unit/cypher_main_visitor.cpp +++ b/tests/unit/cypher_main_visitor.cpp @@ -2310,53 +2310,6 @@ TEST_P(CypherMainVisitorTest, DenyPrivilege) { {AuthQuery::Privilege::MODULE_READ}, {}, {}); check_auth_query(&ast_generator, "DENY MODULE_WRITE TO user", AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", {}, {AuthQuery::Privilege::MODULE_WRITE}, {}, {}); - - std::vector>> label_privileges{}; - std::vector>> edge_type_privileges{}; - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::READ}, {{"*"}}}}); - check_auth_query(&ast_generator, "DENY READ ON LABELS * TO user", AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", - {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::UPDATE}, {{"*"}}}}); - check_auth_query(&ast_generator, "DENY UPDATE ON LABELS * TO user", AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", - {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::CREATE_DELETE}, {{"*"}}}}); - check_auth_query(&ast_generator, "DENY CREATE_DELETE ON LABELS * TO user", AuthQuery::Action::DENY_PRIVILEGE, "", "", - "user", {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::READ}, {{"Label1"}, {"Label2"}}}}); - check_auth_query(&ast_generator, "DENY READ ON LABELS :Label1, :Label2 TO user", AuthQuery::Action::DENY_PRIVILEGE, - "", "", "user", {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::UPDATE}, {{"Label1"}, {"Label2"}}}}); - check_auth_query(&ast_generator, "DENY UPDATE ON LABELS :Label1, :Label2 TO user", AuthQuery::Action::DENY_PRIVILEGE, - "", "", "user", {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::CREATE_DELETE}, {{"Label1"}, {"Label2"}}}}); - check_auth_query(&ast_generator, "DENY CREATE_DELETE ON LABELS :Label1, :Label2 TO user", - AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::READ}, {{"Label1"}, {"Label2"}}}, - {{AuthQuery::FineGrainedPrivilege::UPDATE}, {{"Label3"}}}}); - check_auth_query(&ast_generator, "DENY READ ON LABELS :Label1, :Label2, UPDATE ON LABELS :Label3 TO user", - AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", {}, {}, label_privileges, {}); - label_privileges.clear(); - - label_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::READ}, {{"Label1"}, {"Label2"}}}}); - edge_type_privileges.push_back({{{AuthQuery::FineGrainedPrivilege::READ}, {{"Edge1"}, {"Edge2"}, {"Edge3"}}}}); - check_auth_query(&ast_generator, - "DENY READ ON LABELS :Label1, :Label2, READ ON EDGE_TYPES :Edge1, :Edge2, :Edge3 TO user", - AuthQuery::Action::DENY_PRIVILEGE, "", "", "user", {}, {}, label_privileges, edge_type_privileges); - label_privileges.clear(); - edge_type_privileges.clear(); } TEST_P(CypherMainVisitorTest, RevokePrivilege) { diff --git a/tests/unit/query_plan_create_set_remove_delete.cpp b/tests/unit/query_plan_create_set_remove_delete.cpp index 9da260102..30d7806f7 100644 --- a/tests/unit/query_plan_create_set_remove_delete.cpp +++ b/tests/unit/query_plan_create_set_remove_delete.cpp @@ -115,8 +115,8 @@ TEST(QueryPlan, FineGrainedCreateNodeWithAttributes) { // Denied label { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("label1", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("label1", + memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(test_create(user), QueryRuntimeException); } } @@ -215,8 +215,8 @@ TEST(QueryPlan, FineGrainedCreateReturn) { // Denied label { memgraph::auth::User user{"Test"}; - user.fine_grained_access_handler().label_permissions().Deny("label", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("label", + memgraph::auth::FineGrainedPermission::UPDATE); memgraph::glue::FineGrainedAuthChecker auth_checker{user, &dba}; auto context = MakeContextWithFineGrainedChecker(storage, symbol_table, &dba, &auth_checker); ASSERT_THROW(CollectProduce(*produce, &context), QueryRuntimeException); @@ -354,10 +354,8 @@ class CreateExpandWithAuthFixture : public testing::Test { TEST_F(CreateExpandWithAuthFixture, CreateExpandWithNoGrantsOnCreateDelete) { // All labels denied, All edge types denied memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteCreateExpand(false, user), QueryRuntimeException); ASSERT_THROW(ExecuteCreateExpand(true, user), QueryRuntimeException); } @@ -367,8 +365,7 @@ TEST_F(CreateExpandWithAuthFixture, CreateExpandWithLabelsGrantedOnly) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteCreateExpand(false, user), QueryRuntimeException); ASSERT_THROW(ExecuteCreateExpand(true, user), QueryRuntimeException); @@ -377,8 +374,7 @@ TEST_F(CreateExpandWithAuthFixture, CreateExpandWithLabelsGrantedOnly) { TEST_F(CreateExpandWithAuthFixture, CreateExpandWithEdgeTypesGrantedOnly) { // All labels denied, All edge types granted memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -391,9 +387,8 @@ TEST_F(CreateExpandWithAuthFixture, CreateExpandWithFirstLabelGranted) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("Node1", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("Node2", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("Node2", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().label_permissions().Grant("Node2", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().label_permissions().Grant("Node2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -406,8 +401,7 @@ TEST_F(CreateExpandWithAuthFixture, CreateExpandWithSecondLabelGranted) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("Node2", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("Node1", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("Node1", memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -520,8 +514,7 @@ class MatchCreateNodeWithAuthFixture : public testing::Test { TEST_F(MatchCreateNodeWithAuthFixture, MatchCreateWithAllLabelsDeniedThrows) { // All labels denied memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteMatchCreateTestSuite(user, 3), QueryRuntimeException); } @@ -544,8 +537,7 @@ TEST_F(MatchCreateNodeWithAuthFixture, MatchCreateWithOneLabelDeniedThrows) { user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("l2", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteMatchCreateTestSuite(user, 3), QueryRuntimeException); } @@ -661,10 +653,8 @@ class MatchCreateExpandWithAuthFixture : public testing::Test { TEST_F(MatchCreateExpandWithAuthFixture, MatchCreateExpandThrowsWhenDeniedEverything) { // All labels denied, All edge types denied memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteMatchCreateExpandTestSuite(false, 0, 0, user), QueryRuntimeException); ASSERT_THROW(ExecuteMatchCreateExpandTestSuite(true, 0, 0, user), QueryRuntimeException); } @@ -674,8 +664,7 @@ TEST_F(MatchCreateExpandWithAuthFixture, MatchCreateExpandThrowsWhenDeniedEdgeTy memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteMatchCreateExpandTestSuite(false, 0, 0, user), QueryRuntimeException); ASSERT_THROW(ExecuteMatchCreateExpandTestSuite(true, 0, 0, user), QueryRuntimeException); } @@ -683,7 +672,7 @@ TEST_F(MatchCreateExpandWithAuthFixture, MatchCreateExpandThrowsWhenDeniedEdgeTy TEST_F(MatchCreateExpandWithAuthFixture, MatchCreateExpandThrowsWhenDeniedLabels) { // All labels denied, All edge types granted memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); ASSERT_THROW(ExecuteMatchCreateExpandTestSuite(false, 0, 0, user), QueryRuntimeException); @@ -695,7 +684,7 @@ TEST_F(MatchCreateExpandWithAuthFixture, MatchCreateExpandThrowsWhenDeniedOneLab memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("l1", memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().label_permissions().Deny("l2", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -905,8 +894,7 @@ class DeleteOperatorWithAuthFixture : public testing::Test { TEST_F(DeleteOperatorWithAuthFixture, DeleteNodeThrowsExceptionWhenAllLabelsDenied) { // All labels denied memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteDeleteNodesTestSuite(user, 0), QueryRuntimeException); } @@ -931,8 +919,7 @@ TEST_F(DeleteOperatorWithAuthFixture, DeleteNodeThrowsExceptionWhenEdgeTypesNotG // All labels granted,All edge types denied memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteDeleteNodesTestSuite(user, 0), QueryRuntimeException); } @@ -942,16 +929,16 @@ TEST_F(DeleteOperatorWithAuthFixture, DeleteEdgesThrowsErrorWhenPartialGrant) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("l1", memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().label_permissions().Deny("l3", memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().label_permissions().Deny("l4", memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().label_permissions().Grant("l3", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l4", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant( "type0", memgraph::auth::FineGrainedPermission::CREATE_DELETE); user.fine_grained_access_handler().edge_type_permissions().Grant( "type1", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("type2", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("type3", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().edge_type_permissions().Grant("type2", + memgraph::auth::FineGrainedPermission::UPDATE); + user.fine_grained_access_handler().edge_type_permissions().Grant("type3", + memgraph::auth::FineGrainedPermission::UPDATE); ASSERT_THROW(ExecuteDeleteEdgesTestSuite(user, 0), QueryRuntimeException); } @@ -1307,8 +1294,7 @@ TEST(QueryPlan, SetLabelsWithFineGrained) { // All labels denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); memgraph::storage::Storage db; auto storage_dba = db.Access(); memgraph::query::DbAccessor dba(&storage_dba); @@ -1324,8 +1310,8 @@ TEST(QueryPlan, SetLabelsWithFineGrained) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("label1", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("label2", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("label2", + memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().label_permissions().Grant("label3", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -1487,8 +1473,7 @@ TEST(QueryPlan, RemoveLabelsFineGrainedFiltering) { // All labels denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); memgraph::storage::Storage db; auto storage_dba = db.Access(); memgraph::query::DbAccessor dba(&storage_dba); @@ -1504,8 +1489,8 @@ TEST(QueryPlan, RemoveLabelsFineGrainedFiltering) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("label1", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("label2", - memgraph::auth::FineGrainedPermission::CREATE_DELETE); + user.fine_grained_access_handler().label_permissions().Grant("label2", + memgraph::auth::FineGrainedPermission::UPDATE); user.fine_grained_access_handler().label_permissions().Grant("label3", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -2071,7 +2056,7 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { { auto user = memgraph::auth::User{"denied_global"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); SetVertexProperty(v); ExecuteSetPropertyOnVertex(user, 2); @@ -2089,8 +2074,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { { auto user = memgraph::auth::User{"denied_label"}; - user.fine_grained_access_handler().label_permissions().Deny(vertex_label_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(vertex_label_name, + memgraph::auth::FineGrainedPermission::NOTHING); SetVertexProperty(v); ExecuteSetPropertyOnVertex(user, 2); @@ -2184,7 +2169,7 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { user.fine_grained_access_handler().label_permissions().Grant(vertex_label_name, memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); SetVertexProperty(v); ExecuteSetPropertyOnVertex(user, 2); @@ -2202,8 +2187,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { { auto user = memgraph::auth::User{"granted_update_global_denied_read_label"}; - user.fine_grained_access_handler().label_permissions().Deny(vertex_label_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(vertex_label_name, + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); SetVertexProperty(v); @@ -2224,7 +2209,7 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { user.fine_grained_access_handler().label_permissions().Grant(vertex_label_name, memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); SetVertexProperty(v); ExecuteSetPropertyOnVertex(user, 2); @@ -2242,8 +2227,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyWithAuthChecker) { { auto user = memgraph::auth::User{"granted_create_delete_global_denied_read_label"}; - user.fine_grained_access_handler().label_permissions().Deny(vertex_label_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(vertex_label_name, + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); @@ -2315,7 +2300,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { auto user = memgraph::auth::User{"denied_global"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); SetEdgeProperty(edge.GetValue()); ExecuteSetPropertyOnEdge(user, 2); @@ -2334,8 +2320,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { auto user = memgraph::auth::User{"denied_edge_type"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny(edge_type_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant(edge_type_name, + memgraph::auth::FineGrainedPermission::NOTHING); SetEdgeProperty(edge.GetValue()); ExecuteSetPropertyOnEdge(user, 2); @@ -2396,7 +2382,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant(edge_type_name, memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); SetEdgeProperty(edge.GetValue()); ExecuteSetPropertyOnEdge(user, 2); @@ -2454,8 +2441,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { auto user = memgraph::auth::User{"granted_update_global_denied_read_edge_type"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny(edge_type_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant(edge_type_name, + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); @@ -2478,7 +2465,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant( edge_type_name, memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); SetEdgeProperty(edge.GetValue()); ExecuteSetPropertyOnEdge(user, 2); @@ -2497,8 +2485,8 @@ TEST_F(UpdatePropertiesWithAuthFixture, SetPropertyExpandWithAuthChecker) { auto user = memgraph::auth::User{"granted_create_delete_global_denied_read_edge_type"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny(edge_type_name, - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant(edge_type_name, + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant( "*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); diff --git a/tests/unit/query_plan_match_filter_return.cpp b/tests/unit/query_plan_match_filter_return.cpp index 2aa614cf1..43596dfe6 100644 --- a/tests/unit/query_plan_match_filter_return.cpp +++ b/tests/unit/query_plan_match_filter_return.cpp @@ -138,7 +138,7 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { { auto user = memgraph::auth::User{"deny_global"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); test_hypothesis(user, memgraph::storage::View::OLD, 0); test_hypothesis(user, memgraph::storage::View::NEW, 0); @@ -154,7 +154,8 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { { auto user = memgraph::auth::User{"deny_label_read"}; - user.fine_grained_access_handler().label_permissions().Deny(labelName, memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(labelName, + memgraph::auth::FineGrainedPermission::NOTHING); test_hypothesis(user, memgraph::storage::View::OLD, 0); test_hypothesis(user, memgraph::storage::View::NEW, 0); @@ -163,7 +164,8 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { { auto user = memgraph::auth::User{"grant_global_deny_label"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny(labelName, memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(labelName, + memgraph::auth::FineGrainedPermission::NOTHING); test_hypothesis(user, memgraph::storage::View::OLD, 0); test_hypothesis(user, memgraph::storage::View::NEW, 0); @@ -171,7 +173,7 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { { auto user = memgraph::auth::User{"deny_global_grant_label"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant(labelName, memgraph::auth::FineGrainedPermission::READ); @@ -182,7 +184,8 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { { auto user = memgraph::auth::User{"global_update_deny_label"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::UPDATE); - user.fine_grained_access_handler().label_permissions().Deny(labelName, memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(labelName, + memgraph::auth::FineGrainedPermission::NOTHING); test_hypothesis(user, memgraph::storage::View::OLD, 0); test_hypothesis(user, memgraph::storage::View::NEW, 0); @@ -192,7 +195,8 @@ TEST_F(MatchReturnFixture, ScanAllWithAuthChecker) { auto user = memgraph::auth::User{"global_create_delete_deny_label"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().label_permissions().Deny(labelName, memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant(labelName, + memgraph::auth::FineGrainedPermission::NOTHING); test_hypothesis(user, memgraph::storage::View::OLD, 0); test_hypothesis(user, memgraph::storage::View::NEW, 0); @@ -534,8 +538,8 @@ TEST_F(ExpandFixture, ExpandWithEdgeFiltering) { user.fine_grained_access_handler().edge_type_permissions().Grant( "Edge", memgraph::auth::FineGrainedPermission::CREATE_DELETE); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_test", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_test", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::CREATE_DELETE); memgraph::storage::EdgeTypeId edge_type_test{db.NameToEdgeType("edge_type_test")}; @@ -851,8 +855,9 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { // All labels, All edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 1, nullopt, reverse, user), (map_int{})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 1, nullopt, reverse, user), (map_int{})); @@ -866,7 +871,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { // All labels granted, All edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 0, nullopt, reverse, user), (map_int{{0, 2}})); @@ -888,7 +894,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 1, nullopt, reverse, user), (map_int{})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 1, nullopt, reverse, user), (map_int{})); @@ -905,7 +911,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("1", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 0, nullopt, reverse, user), (map_int{{0, 2}})); @@ -926,8 +932,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { // All labels granted, Edge types from layer 0 to layer 1 denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_1", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); @@ -956,7 +962,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 0, nullopt, reverse, user), (map_int{{0, 2}})); @@ -984,8 +990,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedOneVariableExpansion) { user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_2", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", + memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, 0, nullopt, reverse, user), (map_int{{0, 2}})); @@ -1099,8 +1105,9 @@ TEST_F(QueryPlanExpandVariable, FineGrainedEdgeUniquenessTwoVariableExpansions) // All labels denied, All edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 2, 2, false, user), (map_int{})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 2, 2, true, user), (map_int{})); @@ -1111,7 +1118,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedEdgeUniquenessTwoVariableExpansions) user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("1", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::NOTHING); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, false, user), (map_int{{0, 4}})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, true, user), (map_int{{0, 4}})); @@ -1123,7 +1130,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedEdgeUniquenessTwoVariableExpansions) user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::NOTHING); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, false, user), (map_int{{1, 4}, {0, 2}})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, true, user), (map_int{{1, 4}, {0, 2}})); @@ -1133,8 +1140,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedEdgeUniquenessTwoVariableExpansions) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_1", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", memgraph::auth::FineGrainedPermission::READ); @@ -1150,8 +1157,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedEdgeUniquenessTwoVariableExpansions) user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_2", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", + memgraph::auth::FineGrainedPermission::NOTHING); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, false, user), (map_int{{1, 24}, {0, 12}})); EXPECT_EQ(test_expand(0, EdgeAtom::Direction::OUT, 0, 2, true, user), (map_int{{1, 20}, {0, 12}})); @@ -1220,8 +1227,9 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { // All labels and edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); auto results = GetPathResults(create_path, path_symbol, &user); ASSERT_EQ(results.size(), 0); @@ -1231,7 +1239,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); auto results = GetPathResults(create_path, path_symbol, &user); ASSERT_EQ(results.size(), 0); @@ -1240,7 +1248,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { // All labels granted, All edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); auto results = GetPathResults(create_path, path_symbol, &user); @@ -1251,7 +1260,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("0", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); @@ -1264,7 +1273,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("1", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); auto results = GetPathResults(create_path, path_symbol, &user); @@ -1277,7 +1286,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::NOTHING); auto results = GetPathResults(create_path, path_symbol, &user); ASSERT_EQ(results.size(), 6); @@ -1297,8 +1306,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { // First layer edge type denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_1", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); @@ -1312,8 +1321,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedFilterNamedPath) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_2", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); auto results = GetPathResults(create_path, path_symbol, &user); @@ -1587,8 +1596,9 @@ TEST_F(QueryPlanExpandVariable, FineGrainedExpandToSameSymbol) { // All labels denied, All edge types denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, std::nullopt, std::nullopt, reverse, user), (map_int{})); @@ -1614,7 +1624,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedExpandToSameSymbol) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("1", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::READ); for (auto reverse : {false, true}) { @@ -1642,7 +1652,7 @@ TEST_F(QueryPlanExpandVariable, FineGrainedExpandToSameSymbol) { user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("0", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().label_permissions().Deny("2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("2", memgraph::auth::FineGrainedPermission::NOTHING); for (auto reverse : {false, true}) { EXPECT_EQ(test_expand(0, EdgeAtom::Direction::IN, std::nullopt, std::nullopt, reverse, user), (map_int{})); @@ -1668,8 +1678,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedExpandToSameSymbol) { // All labels granted, Edge type from layer 0 to layer 1 denied { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_1", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", memgraph::auth::FineGrainedPermission::READ); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); @@ -1698,8 +1708,8 @@ TEST_F(QueryPlanExpandVariable, FineGrainedExpandToSameSymbol) { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_1", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_2", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_2", + memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); for (auto reverse : {false, true}) { @@ -2090,7 +2100,7 @@ TEST_F(QueryPlanExpandWeightedShortestPath, FineGrainedFiltering) { // Denied all labels { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); auto results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(results.size(), 0); @@ -2100,7 +2110,8 @@ TEST_F(QueryPlanExpandWeightedShortestPath, FineGrainedFiltering) { { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); auto results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(results.size(), 0); } @@ -2108,7 +2119,7 @@ TEST_F(QueryPlanExpandWeightedShortestPath, FineGrainedFiltering) { // Denied first vertex label { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("l0", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l0", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); auto results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); @@ -2128,7 +2139,7 @@ TEST_F(QueryPlanExpandWeightedShortestPath, FineGrainedFiltering) { auto results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(results.size(), 4); - user.fine_grained_access_handler().label_permissions().Deny("l2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::NOTHING); auto filtered_results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(filtered_results.size(), 3); } @@ -2153,8 +2164,8 @@ TEST_F(QueryPlanExpandWeightedShortestPath, FineGrainedFiltering) { user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_filter", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_filter", + memgraph::auth::FineGrainedPermission::NOTHING); auto filtered_results = ExpandWShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(filtered_results.size(), 4); } @@ -2547,7 +2558,8 @@ TEST_F(QueryPlanExpandAllShortestPaths, BasicWithFineGrainedFiltering) { { memgraph::auth::User user{"test"}; user.fine_grained_access_handler().label_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("*", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("*", + memgraph::auth::FineGrainedPermission::NOTHING); auto results = ExpandAllShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(results.size(), 0); } @@ -2555,7 +2567,7 @@ TEST_F(QueryPlanExpandAllShortestPaths, BasicWithFineGrainedFiltering) { // Denied first vertex label { memgraph::auth::User user{"test"}; - user.fine_grained_access_handler().label_permissions().Deny("l0", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l0", memgraph::auth::FineGrainedPermission::NOTHING); user.fine_grained_access_handler().edge_type_permissions().Grant("*", memgraph::auth::FineGrainedPermission::READ); auto results = ExpandAllShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); @@ -2574,7 +2586,7 @@ TEST_F(QueryPlanExpandAllShortestPaths, BasicWithFineGrainedFiltering) { auto results = ExpandAllShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(results.size(), 4); - user.fine_grained_access_handler().label_permissions().Deny("l2", memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().label_permissions().Grant("l2", memgraph::auth::FineGrainedPermission::NOTHING); auto filtered_results = ExpandAllShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(filtered_results.size(), 3); @@ -2600,8 +2612,8 @@ TEST_F(QueryPlanExpandAllShortestPaths, BasicWithFineGrainedFiltering) { user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type", memgraph::auth::FineGrainedPermission::READ); - user.fine_grained_access_handler().edge_type_permissions().Deny("edge_type_filter", - memgraph::auth::FineGrainedPermission::READ); + user.fine_grained_access_handler().edge_type_permissions().Grant("edge_type_filter", + memgraph::auth::FineGrainedPermission::NOTHING); auto filtered_results = ExpandAllShortest(EdgeAtom::Direction::BOTH, 1000, LITERAL(true), 0, nullptr, &user); ASSERT_EQ(filtered_results.size(), 4);