Fix logic

* Stop auth module from creating users
* Explicit about auth policy (check if no users defined OR auth module used)
* Role supports database access definition
* Authenticate() returns user or role
* AuthChecker generates QueryUserOrRole (can be empty)
* QueryUserOrRole actually authorizes
* Add auth cache invalidation
* Better database access queries (GRANT, DENY, REVOKE DATABASE)

.clang-tidy

@@ -6,6 +6,7 @@ Checks: '*,
          -altera-unroll-loops,
          -android-*,
          -cert-err58-cpp,
+         -cppcoreguidelines-avoid-do-while,
          -cppcoreguidelines-avoid-c-arrays,
          -cppcoreguidelines-avoid-goto,
          -cppcoreguidelines-avoid-magic-numbers,
@@ -60,6 +61,7 @@ Checks: '*,
          -readability-implicit-bool-conversion,
          -readability-magic-numbers,
          -readability-named-parameter,
+         -readability-identifier-length,
          -misc-no-recursion,
          -concurrency-mt-unsafe,
          -bugprone-easily-swappable-parameters'

.github/ISSUE_TEMPLATE/bug_report.md

@@ -3,7 +3,6 @@ name: Bug report
 about: Create a report to help us improve
 title: ""
 labels: bug
-assignees: gitbuda
 ---
 
 **Memgraph version**

.github/workflows/diff.yaml

@@ -268,7 +268,6 @@ jobs:
           ctest -R memgraph__unit --output-on-failure -j$THREADS
 
       - name: Ensure Kafka and Pulsar are up
-        if: false
         run: |
           cd tests/e2e/streams/kafka
           docker-compose up -d
@@ -276,7 +275,6 @@ jobs:
           docker-compose up -d
 
       - name: Run e2e tests
-        if: false
         run: |
           cd tests
           ./setup.sh /opt/toolchain-v4/activate
@@ -285,7 +283,6 @@ jobs:
           ./run.sh
 
       - name: Ensure Kafka and Pulsar are down
-        if: false
         run: |
           cd tests/e2e/streams/kafka
           docker-compose down
@@ -339,118 +336,6 @@ jobs:
             # multiple paths could be defined
             build/logs
 
-  experimental_build_ha:
-    name: "High availability build"
-    runs-on: [self-hosted, Linux, X64, Diff]
-    env:
-      THREADS: 24
-      MEMGRAPH_ENTERPRISE_LICENSE: ${{ secrets.MEMGRAPH_ENTERPRISE_LICENSE }}
-      MEMGRAPH_ORGANIZATION_NAME: ${{ secrets.MEMGRAPH_ORGANIZATION_NAME }}
-
-    steps:
-      - name: Set up repository
-        uses: actions/checkout@v4
-        with:
-          # Number of commits to fetch. `0` indicates all history for all
-          # branches and tags. (default: 1)
-          fetch-depth: 0
-
-      - name: Build release binaries
-        run: |
-          source /opt/toolchain-v4/activate
-          ./init
-          cd build
-          cmake -DCMAKE_BUILD_TYPE=Release -DMG_EXPERIMENTAL_HIGH_AVAILABILITY=ON ..
-          make -j$THREADS
-      - name: Run unit tests
-        run: |
-          source /opt/toolchain-v4/activate
-          cd build
-          ctest -R memgraph__unit --output-on-failure -j$THREADS
-      - name: Run e2e tests
-        if: false
-        run: |
-          cd tests
-          ./setup.sh /opt/toolchain-v4/activate
-          source ve3/bin/activate_e2e
-          cd e2e
-          ./run.sh "Coordinator"
-          ./run.sh "Client initiated failover"
-          ./run.sh "Uninitialized cluster"
-      - name: Save test data
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: "Test data(High availability build)"
-          path: |
-            # multiple paths could be defined
-            build/logs
-
-  experimental_build_mt:
-    name: "MultiTenancy replication build"
-    runs-on: [self-hosted, Linux, X64, Diff]
-    env:
-      THREADS: 24
-      MEMGRAPH_ENTERPRISE_LICENSE: ${{ secrets.MEMGRAPH_ENTERPRISE_LICENSE }}
-      MEMGRAPH_ORGANIZATION_NAME: ${{ secrets.MEMGRAPH_ORGANIZATION_NAME }}
-
-    steps:
-      - name: Set up repository
-        uses: actions/checkout@v4
-        with:
-          # Number of commits to fetch. `0` indicates all history for all
-          # branches and tags. (default: 1)
-          fetch-depth: 0
-
-
-      - name: Build release binaries
-        run: |
-          # Activate toolchain.
-          source /opt/toolchain-v4/activate
-
-          # Initialize dependencies.
-          ./init
-
-          # Build MT replication experimental binaries.
-          cd build
-          cmake -DCMAKE_BUILD_TYPE=Release -D MG_EXPERIMENTAL_REPLICATION_MULTITENANCY=ON ..
-          make -j$THREADS
-
-      - name: Run unit tests
-        run: |
-          # Activate toolchain.
-          source /opt/toolchain-v4/activate
-
-          # Run unit tests.
-          cd build
-          ctest -R memgraph__unit --output-on-failure -j$THREADS
-
-      - name: Run e2e tests
-        if: false
-        run: |
-          cd tests
-          ./setup.sh /opt/toolchain-v4/activate
-          source ve3/bin/activate_e2e
-          cd e2e
-
-          # Just the replication based e2e tests
-          ./run.sh "Replicate multitenancy"
-          ./run.sh "Show"
-          ./run.sh "Show while creating invalid state"
-          ./run.sh "Delete edge replication"
-          ./run.sh "Read-write benchmark"
-          ./run.sh "Index replication"
-          ./run.sh "Constraints"
-
-      - name: Save test data
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: "Test data(MultiTenancy replication build)"
-          path: |
-            # multiple paths could be defined
-            build/logs
-
   release_jepsen_test:
     name: "Release Jepsen Test"
     runs-on: [self-hosted, Linux, X64, Debian10, JepsenControl]

.github/workflows/release_build_test.yaml

@@ -0,0 +1,162 @@
+name: Release build test
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+on:
+  workflow_dispatch:
+    inputs:
+      build_type:
+        type: choice
+        description: "Memgraph Build type. Default value is Release."
+        default: 'Release'
+        options:
+          - Release
+          - RelWithDebInfo
+
+  push:
+    branches:
+      - "release/**"
+    tags:
+      - "v*.*.*-rc*"
+      - "v*.*-rc*"
+  schedule:
+    # UTC
+    - cron: "0 22 * * *"
+
+env:
+  THREADS: 24
+  MEMGRAPH_ENTERPRISE_LICENSE: ${{ secrets.MEMGRAPH_ENTERPRISE_LICENSE }}
+  MEMGRAPH_ORGANIZATION_NAME: ${{ secrets.MEMGRAPH_ORGANIZATION_NAME }}
+  BUILD_TYPE: ${{ github.event.inputs.build_type || 'Release' }}
+
+jobs:
+  Debian10:
+    uses: ./.github/workflows/release_debian10.yaml
+    with:
+      build_type: ${{ github.event.inputs.build_type || 'Release' }}
+    secrets: inherit
+
+  Ubuntu20_04:
+    uses: ./.github/workflows/release_ubuntu2004.yaml
+    with:
+      build_type: ${{ github.event.inputs.build_type || 'Release' }}
+    secrets: inherit
+
+  PackageDebian10:
+    if: github.ref_type == 'tag'
+    needs: [Debian10]
+    runs-on: [self-hosted, DockerMgBuild, X64]
+    timeout-minutes: 60
+    steps:
+      - name: "Set up repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required because of release/get_version.py
+      - name: "Build package"
+        run: |
+          ./release/package/run.sh package debian-10 $BUILD_TYPE
+      - name: "Upload package"
+        uses: actions/upload-artifact@v4
+        with:
+          name: debian-10
+          path: build/output/debian-10/memgraph*.deb
+
+  PackageUbuntu20_04:
+    if: github.ref_type == 'tag'
+    needs: [Ubuntu20_04]
+    runs-on: [self-hosted, DockerMgBuild, X64]
+    timeout-minutes: 60
+    steps:
+      - name: "Set up repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required because of release/get_version.py
+      - name: "Build package"
+        run: |
+          ./release/package/run.sh package ubuntu-22.04 $BUILD_TYPE
+      - name: "Upload package"
+        uses: actions/upload-artifact@v4
+        with:
+          name: ubuntu-22.04
+          path: build/output/ubuntu-22.04/memgraph*.deb
+
+  PackageUbuntu20_04_ARM:
+    if: github.ref_type == 'tag'
+    needs: [Ubuntu20_04]
+    runs-on: [self-hosted, DockerMgBuild, ARM64]
+    # M1 Mac mini is sometimes slower
+    timeout-minutes: 90
+    steps:
+      - name: "Set up repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required because of release/get_version.py
+      - name: "Build package"
+        run: |
+          ./release/package/run.sh package ubuntu-22.04-arm $BUILD_TYPE
+      - name: "Upload package"
+        uses: actions/upload-artifact@v4
+        with:
+          name: ubuntu-22.04-aarch64
+          path: build/output/ubuntu-22.04-arm/memgraph*.deb
+
+  PackageDebian11:
+    if: github.ref_type == 'tag'
+    needs: [Debian10, Ubuntu20_04]
+    runs-on: [self-hosted, DockerMgBuild, X64]
+    timeout-minutes: 60
+    steps:
+      - name: "Set up repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required because of release/get_version.py
+      - name: "Build package"
+        run: |
+          ./release/package/run.sh package debian-11 $BUILD_TYPE
+      - name: "Upload package"
+        uses: actions/upload-artifact@v4
+        with:
+          name: debian-11
+          path: build/output/debian-11/memgraph*.deb
+
+  PackageDebian11_ARM:
+    if: github.ref_type == 'tag'
+    needs: [Debian10, Ubuntu20_04]
+    runs-on: [self-hosted, DockerMgBuild, ARM64]
+    # M1 Mac mini is sometimes slower
+    timeout-minutes: 90
+    steps:
+      - name: "Set up repository"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required because of release/get_version.py
+      - name: "Build package"
+        run: |
+          ./release/package/run.sh package debian-11-arm $BUILD_TYPE
+      - name: "Upload package"
+        uses: actions/upload-artifact@v4
+        with:
+          name: debian-11-aarch64
+          path: build/output/debian-11-arm/memgraph*.deb
+
+  PushToS3:
+    if: github.ref_type == 'tag'
+    needs: [PackageDebian10, PackageDebian11, PackageDebian11_ARM, PackageUbuntu20_04, PackageUbuntu20_04_ARM]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          # name: # if name input parameter is not provided, all artifacts are downloaded
+                  # and put in directories named after each one.
+          path: build/output/release
+      - name: Upload to S3
+        uses: jakejarvis/s3-sync-action@v0.5.1
+        env:
+          AWS_S3_BUCKET: "deps.memgraph.io"
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: "eu-west-1"
+          SOURCE_DIR: "build/output/release"
+          DEST_DIR: "memgraph-unofficial/${{ github.ref_name }}/"

.github/workflows/release_debian10.yaml

@@ -1,6 +1,12 @@
 name: Release Debian 10
 
 on:
+  workflow_call:
+    inputs:
+      build_type:
+        type: string
+        description: "Memgraph Build type. Default value is Release."
+        default: 'Release'
   workflow_dispatch:
     inputs:
       build_type:
@@ -11,10 +17,8 @@ on:
           - Release
           - RelWithDebInfo
 
-  schedule:
-    - cron: "0 22 * * *"
-
 env:
+  OS: "Debian10"
   THREADS: 24
   MEMGRAPH_ENTERPRISE_LICENSE: ${{ secrets.MEMGRAPH_ENTERPRISE_LICENSE }}
   MEMGRAPH_ORGANIZATION_NAME: ${{ secrets.MEMGRAPH_ORGANIZATION_NAME }}
@@ -111,7 +115,7 @@ jobs:
       - name: Save code coverage
         uses: actions/upload-artifact@v4
         with:
-          name: "Code coverage(Coverage build)"
+          name: "Code coverage(Coverage build)-${{ env.OS }}"
           path: tools/github/generated/code_coverage.tar.gz
 
   debug_build:
@@ -165,7 +169,7 @@ jobs:
       - name: Save cppcheck and clang-format errors
         uses: actions/upload-artifact@v4
         with:
-          name: "Code coverage(Debug build)"
+          name: "Code coverage(Debug build)-${{ env.OS }}"
           path: tools/github/cppcheck_and_clang_format.txt
 
   debug_integration_test:
@@ -242,7 +246,7 @@ jobs:
       - name: Save enterprise DEB package
         uses: actions/upload-artifact@v4
         with:
-          name: "Enterprise DEB package"
+          name: "Enterprise DEB package-${{ env.OS}}"
           path: build/output/memgraph*.deb
 
       - name: Run GQL Behave tests
@@ -255,7 +259,7 @@ jobs:
       - name: Save quality assurance status
         uses: actions/upload-artifact@v4
         with:
-          name: "GQL Behave Status"
+          name: "GQL Behave Status-${{ env.OS }}"
           path: |
             tests/gql_behave/gql_behave_status.csv
             tests/gql_behave/gql_behave_status.html
@@ -321,7 +325,6 @@ jobs:
             --no-strict
 
   release_e2e_test:
-    if: false
     name: "Release End-to-end Test"
     runs-on: [self-hosted, Linux, X64, Debian10]
     timeout-minutes: 60
@@ -456,5 +459,5 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ always() }}
         with:
-          name: "Jepsen Report"
+          name: "Jepsen Report-${{ env.OS }}"
           path: tests/jepsen/Jepsen.tar.gz

.github/workflows/release_ubuntu2004.yaml

@@ -1,6 +1,12 @@
 name: Release Ubuntu 20.04
 
 on:
+  workflow_call:
+    inputs:
+      build_type:
+        type: string
+        description: "Memgraph Build type. Default value is Release."
+        default: 'Release'
   workflow_dispatch:
     inputs:
       build_type:
@@ -11,10 +17,8 @@ on:
           - Release
           - RelWithDebInfo
 
-  schedule:
-    - cron: "0 22 * * *"
-
 env:
+  OS: "Ubuntu 20.04"
   THREADS: 24
   MEMGRAPH_ENTERPRISE_LICENSE: ${{ secrets.MEMGRAPH_ENTERPRISE_LICENSE }}
   MEMGRAPH_ORGANIZATION_NAME: ${{ secrets.MEMGRAPH_ORGANIZATION_NAME }}
@@ -107,7 +111,7 @@ jobs:
       - name: Save code coverage
         uses: actions/upload-artifact@v4
         with:
-          name: "Code coverage(Coverage build)"
+          name: "Code coverage(Coverage build)-${{ env.OS }}"
           path: tools/github/generated/code_coverage.tar.gz
 
   debug_build:
@@ -161,7 +165,7 @@ jobs:
       - name: Save cppcheck and clang-format errors
         uses: actions/upload-artifact@v4
         with:
-          name: "Code coverage(Debug build)"
+          name: "Code coverage(Debug build)-${{ env.OS }}"
           path: tools/github/cppcheck_and_clang_format.txt
 
   debug_integration_test:
@@ -238,7 +242,7 @@ jobs:
       - name: Save enterprise DEB package
         uses: actions/upload-artifact@v4
         with:
-          name: "Enterprise DEB package"
+          name: "Enterprise DEB package-${{ env.OS }}"
           path: build/output/memgraph*.deb
 
       - name: Run GQL Behave tests
@@ -251,7 +255,7 @@ jobs:
       - name: Save quality assurance status
         uses: actions/upload-artifact@v4
         with:
-          name: "GQL Behave Status"
+          name: "GQL Behave Status-${{ env.OS }}"
           path: |
             tests/gql_behave/gql_behave_status.csv
             tests/gql_behave/gql_behave_status.html
@@ -317,7 +321,6 @@ jobs:
             --no-strict
 
   release_e2e_test:
-    if: false
     name: "Release End-to-end Test"
     runs-on: [self-hosted, Linux, X64, Ubuntu20.04]
     timeout-minutes: 60

.github/workflows/stress_test_large.yaml

@@ -1,4 +1,7 @@
 name: Stress test large
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
 
 on:
   workflow_dispatch:
@@ -10,7 +13,10 @@ on:
         options:
           - Release
           - RelWithDebInfo
-
+  push:
+    tags:
+      - "v*.*.*-rc*"
+      - "v*.*-rc*"
   schedule:
     - cron: "0 22 * * *"
 

ADRs/003_rocksdb.md

@@ -0,0 +1,38 @@
+# RocksDB ADR
+
+**Author**
+Marko Budiselic (github.com/gitbuda)
+
+**Status**
+ACCEPTED
+
+**Date**
+January 23, 2024
+
+**Problem**
+
+Interacting with data (reads and writes) on disk in a concurrent, safe, and
+fast way is a challenging task. Implementing all low-level primitives to
+interact with various disk hardware efficiently consumes significant
+engineering people. Whenever Memgraph has to store data on disk (or any
+other colder than RAM storage system), the problem is how to do that in the
+least amount of development time while satisfying all functional requirements
+(often performance).
+
+**Criteria**
+
+- working efficiently in a highly concurrent environment
+- easy integration with Memgraph's C++ codebase
+- providing low-level key-value API
+- heavily tested in production environments
+- providing abstractions for the storage hardware (even for cloud-based
+  storages like S3)
+
+**Decision**
+
+There are a few robust key-value stores, but finding one that is
+production-ready and compatible with Memgraph's C++ codebase is challenging.
+**We select [RocksDB](https://github.com/facebook/rocksdb)** because it
+delivers robust API to manage data on disk; it's battle-tested in many
+production environments (many databases systems are embedding RocksDB), and
+it's the most compatible one.

CMakeLists.txt

@@ -211,8 +211,13 @@ set(CMAKE_CXX_FLAGS_RELWITHDEBINFO
 # ** Static linking is allowed only for executables! **
 set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -static-libgcc -static-libstdc++")
 
-# Use lld linker to speedup build
-add_link_options(-fuse-ld=lld) # TODO: use mold linker
+# Use lld linker to speedup build and use less memory.
+add_link_options(-fuse-ld=lld)
+# NOTE: Moving to latest Clang (probably starting from 15), lld stopped to work
+# without explicit link_directories call.
+string(REPLACE ":" " " LD_LIBS $ENV{LD_LIBRARY_PATH})
+separate_arguments(LD_LIBS)
+link_directories(${LD_LIBS})
 
 # release flags
 set(CMAKE_CXX_FLAGS_RELEASE "-O2 -DNDEBUG")
@@ -271,18 +276,6 @@ endif()
 set(libs_dir ${CMAKE_SOURCE_DIR}/libs)
 add_subdirectory(libs EXCLUDE_FROM_ALL)
 
-option(MG_EXPERIMENTAL_HIGH_AVAILABILITY "Feature flag for experimental high availability" OFF)
-
-if (NOT MG_ENTERPRISE AND MG_EXPERIMENTAL_HIGH_AVAILABILITY)
-    set(MG_EXPERIMENTAL_HIGH_AVAILABILITY OFF)
-    message(FATAL_ERROR "MG_EXPERIMENTAL_HIGH_AVAILABILITY must be used with enterpise version of the code.")
-endif ()
-
-if (MG_EXPERIMENTAL_HIGH_AVAILABILITY)
-    add_compile_definitions(MG_EXPERIMENTAL_HIGH_AVAILABILITY)
-endif ()
-
-# Optional subproject configuration -------------------------------------------
 option(TEST_COVERAGE "Generate coverage reports from running memgraph" OFF)
 option(TOOLS "Build tools binaries" ON)
 option(QUERY_MODULES "Build query modules containing custom procedures" ON)
@@ -291,16 +284,6 @@ option(TSAN "Build with Thread Sanitizer. To get a reasonable performance option
 option(UBSAN "Build with Undefined Behaviour Sanitizer" OFF)
 
 # Build feature flags
-option(MG_EXPERIMENTAL_REPLICATION_MULTITENANCY "Feature flag for experimental replicaition of multitenacy" OFF)
-
-if (NOT MG_ENTERPRISE AND MG_EXPERIMENTAL_REPLICATION_MULTITENANCY)
-    set(MG_EXPERIMENTAL_REPLICATION_MULTITENANCY OFF)
-    message(FATAL_ERROR "MG_EXPERIMENTAL_REPLICATION_MULTITENANCY with community edition build isn't possible")
-endif ()
-
-if (MG_EXPERIMENTAL_REPLICATION_MULTITENANCY)
-    add_compile_definitions(MG_EXPERIMENTAL_REPLICATION_MULTITENANCY)
-endif ()
 
 if (TEST_COVERAGE)
   string(TOLOWER ${CMAKE_BUILD_TYPE} lower_build_type)

environment/os/amzn-2.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -9,7 +7,7 @@ check_operating_system "amzn-2"
 check_architecture "x86_64"
 
 TOOLCHAIN_BUILD_DEPS=(
-    gcc gcc-c++ make # generic build tools
+    git gcc gcc-c++ make # generic build tools
     wget # used for archive download
     gnupg2 # used for archive signature verification
     tar gzip bzip2 xz unzip # used for archive unpacking
@@ -63,6 +61,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/centos-7.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -63,6 +61,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/centos-9.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -9,8 +7,10 @@ check_operating_system "centos-9"
 check_architecture "x86_64"
 
 TOOLCHAIN_BUILD_DEPS=(
-    coreutils-common gcc gcc-c++ make # generic build tools
     wget # used for archive download
+    coreutils-common gcc gcc-c++ make # generic build tools
+    # NOTE: Pure libcurl conflicts with libcurl-minimal
+    libcurl-devel # cmake build requires it
     gnupg2 # used for archive signature verification
     tar gzip bzip2 xz unzip # used for archive unpacking
     zlib-devel # zlib library used for all builds
@@ -64,6 +64,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )
@@ -123,7 +125,9 @@ install() {
     else
         echo "NOTE: export LANG=en_US.utf8"
     fi
-    yum update -y
+    # --nobest is used because of libipt because we install custom versions
+    # because libipt-devel is not available on CentOS 9 Stream
+    yum update -y --nobest
     yum install -y wget git python3 python3-pip
 
     for pkg in $1; do

environment/os/debian-10.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "debian-10"
 check_architecture "x86_64"
 

environment/os/debian-11-arm.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "debian-11"
 check_architecture "arm64" "aarch64"
 

environment/os/debian-11.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -61,6 +59,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/debian-12-arm.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "debian-12"
+check_architecture "arm64" "aarch64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils gcc g++ build-essential make # generic build tools
+    wget # used for archive download
+    gnupg # used for archive signature verification
+    tar gzip bzip2 xz-utils unzip # used for archive unpacking
+    zlib1g-dev # zlib library used for all builds
+    libexpat1-dev liblzma-dev python3-dev texinfo # for gdb
+    libcurl4-openssl-dev # for cmake
+    libreadline-dev # for cmake and llvm
+    libffi-dev libxml2-dev # for llvm
+    libedit-dev libpcre2-dev libpcre3-dev automake bison # for swig
+    curl # snappy
+    file # for libunwind
+    libssl-dev # for libevent
+    libgmp-dev
+    gperf # for proxygen
+    git # for fbthrift
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz-utils # used for archive unpacking
+    zlib1g # zlib library used for all builds
+    libexpat1 liblzma5 python3 # for gdb
+    libcurl4 # for cmake
+    file # for CPack
+    libreadline8 # for cmake and llvm
+    libffi8 libxml2 # for llvm
+    libssl-dev # for libevent
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make pkg-config # build system
+    curl wget # for downloading libs
+    uuid-dev default-jre-headless # required by antlr
+    libreadline-dev # for memgraph console
+    libpython3-dev python3-dev # for query modules
+    libssl-dev
+    libseccomp-dev
+    netcat # tests are using nc to wait for memgraph
+    python3 virtualenv python3-virtualenv python3-pip # for qa, macro_benchmark and stress tests
+    python3-yaml # for the configuration generator
+    libcurl4-openssl-dev # mg-requests
+    sbcl # for custom Lisp C++ preprocessing
+    doxygen graphviz # source documentation generators
+    mono-runtime mono-mcs zip unzip default-jdk-headless custom-maven3.9.3 # for driver tests
+    dotnet-sdk-7.0 golang custom-golang1.18.9 nodejs npm
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    libsasl2-dev
+)
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if ! dpkg -s "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    apt update
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    apt install -y wget
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == dotnet-sdk-7.0  ]; then
+            if ! dpkg -s "$pkg" 2>/dev/null >/dev/null; then
+                wget -nv https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
+                dpkg -i packages-microsoft-prod.deb
+                apt-get update
+                apt-get install -y apt-transport-https dotnet-sdk-7.0
+            fi
+            continue
+        fi
+        apt install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/debian-12.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "debian-12"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils gcc g++ build-essential make # generic build tools
+    wget # used for archive download
+    gnupg # used for archive signature verification
+    tar gzip bzip2 xz-utils unzip # used for archive unpacking
+    zlib1g-dev # zlib library used for all builds
+    libexpat1-dev libipt-dev libbabeltrace-dev liblzma-dev python3-dev texinfo # for gdb
+    libcurl4-openssl-dev # for cmake
+    libreadline-dev # for cmake and llvm
+    libffi-dev libxml2-dev # for llvm
+    libedit-dev libpcre2-dev libpcre3-dev automake bison # for swig
+    curl # snappy
+    file # for libunwind
+    libssl-dev # for libevent
+    libgmp-dev
+    gperf # for proxygen
+    git # for fbthrift
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz-utils # used for archive unpacking
+    zlib1g # zlib library used for all builds
+    libexpat1 libipt2 libbabeltrace1 liblzma5 python3 # for gdb
+    libcurl4 # for cmake
+    file # for CPack
+    libreadline8 # for cmake and llvm
+    libffi8 libxml2 # for llvm
+    libssl-dev # for libevent
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make cmake pkg-config # build system
+    curl wget # for downloading libs
+    uuid-dev default-jre-headless # required by antlr
+    libreadline-dev # for memgraph console
+    libpython3-dev python3-dev # for query modules
+    libssl-dev
+    libseccomp-dev
+    netcat-traditional # tests are using nc to wait for memgraph
+    python3 virtualenv python3-virtualenv python3-pip # for qa, macro_benchmark and stress tests
+    python3-yaml # for the configuration generator
+    libcurl4-openssl-dev # mg-requests
+    sbcl # for custom Lisp C++ preprocessing
+    doxygen graphviz # source documentation generators
+    mono-runtime mono-mcs zip unzip default-jdk-headless custom-maven3.9.3 # for driver tests
+    dotnet-sdk-7.0 golang custom-golang1.18.9 nodejs npm
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    libsasl2-dev
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if ! dpkg -s "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    apt update
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    apt install -y wget
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == dotnet-sdk-7.0  ]; then
+            if ! dpkg -s "$pkg" 2>/dev/null >/dev/null; then
+                wget -nv https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
+                dpkg -i packages-microsoft-prod.deb
+                apt-get update
+                apt-get install -y apt-transport-https dotnet-sdk-7.0
+            fi
+            continue
+        fi
+        apt install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/fedora-36.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "fedora-36"
 check_architecture "x86_64"
 
@@ -27,6 +27,7 @@ TOOLCHAIN_BUILD_DEPS=(
     libipt libipt-devel # intel
     patch
     perl # for openssl
+    git
 )
 
 TOOLCHAIN_RUN_DEPS=(

environment/os/fedora-38.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -27,6 +25,7 @@ TOOLCHAIN_BUILD_DEPS=(
     libipt libipt-devel # intel
     patch
     perl # for openssl
+    git
 )
 
 TOOLCHAIN_RUN_DEPS=(
@@ -58,6 +57,16 @@ MEMGRAPH_BUILD_DEPS=(
     libtool  # for protobuf code generation
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
 list() {
     echo "$1"
 }

environment/os/fedora-39.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "fedora-39"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils-common gcc gcc-c++ make # generic build tools
+    wget # used for archive download
+    gnupg2 # used for archive signature verification
+    tar gzip bzip2 xz unzip # used for archive unpacking
+    zlib-devel # zlib library used for all builds
+    expat-devel xz-devel python3-devel texinfo libbabeltrace-devel # for gdb
+    curl libcurl-devel # for cmake
+    readline-devel # for cmake and llvm
+    libffi-devel libxml2-devel # for llvm
+    libedit-devel pcre-devel pcre2-devel automake bison # for swig
+    file
+    openssl-devel
+    gmp-devel
+    gperf
+    diffutils
+    libipt libipt-devel # intel
+    patch
+    perl # for openssl
+    git
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz # used for archive unpacking
+    zlib # zlib library used for all builds
+    expat xz-libs python3 # for gdb
+    readline # for cmake and llvm
+    libffi libxml2 # for llvm
+    openssl-devel
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make pkgconf-pkg-config # build system
+    wget # for downloading libs
+    libuuid-devel java-11-openjdk # required by antlr
+    readline-devel # for memgraph console
+    python3-devel # for query modules
+    openssl-devel
+    libseccomp-devel
+    python3 python3-pip python3-virtualenv python3-virtualenvwrapper python3-pyyaml nmap-ncat # for tests
+    libcurl-devel # mg-requests
+    rpm-build rpmlint # for RPM package building
+    doxygen graphviz # source documentation generators
+    which nodejs golang zip unzip java-11-openjdk-devel # for driver tests
+    sbcl # for custom Lisp C++ preprocessing
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    if [ -v LD_LIBRARY_PATH ]; then
+      # On Fedora 38 yum/dnf and python11 use newer glibc which is not compatible
+      # with ours, so we need to momentarely disable env
+      local OLD_LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
+      LD_LIBRARY_PATH=""
+    fi
+    local missing=""
+    for pkg in $1; do
+        if ! dnf list installed "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+    if [ -v OLD_LD_LIBRARY_PATH ]; then
+      echo "Restoring LD_LIBRARY_PATH..."
+      LD_LIBRARY_PATH=${OLD_LD_LIBRARY_PATH}
+    fi
+}
+
+install() {
+    cd "$DIR"
+    if [ "$EUID" -ne 0 ]; then
+        echo "Please run as root."
+        exit 1
+    fi
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests don't work without the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    dnf update -y
+    for pkg in $1; do
+        dnf install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/rocky-9.3.sh

@@ -0,0 +1,188 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+# TODO(gitbuda): Rocky gets automatically updates -> figure out how to handle it.
+check_operating_system "rocky-9.3"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    wget # used for archive download
+    coreutils-common gcc gcc-c++ make # generic build tools
+    # NOTE: Pure libcurl conflicts with libcurl-minimal
+    libcurl-devel # cmake build requires it
+    gnupg2 # used for archive signature verification
+    tar gzip bzip2 xz unzip # used for archive unpacking
+    zlib-devel # zlib library used for all builds
+    expat-devel xz-devel python3-devel perl-Unicode-EastAsianWidth texinfo libbabeltrace-devel # for gdb
+    readline-devel # for cmake and llvm
+    libffi-devel libxml2-devel # for llvm
+    libedit-devel pcre-devel pcre2-devel automake bison # for swig
+    file
+    openssl-devel
+    gmp-devel
+    gperf
+    diffutils
+    libipt libipt-devel # intel
+    patch
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz # used for archive unpacking
+    zlib # zlib library used for all builds
+    expat xz-libs python3 # for gdb
+    readline # for cmake and llvm
+    libffi libxml2 # for llvm
+    openssl-devel
+    perl # for openssl
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make cmake pkgconf-pkg-config # build system
+    wget # for downloading libs
+    libuuid-devel java-11-openjdk # required by antlr
+    readline-devel # for memgraph console
+    python3-devel # for query modules
+    openssl-devel
+    libseccomp-devel
+    python3 python3-pip python3-virtualenv nmap-ncat # for qa, macro_benchmark and stress tests
+    #
+    # IMPORTANT: python3-yaml does NOT exist on CentOS
+    # Install it manually using `pip3 install PyYAML`
+    #
+    PyYAML # Package name here does not correspond to the yum package!
+    libcurl-devel # mg-requests
+    rpm-build rpmlint # for RPM package building
+    doxygen graphviz # source documentation generators
+    which nodejs golang custom-golang1.18.9 # for driver tests
+    zip unzip java-11-openjdk-devel java-17-openjdk java-17-openjdk-devel custom-maven3.9.3 # for driver tests
+    sbcl # for custom Lisp C++ preprocessing
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    cyrus-sasl-devel
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == "PyYAML" ]; then
+            if ! python3 -c "import yaml" >/dev/null 2>/dev/null; then
+                missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == "python3-virtualenv" ]; then
+            continue
+        fi
+        if ! yum list installed "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    if [ "$EUID" -ne 0 ]; then
+        echo "Please run as root."
+        exit 1
+    fi
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    yum update -y
+    yum install -y wget git python3 python3-pip
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == perl-Unicode-EastAsianWidth ]; then
+            if ! dnf list installed perl-Unicode-EastAsianWidth >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/CRB/x86_64/os/Packages/p/perl-Unicode-EastAsianWidth-12.0-7.el9.noarch.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == texinfo ]; then
+            if ! dnf list installed texinfo >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/CRB/x86_64/os/Packages/t/texinfo-6.7-15.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == libbabeltrace-devel ]; then
+            if ! dnf list installed libbabeltrace-devel >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/devel/x86_64/os/Packages/l/libbabeltrace-devel-1.5.8-10.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == libipt-devel ]; then
+            if ! dnf list installed libipt-devel >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/devel/x86_64/os/Packages/l/libipt-devel-2.0.4-5.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == PyYAML ]; then
+            if [ -z ${SUDO_USER+x} ]; then # Running as root (e.g. Docker).
+                pip3 install --user PyYAML
+            else # Running using sudo.
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install --user PyYAML"
+            fi
+            continue
+        fi
+        if [ "$pkg" == python3-virtualenv ]; then
+            if [ -z ${SUDO_USER+x} ]; then # Running as root (e.g. Docker).
+                pip3 install virtualenv
+                pip3 install virtualenvwrapper
+            else # Running using sudo.
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install virtualenv"
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install virtualenvwrapper"
+            fi
+            continue
+        fi
+        yum install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/template.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -20,6 +18,10 @@ MEMGRAPH_BUILD_DEPS=(
     pkg
 )
 
+MEMGRAPH_TEST_DEPS=(
+  pkg
+)
+
 MEMGRAPH_RUN_DEPS=(
     pkg
 )

environment/os/ubuntu-18.04.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "ubuntu-18.04"
 check_architecture "x86_64"
 

environment/os/ubuntu-20.04.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/os/ubuntu-22.04-arm.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/os/ubuntu-22.04.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/toolchain/.gitignore

@@ -2,3 +2,4 @@ archives
 build
 output
 *.tar.gz
+tmp_build.sh

environment/toolchain/template_build.sh

@@ -0,0 +1,48 @@
+#!/bin/bash -e
+
+# NOTE: Copy this under memgraph/environment/toolchain/vN/tmp_build.sh, edit and test.
+
+pushd () { command pushd "$@" > /dev/null; }
+popd () { command popd "$@" > /dev/null; }
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+CPUS=$( grep -c processor < /proc/cpuinfo )
+cd "$DIR"
+source "$DIR/../../util.sh"
+DISTRO="$(operating_system)"
+TOOLCHAIN_VERSION=5
+NAME=toolchain-v$TOOLCHAIN_VERSION
+PREFIX=/opt/$NAME
+function log_tool_name () {
+    echo ""
+    echo ""
+    echo "#### $1 ####"
+    echo ""
+    echo ""
+}
+
+# HERE: Remove/clear dependencies from a given toolchain.
+
+mkdir -p archives && pushd archives
+# HERE: Download dependencies here.
+popd
+
+mkdir -p build
+pushd build
+source $PREFIX/activate
+export CC=$PREFIX/bin/clang
+export CXX=$PREFIX/bin/clang++
+export CFLAGS="$CFLAGS -fPIC"
+export PATH=$PREFIX/bin:$PATH
+export LD_LIBRARY_PATH=$PREFIX/lib64
+COMMON_CMAKE_FLAGS="-DCMAKE_INSTALL_PREFIX=$PREFIX
+                    -DCMAKE_PREFIX_PATH=$PREFIX
+                    -DCMAKE_BUILD_TYPE=Release
+                    -DCMAKE_C_COMPILER=$CC
+                    -DCMAKE_CXX_COMPILER=$CXX
+                    -DBUILD_SHARED_LIBS=OFF
+                    -DCMAKE_CXX_STANDARD=20
+                    -DBUILD_TESTING=OFF
+                    -DCMAKE_REQUIRED_INCLUDES=$PREFIX/include
+                    -DCMAKE_POSITION_INDEPENDENT_CODE=ON"
+
+# HERE: Add dependencies to test below.

environment/toolchain/v5/build.sh

@@ -307,7 +307,7 @@ if [ ! -f $PREFIX/bin/ld.gold ]; then
 fi
 
 log_tool_name "GDB $GDB_VERSION"
-if [ ! -f $PREFIX/bin/gdb ]; then
+if [[ ! -f "$PREFIX/bin/gdb" && "$DISTRO" -ne "amzn-2" ]]; then
     if [ -d gdb-$GDB_VERSION ]; then
         rm -rf gdb-$GDB_VERSION
     fi
@@ -671,7 +671,6 @@ PROXYGEN_SHA256=5360a8ccdfb2f5a6c7b3eed331ec7ab0e2c792d579c6fff499c85c516c11fe14
 WANGLE_SHA256=1002e9c32b6f4837f6a760016e3b3e22f3509880ef3eaad191c80dc92655f23f
 # WANGLE_SHA256=0e493c03572bb27fe9ca03a9da5023e52fde99c95abdcaa919bb6190e7e69532
 
-FLEX_VERSION=2.6.4
 FMT_SHA256=78b8c0a72b1c35e4443a7e308df52498252d1cefc2b08c9a97bc9ee6cfe61f8b
 FMT_VERSION=10.1.1
 # NOTE: spdlog depends on exact fmt versions -> UPGRADE fmt and spdlog TOGETHER.
@@ -690,8 +689,8 @@ LZ4_VERSION=1.9.4
 SNAPPY_SHA256=75c1fbb3d618dd3a0483bff0e26d0a92b495bbe5059c8b4f1c962b478b6e06e7
 SNAPPY_VERSION=1.1.9
 XZ_VERSION=5.2.5 # for LZMA
-ZLIB_VERSION=1.3
-ZSTD_VERSION=1.5.0
+ZLIB_VERSION=1.3.1
+ZSTD_VERSION=1.5.5
 
 pushd archives
 if [ ! -f boost_$BOOST_VERSION_UNDERSCORES.tar.gz ]; then
@@ -700,7 +699,7 @@ if [ ! -f boost_$BOOST_VERSION_UNDERSCORES.tar.gz ]; then
     wget https://boostorg.jfrog.io/artifactory/main/release/$BOOST_VERSION/source/boost_$BOOST_VERSION_UNDERSCORES.tar.gz -O boost_$BOOST_VERSION_UNDERSCORES.tar.gz
 fi
 if [ ! -f bzip2-$BZIP2_VERSION.tar.gz ]; then
-    wget https://sourceforge.net/projects/bzip2/files/bzip2-$BZIP2_VERSION.tar.gz -O bzip2-$BZIP2_VERSION.tar.gz
+    wget https://sourceware.org/pub/bzip2/bzip2-$BZIP2_VERSION.tar.gz -O bzip2-$BZIP2_VERSION.tar.gz
 fi
 if [ ! -f double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz ]; then
     wget https://github.com/google/double-conversion/archive/refs/tags/v$DOUBLE_CONVERSION_VERSION.tar.gz -O double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz
@@ -708,9 +707,7 @@ fi
 if [ ! -f fizz-$FBLIBS_VERSION.tar.gz ]; then
     wget https://github.com/facebookincubator/fizz/releases/download/v$FBLIBS_VERSION/fizz-v$FBLIBS_VERSION.tar.gz -O fizz-$FBLIBS_VERSION.tar.gz
 fi
-if [ ! -f flex-$FLEX_VERSION.tar.gz ]; then
-    wget https://github.com/westes/flex/releases/download/v$FLEX_VERSION/flex-$FLEX_VERSION.tar.gz -O flex-$FLEX_VERSION.tar.gz
-fi
+
 if [ ! -f fmt-$FMT_VERSION.tar.gz ]; then
     wget https://github.com/fmtlib/fmt/archive/refs/tags/$FMT_VERSION.tar.gz -O fmt-$FMT_VERSION.tar.gz
 fi
@@ -765,14 +762,6 @@ echo "$BZIP2_SHA256 bzip2-$BZIP2_VERSION.tar.gz" | sha256sum -c
 echo "$DOUBLE_CONVERSION_SHA256 double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz" | sha256sum -c
 # verify fizz
 echo "$FIZZ_SHA256 fizz-$FBLIBS_VERSION.tar.gz" | sha256sum -c
-# verify flex
-if [ ! -f flex-$FLEX_VERSION.tar.gz.sig ]; then
-    wget https://github.com/westes/flex/releases/download/v$FLEX_VERSION/flex-$FLEX_VERSION.tar.gz.sig
-fi
-if false; then
-    $GPG --keyserver $KEYSERVER --recv-keys 0xE4B29C8D64885307
-    $GPG --verify flex-$FLEX_VERSION.tar.gz.sig flex-$FLEX_VERSION.tar.gz
-fi
 # verify fmt
 echo "$FMT_SHA256 fmt-$FMT_VERSION.tar.gz" | sha256sum -c
 # verify spdlog
@@ -1025,7 +1014,6 @@ if [ ! -d $PREFIX/include/gflags ]; then
     if [ -d gflags ]; then
         rm -rf gflags
     fi
-
     git clone https://github.com/memgraph/gflags.git gflags
     pushd gflags
     git checkout $GFLAGS_COMMIT_HASH
@@ -1034,7 +1022,7 @@ if [ ! -d $PREFIX/include/gflags ]; then
     cmake .. $COMMON_CMAKE_FLAGS \
         -DREGISTER_INSTALL_PREFIX=OFF \
         -DBUILD_gflags_nothreads_LIB=OFF \
-        -DGFLAGS_NO_FILENAMES=0
+        -DGFLAGS_NO_FILENAMES=1
     make -j$CPUS install
     popd && popd
 fi
@@ -1232,18 +1220,6 @@ if false; then
   fi
 fi
 
-log_tool_name "flex $FLEX_VERSION"
-if [ ! -f $PREFIX/include/FlexLexer.h ]; then
-    if [ -d flex-$FLEX_VERSION ]; then
-        rm -rf flex-$FLEX_VERSION
-    fi
-    tar -xzf ../archives/flex-$FLEX_VERSION.tar.gz
-    pushd flex-$FLEX_VERSION
-    ./configure $COMMON_CONFIGURE_FLAGS
-    make -j$CPUS install
-    popd
-fi
-
 popd
 # NOTE: It's important/clean (e.g., easier upload to S3) to have a separated
 # folder to the output archive.

include/_mgp.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -283,7 +283,7 @@ inline mgp_list *list_all_unique_constraints(mgp_graph *graph, mgp_memory *memor
 }
 
 // mgp_graph
-  
+
 inline bool graph_is_transactional(mgp_graph *graph) { return MgInvoke<int>(mgp_graph_is_transactional, graph); }
 
 inline bool graph_is_mutable(mgp_graph *graph) { return MgInvoke<int>(mgp_graph_is_mutable, graph); }

init

@@ -119,7 +119,7 @@ fi
 # Install precommit hook except on old operating systems because we don't
 # develop on them -> pre-commit hook not required -> we can use latest
 # packages.
-if [ "${DISTRO}" != "centos-7" ] && [ "$DISTRO" != "debian-10" ] && [ "${DISTRO}" != "ubuntu-18.04" ] && [ "${DISTRO}" != "amzn-2" ]; then
+if [ "${DISTRO}" != "centos-7" ] && [ "$DISTRO" != "debian-10" ] && [ "${DISTRO}" != "ubuntu-18.04" ] && [ "${DISTRO}" != "amzn-2" ] && [ "${DISTRO}" != "debian-12" ]; then
   python3 -m pip install pre-commit
   python3 -m pre_commit install
   # Install py format tools for usage during the development.
@@ -128,6 +128,20 @@ if [ "${DISTRO}" != "centos-7" ] && [ "$DISTRO" != "debian-10" ] && [ "${DISTRO}
   echo "Install isort"
   python3 -m pip install isort==5.12.*
 fi
+# The saga with pre-commit continues...
+if [ "${DISTRO}" == "debian-12" ]; then
+  python3 -m pip install pre-commit --break-system-packages
+  python3 -m pre_commit install
+  # Install py format tools for usage during the development.
+  echo "Install black formatter"
+  python3 -m pip install black==23.1.* --break-system-packages
+  echo "Install isort"
+  python3 -m pip install isort==5.12.* --break-system-packages
+fi
+# TODO(gitbuda): The proper solution is to install everything under a single
+# venv or using pipx. This is a bigger change across memgraph repo, probably
+# setting up a single venv for the whole repo or somehow integrating this with
+# the toolchain activation script.
 
 # Link `include/mgp.py` with `release/mgp/mgp.py`
 ln -v -f include/mgp.py release/mgp/mgp.py

libs/.gitignore

@@ -7,3 +7,4 @@
 !pulsar.patch
 !antlr4.10.1.patch
 !rocksdb8.1.1.patch
+!nuraft2.1.0.patch

libs/CMakeLists.txt

@@ -16,7 +16,7 @@ set(GFLAGS_NOTHREADS OFF)
 
 # NOTE: config/generate.py depends on the gflags help XML format.
 find_package(gflags REQUIRED)
-find_package(fmt 8.0.1)
+find_package(fmt 8.0.1 REQUIRED)
 find_package(ZLIB 1.2.11 REQUIRED)
 
 set(LIB_DIR ${CMAKE_CURRENT_SOURCE_DIR})

libs/librdtsc.patch

@@ -5,7 +5,7 @@ index ee9b58c..31359a9 100644
 @@ -48,7 +48,7 @@ option(LIBRDTSC_USE_PMU     "Enables PMU usage on ARM platforms"        OFF)
  # |          Library Build and Install Properties          |
  # +--------------------------------------------------------+
- 
+
 -add_library(rdtsc SHARED
 +add_library(rdtsc
      src/cycles.c
@@ -14,7 +14,7 @@ index ee9b58c..31359a9 100644
 @@ -72,15 +72,6 @@ target_include_directories(rdtsc
    PUBLIC ${CMAKE_CURRENT_SOURCE_DIR}/include
  )
- 
+
 -# Install directory changes depending on build mode
 -if (CMAKE_BUILD_TYPE MATCHES "^[Dd]ebug")
 -    # During debug, the library will be installed into a local directory
@@ -27,3 +27,15 @@ index ee9b58c..31359a9 100644
  # Specifying what to export when installing (GNUInstallDirs required)
  install(TARGETS rdtsc
          EXPORT librstsc-config
+diff --git a/include/librdtsc/common_timer.h b/include/librdtsc/common_timer.h
+index a6922d8..080dc77 100644
+--- a/include/librdtsc/common_timer.h
++++ b/include/librdtsc/common_timer.h
+@@ -2,6 +2,7 @@
+ #define LIBRDTSC_COMMON_TIMER_H
+
+ #include <librdtsc/common.h>
++#include <librdtsc/cycles.h>
+
+ extern uint64_t rdtsc_get_tsc_freq_arch();
+ extern uint64_t rdtsc_get_tsc_freq();

libs/nuraft2.1.0.patch

@@ -0,0 +1,24 @@
+diff --git a/include/libnuraft/asio_service_options.hxx b/include/libnuraft/asio_service_options.hxx
+index 8fe1ec9..9497355 100644
+--- a/include/libnuraft/asio_service_options.hxx
++++ b/include/libnuraft/asio_service_options.hxx
+@@ -17,6 +17,7 @@ limitations under the License.
+ 
+ #pragma once
+ 
++#include <cstdint>
+ #include <functional>
+ #include <string>
+ #include <system_error>
+diff --git a/include/libnuraft/callback.hxx b/include/libnuraft/callback.hxx
+index 7b71624..d48c1e2 100644
+--- a/include/libnuraft/callback.hxx
++++ b/include/libnuraft/callback.hxx
+@@ -18,6 +18,7 @@ limitations under the License.
+ #ifndef _CALLBACK_H_
+ #define _CALLBACK_H_
+ 
++#include <cstdint>
+ #include <functional>
+ #include <string>
+ 

libs/rocksdb.patch

@@ -1,21 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 6761929..6a369af 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -220,6 +220,7 @@ else()
-       set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -momit-leaf-frame-pointer")
-     endif()
-   endif()
-+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-deprecated-copy -Wno-unused-but-set-variable")
- endif()
- 
- include(CheckCCompilerFlag)
-@@ -997,7 +998,7 @@ if(NOT WIN32 OR ROCKSDB_INSTALL_ON_WINDOWS)
- 
-   if(ROCKSDB_BUILD_SHARED)
-     install(
--      TARGETS ${ROCKSDB_SHARED_LIB}
-+      TARGETS ${ROCKSDB_SHARED_LIB} OPTIONAL
-       EXPORT RocksDBTargets
-       COMPONENT runtime
-       ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}"

libs/setup.sh

@@ -123,10 +123,10 @@ declare -A primary_urls=(
   ["pulsar"]="http://$local_cache_host/git/pulsar.git"
   ["librdtsc"]="http://$local_cache_host/git/librdtsc.git"
   ["ctre"]="http://$local_cache_host/file/hanickadot/compile-time-regular-expressions/v3.7.2/single-header/ctre.hpp"
-  ["absl"]="https://$local_cache_host/git/abseil-cpp.git"
-  ["jemalloc"]="https://$local_cache_host/git/jemalloc.git"
-  ["range-v3"]="https://$local_cache_host/git/ericniebler/range-v3.git"
-  ["nuraft"]="https://$local_cache_host/git/eBay/NuRaft.git"
+  ["absl"]="http://$local_cache_host/git/abseil-cpp.git"
+  ["jemalloc"]="http://$local_cache_host/git/jemalloc.git"
+  ["range-v3"]="http://$local_cache_host/git/range-v3.git"
+  ["nuraft"]="http://$local_cache_host/git/NuRaft.git"
 )
 
 # The goal of secondary urls is to have links to the "source of truth" of
@@ -168,12 +168,11 @@ pushd antlr4
 git apply ../antlr4.10.1.patch
 popd
 
-# cppitertools v2.0 2019-12-23
-cppitertools_ref="cb3635456bdb531121b82b4d2e3afc7ae1f56d47"
+cppitertools_ref="v2.1" # 2021-01-15
 repo_clone_try_double "${primary_urls[cppitertools]}" "${secondary_urls[cppitertools]}" "cppitertools" "$cppitertools_ref"
 
 # rapidcheck
-rapidcheck_tag="7bc7d302191a4f3d0bf005692677126136e02f60" # (2020-05-04)
+rapidcheck_tag="1c91f40e64d87869250cfb610376c629307bf77d" # (2023-08-15)
 repo_clone_try_double "${primary_urls[rapidcheck]}" "${secondary_urls[rapidcheck]}" "rapidcheck" "$rapidcheck_tag"
 
 # google benchmark
@@ -221,7 +220,7 @@ repo_clone_try_double "${primary_urls[pymgclient]}" "${secondary_urls[pymgclient
 mgconsole_tag="v1.4.0" # (2023-05-21)
 repo_clone_try_double "${primary_urls[mgconsole]}" "${secondary_urls[mgconsole]}" "mgconsole" "$mgconsole_tag" true
 
-spdlog_tag="v1.9.2" # (2021-08-12)
+spdlog_tag="v1.12.0" # (2022-11-02)
 repo_clone_try_double "${primary_urls[spdlog]}" "${secondary_urls[spdlog]}" "spdlog" "$spdlog_tag" true
 
 # librdkafka
@@ -270,6 +269,8 @@ pushd jemalloc
 MALLOC_CONF="retain:false,percpu_arena:percpu,oversize_threshold:0,muzzy_decay_ms:5000,dirty_decay_ms:5000" \
 ./configure \
   --disable-cxx \
+  --with-lg-page=12 \
+  --with-lg-hugepage=21 \
   --enable-shared=no --prefix=$working_dir \
   --with-malloc-conf="retain:false,percpu_arena:percpu,oversize_threshold:0,muzzy_decay_ms:5000,dirty_decay_ms:5000"
 
@@ -284,5 +285,6 @@ repo_clone_try_double "${primary_urls[range-v3]}" "${secondary_urls[range-v3]}"
 nuraft_tag="v2.1.0"
 repo_clone_try_double "${primary_urls[nuraft]}" "${secondary_urls[nuraft]}" "nuraft" "$nuraft_tag" true
 pushd nuraft
+git apply ../nuraft2.1.0.patch
 ./prepare.sh
 popd

src/CMakeLists.txt

@@ -22,8 +22,10 @@ add_subdirectory(dbms)
 add_subdirectory(flags)
 add_subdirectory(distributed)
 add_subdirectory(replication)
+add_subdirectory(replication_handler)
 add_subdirectory(coordination)
 add_subdirectory(replication_coordination_glue)
+add_subdirectory(system)
 
 string(TOLOWER ${CMAKE_BUILD_TYPE} lower_build_type)
 
@@ -43,10 +45,10 @@ set(mg_single_node_v2_sources
 add_executable(memgraph ${mg_single_node_v2_sources})
 target_include_directories(memgraph PUBLIC ${CMAKE_SOURCE_DIR}/include)
 target_link_libraries(memgraph stdc++fs Threads::Threads
-        mg-telemetry mg-communication mg-communication-metrics mg-memory mg-utils mg-license mg-settings mg-glue mg-flags)
+        mg-telemetry mg-communication mg-communication-metrics mg-memory mg-utils mg-license mg-settings mg-glue mg-flags mg::system mg::replication_handler)
 
 # NOTE: `include/mg_procedure.syms` describes a pattern match for symbols which
-# should be dynamically exported, so that `dlopen` can correctly link the
+# should be dynamically exported, so that `dlopen` can correctly link th
 # symbols in custom procedure module libraries.
 target_link_libraries(memgraph "-Wl,--dynamic-list=${CMAKE_SOURCE_DIR}/include/mg_procedure.syms")
 set_target_properties(memgraph PROPERTIES

src/auth/CMakeLists.txt

@@ -2,7 +2,9 @@ set(auth_src_files
     auth.cpp
     crypto.cpp
     models.cpp
-    module.cpp)
+    module.cpp
+    rpc.cpp
+    replication_handlers.cpp)
 
 find_package(Seccomp REQUIRED)
 find_package(fmt REQUIRED)
@@ -11,7 +13,7 @@ find_package(gflags REQUIRED)
 
 add_library(mg-auth STATIC ${auth_src_files})
 target_link_libraries(mg-auth json libbcrypt gflags fmt::fmt)
-target_link_libraries(mg-auth mg-utils mg-kvstore mg-license )
+target_link_libraries(mg-auth mg-utils mg-kvstore mg-license mg::system mg-replication)
 
 target_link_libraries(mg-auth ${Seccomp_LIBRARIES})
 target_include_directories(mg-auth SYSTEM PRIVATE ${Seccomp_INCLUDE_DIRS})

src/auth/auth.cpp

@@ -9,13 +9,16 @@
 #include "auth/auth.hpp"
 
 #include <iostream>
+#include <optional>
 #include <utility>
 
 #include <fmt/format.h>
 
 #include "auth/crypto.hpp"
 #include "auth/exceptions.hpp"
+#include "auth/rpc.hpp"
 #include "license/license.hpp"
+#include "system/transaction.hpp"
 #include "utils/flag_validation.hpp"
 #include "utils/message.hpp"
 #include "utils/settings.hpp"
@@ -32,21 +35,124 @@ DEFINE_VALIDATED_string(auth_module_executable, "", "Absolute path to the auth m
                           }
                           return true;
                         });
-DEFINE_bool(auth_module_create_missing_user, true, "Set to false to disable creation of missing users.");
-DEFINE_bool(auth_module_create_missing_role, true, "Set to false to disable creation of missing roles.");
-DEFINE_bool(auth_module_manage_roles, true, "Set to false to disable management of roles through the auth module.");
 DEFINE_VALIDATED_int32(auth_module_timeout_ms, 10000,
                        "Timeout (in milliseconds) used when waiting for a "
                        "response from the auth module.",
                        FLAG_IN_RANGE(100, 1800000));
 
+// DEPRECATED FLAGS
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(auth_module_create_missing_user, true,
+                             "Set to false to disable creation of missing users.", {
+                               spdlog::warn(
+                                   "auth_module_create_missing_user flag is deprecated. It not possible to create "
+                                   "users through the module anymore.");
+                               return true;
+                             });
+
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(auth_module_create_missing_role, true,
+                             "Set to false to disable creation of missing roles.", {
+                               spdlog::warn(
+                                   "auth_module_create_missing_role flag is deprecated. It not possible to create "
+                                   "roles through the module anymore.");
+                               return true;
+                             });
+
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(
+    auth_module_manage_roles, true, "Set to false to disable management of roles through the auth module.", {
+      spdlog::warn(
+          "auth_module_manage_roles flag is deprecated. It not possible to create roles through the module anymore.");
+      return true;
+    });
+
 namespace memgraph::auth {
+
+const Auth::Epoch Auth::kStartEpoch = 1;
+
+namespace {
+#ifdef MG_ENTERPRISE
+/**
+ * REPLICATION SYSTEM ACTION IMPLEMENTATIONS
+ */
+struct UpdateAuthData : memgraph::system::ISystemAction {
+  explicit UpdateAuthData(User user) : user_{std::move(user)}, role_{std::nullopt} {}
+  explicit UpdateAuthData(Role role) : user_{std::nullopt}, role_{std::move(role)} {}
+
+  void DoDurability() override { /* Done during Auth execution */
+  }
+
+  bool DoReplication(replication::ReplicationClient &client, const utils::UUID &main_uuid,
+                     replication::ReplicationEpoch const &epoch,
+                     memgraph::system::Transaction const &txn) const override {
+    auto check_response = [](const replication::UpdateAuthDataRes &response) { return response.success; };
+    if (user_) {
+      return client.SteamAndFinalizeDelta<replication::UpdateAuthDataRpc>(
+          check_response, main_uuid, std::string{epoch.id()}, txn.last_committed_system_timestamp(), txn.timestamp(),
+          *user_);
+    }
+    if (role_) {
+      return client.SteamAndFinalizeDelta<replication::UpdateAuthDataRpc>(
+          check_response, main_uuid, std::string{epoch.id()}, txn.last_committed_system_timestamp(), txn.timestamp(),
+          *role_);
+    }
+    // Should never get here
+    MG_ASSERT(false, "Trying to update auth data that is not a user nor a role");
+    return {};
+  }
+
+  void PostReplication(replication::RoleMainData &mainData) const override {}
+
+ private:
+  std::optional<User> user_;
+  std::optional<Role> role_;
+};
+
+struct DropAuthData : memgraph::system::ISystemAction {
+  enum class AuthDataType { USER, ROLE };
+
+  explicit DropAuthData(AuthDataType type, std::string_view name) : type_{type}, name_{name} {}
+
+  void DoDurability() override { /* Done during Auth execution */
+  }
+
+  bool DoReplication(replication::ReplicationClient &client, const utils::UUID &main_uuid,
+                     replication::ReplicationEpoch const &epoch,
+                     memgraph::system::Transaction const &txn) const override {
+    auto check_response = [](const replication::DropAuthDataRes &response) { return response.success; };
+
+    memgraph::replication::DropAuthDataReq::DataType type{};
+    switch (type_) {
+      case AuthDataType::USER:
+        type = memgraph::replication::DropAuthDataReq::DataType::USER;
+        break;
+      case AuthDataType::ROLE:
+        type = memgraph::replication::DropAuthDataReq::DataType::ROLE;
+        break;
+    }
+    return client.SteamAndFinalizeDelta<replication::DropAuthDataRpc>(
+        check_response, main_uuid, std::string{epoch.id()}, txn.last_committed_system_timestamp(), txn.timestamp(),
+        type, name_);
+  }
+  void PostReplication(replication::RoleMainData &mainData) const override {}
+
+ private:
+  AuthDataType type_;
+  std::string name_;
+};
+#endif
+
+/**
+ * CONSTANTS
+ */
 const std::string kUserPrefix = "user:";
 const std::string kRolePrefix = "role:";
 const std::string kLinkPrefix = "link:";
 const std::string kVersion = "version";
 
 static constexpr auto kVersionV1 = "V1";
+}  // namespace
 
 /**
  * All data stored in the `Auth` storage is stored in an underlying
@@ -112,6 +218,17 @@ void MigrateVersions(kvstore::KVStore &store) {
     version_str = kVersionV1;
   }
 }
+
+auto ParseJson(std::string_view str) {
+  nlohmann::json data;
+  try {
+    data = nlohmann::json::parse(str);
+  } catch (const nlohmann::json::parse_error &e) {
+    throw AuthException("Couldn't load auth data!");
+  }
+  return data;
+}
+
 };  // namespace
 
 Auth::Auth(std::string storage_directory, Config config)
@@ -119,8 +236,11 @@ Auth::Auth(std::string storage_directory, Config config)
   MigrateVersions(storage_);
 }
 
-std::optional<User> Auth::Authenticate(const std::string &username, const std::string &password) {
+std::optional<UserOrRole> Auth::Authenticate(const std::string &username, const std::string &password) {
   if (module_.IsUsed()) {
+    /*
+     * MODULE AUTH STORAGE
+     */
     const auto license_check_result = license::global_license_checker.IsEnterpriseValid(utils::global_settings);
     if (license_check_result.HasError()) {
       spdlog::warn(license::LicenseCheckErrorToString(license_check_result.GetError(), "authentication modules"));
@@ -145,102 +265,64 @@ std::optional<User> Auth::Authenticate(const std::string &username, const std::s
     auto is_authenticated = ret_authenticated.get<bool>();
     const auto &rolename = ret_role.get<std::string>();
 
+    // Check if role is present
+    auto role = GetRole(rolename);
+    if (!role) {
+      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the role '{}' doesn't exist.",
+                                          username, rolename, "https://memgr.ph/auth"));
+      return std::nullopt;
+    }
+
     // Authenticate the user.
     if (!is_authenticated) return std::nullopt;
 
-    // Find or create the user and return it.
-    auto user = GetUser(username);
-    if (!user) {
-      if (FLAGS_auth_module_create_missing_user) {
-        user = AddUser(username, password);
-        if (!user) {
-          spdlog::warn(utils::MessageWithLink(
-              "Couldn't create the missing user '{}' using the auth module because the user already exists as a role.",
-              username, "https://memgr.ph/auth"));
-          return std::nullopt;
-        }
-      } else {
-        spdlog::warn(utils::MessageWithLink(
-            "Couldn't authenticate user '{}' using the auth module because the user doesn't exist.", username,
-            "https://memgr.ph/auth"));
-        return std::nullopt;
-      }
-    } else {
-      UpdatePassword(*user, password);
-    }
-    if (FLAGS_auth_module_manage_roles) {
-      if (!rolename.empty()) {
-        auto role = GetRole(rolename);
-        if (!role) {
-          if (FLAGS_auth_module_create_missing_role) {
-            role = AddRole(rolename);
-            if (!role) {
-              spdlog::warn(
-                  utils::MessageWithLink("Couldn't authenticate user '{}' using the auth module because the user's "
-                                         "role '{}' already exists as a user.",
-                                         username, rolename, "https://memgr.ph/auth"));
-              return std::nullopt;
-            }
-            SaveRole(*role);
-          } else {
-            spdlog::warn(utils::MessageWithLink(
-                "Couldn't authenticate user '{}' using the auth module because the user's role '{}' doesn't exist.",
-                username, rolename, "https://memgr.ph/auth"));
-            return std::nullopt;
-          }
-        }
-        user->SetRole(*role);
-      } else {
-        user->ClearRole();
-      }
-    }
-    SaveUser(*user);
-    return user;
-  } else {
-    auto user = GetUser(username);
-    if (!user) {
-      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the user doesn't exist.", username,
-                                          "https://memgr.ph/auth"));
-      return std::nullopt;
-    }
-    if (!user->CheckPassword(password)) {
-      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the password is not correct.",
-                                          username, "https://memgr.ph/auth"));
-      return std::nullopt;
-    }
-    if (user->UpgradeHash(password)) {
-      SaveUser(*user);
-    }
-
-    return user;
+    return RoleWUsername{username, std::move(*role)};
   }
+
+  /*
+   * LOCAL AUTH STORAGE
+   */
+  auto user = GetUser(username);
+  if (!user) {
+    spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the user doesn't exist.", username,
+                                        "https://memgr.ph/auth"));
+    return std::nullopt;
+  }
+  if (!user->CheckPassword(password)) {
+    spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the password is not correct.",
+                                        username, "https://memgr.ph/auth"));
+    return std::nullopt;
+  }
+  if (user->UpgradeHash(password)) {
+    SaveUser(*user);
+  }
+
+  return user;
 }
 
-std::optional<User> Auth::GetUser(const std::string &username_orig) const {
-  auto username = utils::ToLowerCase(username_orig);
-  auto existing_user = storage_.Get(kUserPrefix + username);
-  if (!existing_user) return std::nullopt;
-
-  nlohmann::json data;
-  try {
-    data = nlohmann::json::parse(*existing_user);
-  } catch (const nlohmann::json::parse_error &e) {
-    throw AuthException("Couldn't load user data!");
-  }
-
-  auto user = User::Deserialize(data);
-  auto link = storage_.Get(kLinkPrefix + username);
-
+void Auth::LinkUser(User &user) const {
+  auto link = storage_.Get(kLinkPrefix + user.username());
   if (link) {
     auto role = GetRole(*link);
     if (role) {
       user.SetRole(*role);
     }
   }
+}
+
+std::optional<User> Auth::GetUser(const std::string &username_orig) const {
+  if (module_.IsUsed()) return std::nullopt;  // User's are not supported when using module
+  auto username = utils::ToLowerCase(username_orig);
+  auto existing_user = storage_.Get(kUserPrefix + username);
+  if (!existing_user) return std::nullopt;
+
+  auto user = User::Deserialize(ParseJson(*existing_user));
+  LinkUser(user);
   return user;
 }
 
-void Auth::SaveUser(const User &user) {
+void Auth::SaveUser(const User &user, system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   bool success = false;
   if (const auto *role = user.role(); role != nullptr) {
     success = storage_.PutMultiple(
@@ -252,9 +334,20 @@ void Auth::SaveUser(const User &user) {
   if (!success) {
     throw AuthException("Couldn't save user '{}'!", user.username());
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
+  // All changes to the user end up calling this function, so no need to add a delta anywhere else
+  if (system_tx) {
+#ifdef MG_ENTERPRISE
+    system_tx->AddAction<UpdateAuthData>(user);
+#endif
+  }
 }
 
 void Auth::UpdatePassword(auth::User &user, const std::optional<std::string> &password) {
+  DisableIfModuleUsed();
   // Check if null
   if (!password) {
     if (!config_.password_permit_null) {
@@ -284,7 +377,9 @@ void Auth::UpdatePassword(auth::User &user, const std::optional<std::string> &pa
   user.UpdatePassword(password);
 }
 
-std::optional<User> Auth::AddUser(const std::string &username, const std::optional<std::string> &password) {
+std::optional<User> Auth::AddUser(const std::string &username, const std::optional<std::string> &password,
+                                  system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   if (!NameRegexMatch(username)) {
     throw AuthException("Invalid user name.");
   }
@@ -294,17 +389,28 @@ std::optional<User> Auth::AddUser(const std::string &username, const std::option
   if (existing_role) return std::nullopt;
   auto new_user = User(username);
   UpdatePassword(new_user, password);
-  SaveUser(new_user);
+  SaveUser(new_user, system_tx);
   return new_user;
 }
 
-bool Auth::RemoveUser(const std::string &username_orig) {
+bool Auth::RemoveUser(const std::string &username_orig, system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   auto username = utils::ToLowerCase(username_orig);
   if (!storage_.Get(kUserPrefix + username)) return false;
   std::vector<std::string> keys({kLinkPrefix + username, kUserPrefix + username});
   if (!storage_.DeleteMultiple(keys)) {
     throw AuthException("Couldn't remove user '{}'!", username);
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
+  // Handling drop user delta
+  if (system_tx) {
+#ifdef MG_ENTERPRISE
+    system_tx->AddAction<DropAuthData>(DropAuthData::AuthDataType::USER, username);
+#endif
+  }
   return true;
 }
 
@@ -313,9 +419,28 @@ std::vector<auth::User> Auth::AllUsers() const {
   for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
     auto username = it->first.substr(kUserPrefix.size());
     if (username != utils::ToLowerCase(username)) continue;
-    auto user = GetUser(username);
-    if (user) {
-      ret.push_back(std::move(*user));
+    try {
+      User user = auth::User::Deserialize(ParseJson(it->second));  // Will throw on failure
+      LinkUser(user);
+      ret.emplace_back(std::move(user));
+    } catch (AuthException &) {
+      continue;
+    }
+  }
+  return ret;
+}
+
+std::vector<std::string> Auth::AllUsernames() const {
+  std::vector<std::string> ret;
+  for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
+    auto username = it->first.substr(kUserPrefix.size());
+    if (username != utils::ToLowerCase(username)) continue;
+    try {
+      // Check if serialized correctly
+      memgraph::auth::User::Deserialize(ParseJson(it->second));  // Will throw on failure
+      ret.emplace_back(std::move(username));
+    } catch (AuthException &) {
+      continue;
     }
   }
   return ret;
@@ -323,39 +448,44 @@ std::vector<auth::User> Auth::AllUsers() const {
 
 bool Auth::HasUsers() const { return storage_.begin(kUserPrefix) != storage_.end(kUserPrefix); }
 
+bool Auth::AccessControlled() const { return HasUsers() || module_.IsUsed(); }
+
 std::optional<Role> Auth::GetRole(const std::string &rolename_orig) const {
   auto rolename = utils::ToLowerCase(rolename_orig);
   auto existing_role = storage_.Get(kRolePrefix + rolename);
   if (!existing_role) return std::nullopt;
 
-  nlohmann::json data;
-  try {
-    data = nlohmann::json::parse(*existing_role);
-  } catch (const nlohmann::json::parse_error &e) {
-    throw AuthException("Couldn't load role data!");
-  }
-
-  return Role::Deserialize(data);
+  return Role::Deserialize(ParseJson(*existing_role));
 }
 
-void Auth::SaveRole(const Role &role) {
+void Auth::SaveRole(const Role &role, system::Transaction *system_tx) {
   if (!storage_.Put(kRolePrefix + role.rolename(), role.Serialize().dump())) {
     throw AuthException("Couldn't save role '{}'!", role.rolename());
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
+  // All changes to the role end up calling this function, so no need to add a delta anywhere else
+  if (system_tx) {
+#ifdef MG_ENTERPRISE
+    system_tx->AddAction<UpdateAuthData>(role);
+#endif
+  }
 }
 
-std::optional<Role> Auth::AddRole(const std::string &rolename) {
+std::optional<Role> Auth::AddRole(const std::string &rolename, system::Transaction *system_tx) {
   if (!NameRegexMatch(rolename)) {
     throw AuthException("Invalid role name.");
   }
   if (auto existing_role = GetRole(rolename)) return std::nullopt;
   if (auto existing_user = GetUser(rolename)) return std::nullopt;
   auto new_role = Role(rolename);
-  SaveRole(new_role);
+  SaveRole(new_role, system_tx);
   return new_role;
 }
 
-bool Auth::RemoveRole(const std::string &rolename_orig) {
+bool Auth::RemoveRole(const std::string &rolename_orig, system::Transaction *system_tx) {
   auto rolename = utils::ToLowerCase(rolename_orig);
   if (!storage_.Get(kRolePrefix + rolename)) return false;
   std::vector<std::string> keys;
@@ -368,6 +498,16 @@ bool Auth::RemoveRole(const std::string &rolename_orig) {
   if (!storage_.DeleteMultiple(keys)) {
     throw AuthException("Couldn't remove role '{}'!", rolename);
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
+  // Handling drop role delta
+  if (system_tx) {
+#ifdef MG_ENTERPRISE
+    system_tx->AddAction<DropAuthData>(DropAuthData::AuthDataType::ROLE, rolename);
+#endif
+  }
   return true;
 }
 
@@ -376,16 +516,30 @@ std::vector<auth::Role> Auth::AllRoles() const {
   for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
     auto rolename = it->first.substr(kRolePrefix.size());
     if (rolename != utils::ToLowerCase(rolename)) continue;
-    if (auto role = GetRole(rolename)) {
-      ret.push_back(*role);
-    } else {
-      throw AuthException("Couldn't load role '{}'!", rolename);
+    Role role = memgraph::auth::Role::Deserialize(ParseJson(it->second));  // Will throw on failure
+    ret.emplace_back(std::move(role));
+  }
+  return ret;
+}
+
+std::vector<std::string> Auth::AllRolenames() const {
+  std::vector<std::string> ret;
+  for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
+    auto rolename = it->first.substr(kRolePrefix.size());
+    if (rolename != utils::ToLowerCase(rolename)) continue;
+    try {
+      // Check that the data is serialized correctly
+      memgraph::auth::Role::Deserialize(ParseJson(it->second));
+      ret.emplace_back(std::move(rolename));
+    } catch (AuthException &) {
+      continue;
     }
   }
   return ret;
 }
 
 std::vector<auth::User> Auth::AllUsersForRole(const std::string &rolename_orig) const {
+  DisableIfModuleUsed();
   const auto rolename = utils::ToLowerCase(rolename_orig);
   std::vector<auth::User> ret;
   for (auto it = storage_.begin(kLinkPrefix); it != storage_.end(kLinkPrefix); ++it) {
@@ -404,51 +558,176 @@ std::vector<auth::User> Auth::AllUsersForRole(const std::string &rolename_orig)
 }
 
 #ifdef MG_ENTERPRISE
-bool Auth::GrantDatabaseToUser(const std::string &db, const std::string &name) {
-  if (auto user = GetUser(name)) {
-    if (db == kAllDatabases) {
-      user->db_access().GrantAll();
-    } else {
-      user->db_access().Add(db);
+Auth::Result Auth::GrantDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      GrantDatabase(db, *role, system_tx);
+      return SUCCESS;
     }
-    SaveUser(*user);
-    return true;
+    return NO_ROLE;
   }
-  return false;
+  if (auto user = GetUser(name)) {
+    GrantDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    GrantDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
 }
 
-bool Auth::RevokeDatabaseFromUser(const std::string &db, const std::string &name) {
-  if (auto user = GetUser(name)) {
-    if (db == kAllDatabases) {
-      user->db_access().DenyAll();
-    } else {
-      user->db_access().Remove(db);
-    }
-    SaveUser(*user);
-    return true;
+void Auth::GrantDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().GrantAll();
+  } else {
+    user.db_access().Grant(db);
   }
-  return false;
+  SaveUser(user, system_tx);
 }
 
-void Auth::DeleteDatabase(const std::string &db) {
+void Auth::GrantDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().GrantAll();
+  } else {
+    role.db_access().Grant(db);
+  }
+  SaveRole(role, system_tx);
+}
+
+Auth::Result Auth::DenyDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      DenyDatabase(db, *role, system_tx);
+      return SUCCESS;
+    }
+    return NO_ROLE;
+  }
+  if (auto user = GetUser(name)) {
+    DenyDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    DenyDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::DenyDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().DenyAll();
+  } else {
+    user.db_access().Deny(db);
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::DenyDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().DenyAll();
+  } else {
+    role.db_access().Deny(db);
+  }
+  SaveRole(role, system_tx);
+}
+
+Auth::Result Auth::RevokeDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      RevokeDatabase(db, *role, system_tx);
+      return SUCCESS;
+    }
+    return NO_ROLE;
+  }
+  if (auto user = GetUser(name)) {
+    RevokeDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    RevokeDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::RevokeDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().RevokeAll();
+  } else {
+    user.db_access().Revoke(db);
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::RevokeDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().RevokeAll();
+  } else {
+    role.db_access().Revoke(db);
+  }
+  SaveRole(role, system_tx);
+}
+
+void Auth::DeleteDatabase(const std::string &db, system::Transaction *system_tx) {
   for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
     auto username = it->first.substr(kUserPrefix.size());
-    if (auto user = GetUser(username)) {
-      user->db_access().Delete(db);
-      SaveUser(*user);
+    try {
+      User user = auth::User::Deserialize(ParseJson(it->second));
+      LinkUser(user);
+      user.db_access().Revoke(db);
+      SaveUser(user, system_tx);
+    } catch (AuthException &) {
+      continue;
+    }
+  }
+  for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
+    auto rolename = it->first.substr(kRolePrefix.size());
+    try {
+      auto role = memgraph::auth::Role::Deserialize(ParseJson(it->second));
+      role.db_access().Revoke(db);
+      SaveRole(role, system_tx);
+    } catch (AuthException &) {
+      continue;
     }
   }
 }
 
-bool Auth::SetMainDatabase(std::string_view db, const std::string &name) {
-  if (auto user = GetUser(name)) {
-    if (!user->db_access().SetDefault(db)) {
-      throw AuthException("Couldn't set default database '{}' for user '{}'!", db, name);
+Auth::Result Auth::SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      SetMainDatabase(db, *role, system_tx);
+      return SUCCESS;
     }
-    SaveUser(*user);
-    return true;
+    return NO_ROLE;
   }
-  return false;
+  if (auto user = GetUser(name)) {
+    SetMainDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    SetMainDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::SetMainDatabase(std::string_view db, User &user, system::Transaction *system_tx) {
+  if (!user.db_access().SetMain(db)) {
+    throw AuthException("Couldn't set default database '{}' for '{}'!", db, user.username());
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::SetMainDatabase(std::string_view db, Role &role, system::Transaction *system_tx) {
+  if (!role.db_access().SetMain(db)) {
+    throw AuthException("Couldn't set default database '{}' for '{}'!", db, role.rolename());
+  }
+  SaveRole(role, system_tx);
 }
 #endif
 

src/auth/auth.hpp

@@ -18,12 +18,29 @@
 #include "auth/module.hpp"
 #include "glue/auth_global.hpp"
 #include "kvstore/kvstore.hpp"
+#include "system/action.hpp"
 #include "utils/settings.hpp"
+#include "utils/synchronized.hpp"
 
 namespace memgraph::auth {
 
+class Auth;
+using SynchedAuth = memgraph::utils::Synchronized<memgraph::auth::Auth, memgraph::utils::WritePrioritizedRWLock>;
+
 static const constexpr char *const kAllDatabases = "*";
 
+struct RoleWUsername : Role {
+  template <typename... Args>
+  RoleWUsername(std::string_view username, Args &&...args) : Role{std::forward<Args>(args)...}, username_{username} {}
+
+  std::string username() { return username_; }
+  const std::string &username() const { return username_; }
+
+ private:
+  std::string username_;
+};
+using UserOrRole = std::variant<User, RoleWUsername>;
+
 /**
  * This class serves as the main Authentication/Authorization storage.
  * It provides functions for managing Users, Roles, Permissions and FineGrainedAccessPermissions.
@@ -56,6 +73,25 @@ class Auth final {
     std::regex password_regex{password_regex_str};
   };
 
+  struct Epoch {
+    Epoch() : epoch_{0} {}
+    Epoch(unsigned e) : epoch_{e} {}
+
+    Epoch operator++() { return ++epoch_; }
+    bool operator==(const Epoch &rhs) const = default;
+
+   private:
+    unsigned epoch_;
+  };
+
+  static const Epoch kStartEpoch;
+
+  enum class Result {
+    SUCCESS,
+    NO_USER_ROLE,
+    NO_ROLE,
+  };
+
   explicit Auth(std::string storage_directory, Config config);
 
   /**
@@ -68,6 +104,13 @@ class Auth final {
     config_ = std::move(config);
   }
 
+  /**
+   * @brief
+   *
+   * @return Config
+   */
+  Config GetConfig() const { return config_; }
+
   /**
    * Authenticates a user using his username and password.
    *
@@ -77,7 +120,7 @@ class Auth final {
    * @return a user when the username and password match, nullopt otherwise
    * @throw AuthException if unable to authenticate for whatever reason.
    */
-  std::optional<User> Authenticate(const std::string &username, const std::string &password);
+  std::optional<UserOrRole> Authenticate(const std::string &username, const std::string &password);
 
   /**
    * Gets a user from the storage.
@@ -89,6 +132,8 @@ class Auth final {
    */
   std::optional<User> GetUser(const std::string &username) const;
 
+  void LinkUser(User &user) const;
+
   /**
    * Saves a user object to the storage.
    *
@@ -96,7 +141,7 @@ class Auth final {
    *
    * @throw AuthException if unable to save the user.
    */
-  void SaveUser(const User &user);
+  void SaveUser(const User &user, system::Transaction *system_tx = nullptr);
 
   /**
    * Creates a user if the user doesn't exist.
@@ -107,7 +152,8 @@ class Auth final {
    * @return a user when the user is created, nullopt if the user exists
    * @throw AuthException if unable to save the user.
    */
-  std::optional<User> AddUser(const std::string &username, const std::optional<std::string> &password = std::nullopt);
+  std::optional<User> AddUser(const std::string &username, const std::optional<std::string> &password = std::nullopt,
+                              system::Transaction *system_tx = nullptr);
 
   /**
    * Removes a user from the storage.
@@ -118,7 +164,7 @@ class Auth final {
    *         doesn't exist
    * @throw AuthException if unable to remove the user.
    */
-  bool RemoveUser(const std::string &username);
+  bool RemoveUser(const std::string &username, system::Transaction *system_tx = nullptr);
 
   /**
    * @brief
@@ -136,6 +182,13 @@ class Auth final {
    */
   std::vector<User> AllUsers() const;
 
+  /**
+   * @brief
+   *
+   * @return std::vector<std::string>
+   */
+  std::vector<std::string> AllUsernames() const;
+
   /**
    * Returns whether there are users in the storage.
    *
@@ -143,6 +196,13 @@ class Auth final {
    */
   bool HasUsers() const;
 
+  /**
+   * Returns whether the access is controlled by authentication/authorization.
+   *
+   * @return `true` if auth needs to run
+   */
+  bool AccessControlled() const;
+
   /**
    * Gets a role from the storage.
    *
@@ -153,6 +213,37 @@ class Auth final {
    */
   std::optional<Role> GetRole(const std::string &rolename) const;
 
+  std::optional<UserOrRole> GetUserOrRole(const std::optional<std::string> &username,
+                                          const std::optional<std::string> &rolename) const {
+    auto expect = [](bool condition, std::string &&msg) {
+      if (!condition) throw AuthException(std::move(msg));
+    };
+    // Special case if we are using a module; we must find the specified role
+    if (module_.IsUsed()) {
+      expect(username && rolename, "When using a module, a role needs to be connected to a username.");
+      const auto role = GetRole(*rolename);
+      expect(role != std::nullopt, "No role named " + *rolename);
+      return UserOrRole(auth::RoleWUsername{*username, *role});
+    }
+
+    // First check if we need to find a role
+    if (username && rolename) {
+      const auto role = GetRole(*rolename);
+      expect(role != std::nullopt, "No role named " + *rolename);
+      return UserOrRole(auth::RoleWUsername{*username, *role});
+    }
+
+    // We are only looking for a user
+    if (username) {
+      const auto user = GetUser(*username);
+      expect(user != std::nullopt, "No user named " + *username);
+      return *user;
+    }
+
+    // No user or role
+    return std::nullopt;
+  }
+
   /**
    * Saves a role object to the storage.
    *
@@ -160,7 +251,7 @@ class Auth final {
    *
    * @throw AuthException if unable to save the role.
    */
-  void SaveRole(const Role &role);
+  void SaveRole(const Role &role, system::Transaction *system_tx = nullptr);
 
   /**
    * Creates a role if the role doesn't exist.
@@ -170,7 +261,7 @@ class Auth final {
    * @return a role when the role is created, nullopt if the role exists
    * @throw AuthException if unable to save the role.
    */
-  std::optional<Role> AddRole(const std::string &rolename);
+  std::optional<Role> AddRole(const std::string &rolename, system::Transaction *system_tx = nullptr);
 
   /**
    * Removes a role from the storage.
@@ -181,7 +272,7 @@ class Auth final {
    *         doesn't exist
    * @throw AuthException if unable to remove the role.
    */
-  bool RemoveRole(const std::string &rolename);
+  bool RemoveRole(const std::string &rolename, system::Transaction *system_tx = nullptr);
 
   /**
    * Gets all roles from the storage.
@@ -191,6 +282,13 @@ class Auth final {
    */
   std::vector<Role> AllRoles() const;
 
+  /**
+   * @brief
+   *
+   * @return std::vector<std::string>
+   */
+  std::vector<std::string> AllRolenames() const;
+
   /**
    * Gets all users for a role from the storage.
    *
@@ -202,16 +300,6 @@ class Auth final {
   std::vector<User> AllUsersForRole(const std::string &rolename) const;
 
 #ifdef MG_ENTERPRISE
-  /**
-   * @brief Revoke access to individual database for a user.
-   *
-   * @param db name of the database to revoke
-   * @param name user's username
-   * @return true on success
-   * @throw AuthException if unable to find or update the user
-   */
-  bool RevokeDatabaseFromUser(const std::string &db, const std::string &name);
-
   /**
    * @brief Grant access to individual database for a user.
    *
@@ -220,7 +308,33 @@ class Auth final {
    * @return true on success
    * @throw AuthException if unable to find or update the user
    */
-  bool GrantDatabaseToUser(const std::string &db, const std::string &name);
+  Result GrantDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void GrantDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void GrantDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
+
+  /**
+   * @brief Revoke access to individual database for a user.
+   *
+   * @param db name of the database to revoke
+   * @param name user's username
+   * @return true on success
+   * @throw AuthException if unable to find or update the user
+   */
+  Result DenyDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void DenyDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void DenyDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
+
+  /**
+   * @brief Revoke access to individual database for a user.
+   *
+   * @param db name of the database to revoke
+   * @param name user's username
+   * @return true on success
+   * @throw AuthException if unable to find or update the user
+   */
+  Result RevokeDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void RevokeDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void RevokeDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
 
   /**
    * @brief Delete a database from all users.
@@ -228,7 +342,7 @@ class Auth final {
    * @param db name of the database to delete
    * @throw AuthException if unable to read data
    */
-  void DeleteDatabase(const std::string &db);
+  void DeleteDatabase(const std::string &db, system::Transaction *system_tx = nullptr);
 
   /**
    * @brief Set main database for an individual user.
@@ -238,9 +352,17 @@ class Auth final {
    * @return true on success
    * @throw AuthException if unable to find or update the user
    */
-  bool SetMainDatabase(std::string_view db, const std::string &name);
+  Result SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void SetMainDatabase(std::string_view db, User &user, system::Transaction *system_tx = nullptr);
+  void SetMainDatabase(std::string_view db, Role &role, system::Transaction *system_tx = nullptr);
 #endif
 
+  bool UpToDate(Epoch &e) const {
+    bool res = e == epoch_;
+    e = epoch_;
+    return res;
+  }
+
  private:
   /**
    * @brief
@@ -251,11 +373,18 @@ class Auth final {
    */
   bool NameRegexMatch(const std::string &user_or_role) const;
 
+  void UpdateEpoch() { ++epoch_; }
+
+  void DisableIfModuleUsed() const {
+    if (module_.IsUsed()) throw AuthException("Operation not permited when using an authentication module.");
+  }
+
   // Even though the `kvstore::KVStore` class is guaranteed to be thread-safe,
   // Auth is not thread-safe because modifying users and roles might require
   // more than one operation on the storage.
   kvstore::KVStore storage_;
   auth::Module module_;
   Config config_;
+  Epoch epoch_{kStartEpoch};
 };
 }  // namespace memgraph::auth

src/auth/crypto.hpp

@@ -8,10 +8,12 @@
 
 #pragma once
 
-#include <json/json.hpp>
+#include <cstdint>
 #include <optional>
 #include <string>
 
+#include <json/json.hpp>
+
 namespace memgraph::auth {
 /// Need to be stable, auth durability depends on this
 enum class PasswordHashAlgorithm : uint8_t { BCRYPT = 0, SHA256 = 1, SHA256_MULTIPLE = 2 };

src/auth/models.cpp

@@ -425,10 +425,11 @@ Role::Role(const std::string &rolename, const Permissions &permissions)
     : rolename_(utils::ToLowerCase(rolename)), permissions_(permissions) {}
 #ifdef MG_ENTERPRISE
 Role::Role(const std::string &rolename, const Permissions &permissions,
-           FineGrainedAccessHandler fine_grained_access_handler)
+           FineGrainedAccessHandler fine_grained_access_handler, Databases db_access)
     : rolename_(utils::ToLowerCase(rolename)),
       permissions_(permissions),
-      fine_grained_access_handler_(std::move(fine_grained_access_handler)) {}
+      fine_grained_access_handler_(std::move(fine_grained_access_handler)),
+      db_access_(std::move(db_access)) {}
 #endif
 
 const std::string &Role::rolename() const { return rolename_; }
@@ -454,8 +455,10 @@ nlohmann::json Role::Serialize() const {
 #ifdef MG_ENTERPRISE
   if (memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     data[kFineGrainedAccessHandler] = fine_grained_access_handler_.Serialize();
+    data[kDatabases] = db_access_.Serialize();
   } else {
     data[kFineGrainedAccessHandler] = {};
+    data[kDatabases] = {};
   }
 #endif
   return data;
@@ -471,12 +474,21 @@ Role Role::Deserialize(const nlohmann::json &data) {
   auto permissions = Permissions::Deserialize(data[kPermissions]);
 #ifdef MG_ENTERPRISE
   if (memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
+    Databases db_access;
+    if (data[kDatabases].is_structured()) {
+      db_access = Databases::Deserialize(data[kDatabases]);
+    } else {
+      // Back-compatibility
+      spdlog::warn("Role without specified database access. Given access to the default database.");
+      db_access.Grant(dbms::kDefaultDB);
+      db_access.SetMain(dbms::kDefaultDB);
+    }
     FineGrainedAccessHandler fine_grained_access_handler;
     // We can have an empty fine_grained if the user was created without a valid license
     if (data[kFineGrainedAccessHandler].is_object()) {
       fine_grained_access_handler = FineGrainedAccessHandler::Deserialize(data[kFineGrainedAccessHandler]);
     }
-    return {data[kRoleName], permissions, std::move(fine_grained_access_handler)};
+    return {data[kRoleName], permissions, std::move(fine_grained_access_handler), std::move(db_access)};
   }
 #endif
   return {data[kRoleName], permissions};
@@ -493,7 +505,7 @@ bool operator==(const Role &first, const Role &second) {
 }
 
 #ifdef MG_ENTERPRISE
-void Databases::Add(std::string_view db) {
+void Databases::Grant(std::string_view db) {
   if (allow_all_) {
     grants_dbs_.clear();
     allow_all_ = false;
@@ -502,19 +514,19 @@ void Databases::Add(std::string_view db) {
   denies_dbs_.erase(std::string{db});  // TODO: C++23 use transparent key compare
 }
 
-void Databases::Remove(const std::string &db) {
+void Databases::Deny(const std::string &db) {
   denies_dbs_.emplace(db);
   grants_dbs_.erase(db);
 }
 
-void Databases::Delete(const std::string &db) {
+void Databases::Revoke(const std::string &db) {
   denies_dbs_.erase(db);
   if (!allow_all_) {
     grants_dbs_.erase(db);
   }
   // Reset if default deleted
-  if (default_db_ == db) {
-    default_db_ = "";
+  if (main_db_ == db) {
+    main_db_ = "";
   }
 }
 
@@ -530,9 +542,16 @@ void Databases::DenyAll() {
   denies_dbs_.clear();
 }
 
-bool Databases::SetDefault(std::string_view db) {
+void Databases::RevokeAll() {
+  allow_all_ = false;
+  grants_dbs_.clear();
+  denies_dbs_.clear();
+  main_db_ = "";
+}
+
+bool Databases::SetMain(std::string_view db) {
   if (!Contains(db)) return false;
-  default_db_ = db;
+  main_db_ = db;
   return true;
 }
 
@@ -540,11 +559,11 @@ bool Databases::SetDefault(std::string_view db) {
   return !denies_dbs_.contains(db) && (allow_all_ || grants_dbs_.contains(db));
 }
 
-const std::string &Databases::GetDefault() const {
-  if (!Contains(default_db_)) {
-    throw AuthException("No access to the set default database \"{}\".", default_db_);
+const std::string &Databases::GetMain() const {
+  if (!Contains(main_db_)) {
+    throw AuthException("No access to the set default database \"{}\".", main_db_);
   }
-  return default_db_;
+  return main_db_;
 }
 
 nlohmann::json Databases::Serialize() const {
@@ -552,7 +571,7 @@ nlohmann::json Databases::Serialize() const {
   data[kGrants] = grants_dbs_;
   data[kDenies] = denies_dbs_;
   data[kAllowAll] = allow_all_;
-  data[kDefault] = default_db_;
+  data[kDefault] = main_db_;
   return data;
 }
 
@@ -611,27 +630,49 @@ Permissions User::GetPermissions() const {
 
 #ifdef MG_ENTERPRISE
 FineGrainedAccessPermissions User::GetFineGrainedAccessLabelPermissions() const {
+  return Merge(GetUserFineGrainedAccessLabelPermissions(), GetRoleFineGrainedAccessLabelPermissions());
+}
+
+FineGrainedAccessPermissions User::GetFineGrainedAccessEdgeTypePermissions() const {
+  return Merge(GetUserFineGrainedAccessEdgeTypePermissions(), GetRoleFineGrainedAccessEdgeTypePermissions());
+}
+
+FineGrainedAccessPermissions User::GetUserFineGrainedAccessEdgeTypePermissions() const {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return FineGrainedAccessPermissions{};
   }
 
-  if (role_) {
-    return Merge(role()->fine_grained_access_handler().label_permissions(),
-                 fine_grained_access_handler_.label_permissions());
+  return fine_grained_access_handler_.edge_type_permissions();
+}
+
+FineGrainedAccessPermissions User::GetUserFineGrainedAccessLabelPermissions() const {
+  if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
+    return FineGrainedAccessPermissions{};
   }
 
   return fine_grained_access_handler_.label_permissions();
 }
 
-FineGrainedAccessPermissions User::GetFineGrainedAccessEdgeTypePermissions() const {
+FineGrainedAccessPermissions User::GetRoleFineGrainedAccessEdgeTypePermissions() const {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return FineGrainedAccessPermissions{};
   }
+
   if (role_) {
-    return Merge(role()->fine_grained_access_handler().edge_type_permissions(),
-                 fine_grained_access_handler_.edge_type_permissions());
+    return role()->fine_grained_access_handler().edge_type_permissions();
   }
-  return fine_grained_access_handler_.edge_type_permissions();
+  return FineGrainedAccessPermissions{};
+}
+
+FineGrainedAccessPermissions User::GetRoleFineGrainedAccessLabelPermissions() const {
+  if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
+    return FineGrainedAccessPermissions{};
+  }
+
+  if (role_) {
+    return role()->fine_grained_access_handler().label_permissions();
+  }
+  return FineGrainedAccessPermissions{};
 }
 #endif
 
@@ -697,15 +738,16 @@ User User::Deserialize(const nlohmann::json &data) {
     } else {
       // Back-compatibility
       spdlog::warn("User without specified database access. Given access to the default database.");
-      db_access.Add(dbms::kDefaultDB);
-      db_access.SetDefault(dbms::kDefaultDB);
+      db_access.Grant(dbms::kDefaultDB);
+      db_access.SetMain(dbms::kDefaultDB);
     }
     FineGrainedAccessHandler fine_grained_access_handler;
     // We can have an empty fine_grained if the user was created without a valid license
     if (data[kFineGrainedAccessHandler].is_object()) {
       fine_grained_access_handler = FineGrainedAccessHandler::Deserialize(data[kFineGrainedAccessHandler]);
     }
-    return {data[kUsername], std::move(password_hash), permissions, std::move(fine_grained_access_handler), db_access};
+    return {data[kUsername], std::move(password_hash), permissions, std::move(fine_grained_access_handler),
+            std::move(db_access)};
   }
 #endif
   return {data[kUsername], std::move(password_hash), permissions};

src/auth/models.hpp

@@ -205,50 +205,10 @@ class FineGrainedAccessHandler final {
 bool operator==(const FineGrainedAccessHandler &first, const FineGrainedAccessHandler &second);
 #endif
 
-class Role final {
- public:
-  explicit Role(const std::string &rolename);
-  Role(const std::string &rolename, const Permissions &permissions);
-#ifdef MG_ENTERPRISE
-  Role(const std::string &rolename, const Permissions &permissions,
-       FineGrainedAccessHandler fine_grained_access_handler);
-#endif
-  Role(const Role &) = default;
-  Role &operator=(const Role &) = default;
-  Role(Role &&) noexcept = default;
-  Role &operator=(Role &&) noexcept = default;
-  ~Role() = default;
-
-  const std::string &rolename() const;
-  const Permissions &permissions() const;
-  Permissions &permissions();
-#ifdef MG_ENTERPRISE
-  const FineGrainedAccessHandler &fine_grained_access_handler() const;
-  FineGrainedAccessHandler &fine_grained_access_handler();
-  const FineGrainedAccessPermissions &GetFineGrainedAccessLabelPermissions() const;
-  const FineGrainedAccessPermissions &GetFineGrainedAccessEdgeTypePermissions() const;
-#endif
-  nlohmann::json Serialize() const;
-
-  /// @throw AuthException if unable to deserialize.
-  static Role Deserialize(const nlohmann::json &data);
-
-  friend bool operator==(const Role &first, const Role &second);
-
- private:
-  std::string rolename_;
-  Permissions permissions_;
-#ifdef MG_ENTERPRISE
-  FineGrainedAccessHandler fine_grained_access_handler_;
-#endif
-};
-
-bool operator==(const Role &first, const Role &second);
-
 #ifdef MG_ENTERPRISE
 class Databases final {
  public:
-  Databases() : grants_dbs_{std::string{dbms::kDefaultDB}}, allow_all_(false), default_db_(dbms::kDefaultDB) {}
+  Databases() : grants_dbs_{std::string{dbms::kDefaultDB}}, allow_all_(false), main_db_(dbms::kDefaultDB) {}
 
   Databases(const Databases &) = default;
   Databases &operator=(const Databases &) = default;
@@ -261,7 +221,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Add(std::string_view db);
+  void Grant(std::string_view db);
 
   /**
    * @brief Remove database to the list of granted access.
@@ -270,7 +230,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Remove(const std::string &db);
+  void Deny(const std::string &db);
 
   /**
    * @brief Called when database is dropped. Removes it from granted (if allow_all is false) and denied set.
@@ -278,7 +238,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Delete(const std::string &db);
+  void Revoke(const std::string &db);
 
   /**
    * @brief Set allow_all_ to true and clears grants and denied sets.
@@ -290,10 +250,15 @@ class Databases final {
    */
   void DenyAll();
 
+  /**
+   * @brief Set allow_all_ to false and clears grants and denied sets.
+   */
+  void RevokeAll();
+
   /**
    * @brief Set the default database.
    */
-  bool SetDefault(std::string_view db);
+  bool SetMain(std::string_view db);
 
   /**
    * @brief Checks if access is grated to the database.
@@ -302,11 +267,13 @@ class Databases final {
    * @return true if allow_all and not denied or granted
    */
   bool Contains(std::string_view db) const;
+  bool Denies(std::string_view db_name) const { return denies_dbs_.contains(db_name); }
+  bool Grants(std::string_view db_name) const { return allow_all_ || grants_dbs_.contains(db_name); }
 
   bool GetAllowAll() const { return allow_all_; }
   const std::set<std::string, std::less<>> &GetGrants() const { return grants_dbs_; }
   const std::set<std::string, std::less<>> &GetDenies() const { return denies_dbs_; }
-  const std::string &GetDefault() const;
+  const std::string &GetMain() const;
 
   nlohmann::json Serialize() const;
   /// @throw AuthException if unable to deserialize.
@@ -318,15 +285,69 @@ class Databases final {
       : grants_dbs_(std::move(grant)),
         denies_dbs_(std::move(deny)),
         allow_all_(allow_all),
-        default_db_(std::move(default_db)) {}
+        main_db_(std::move(default_db)) {}
 
   std::set<std::string, std::less<>> grants_dbs_;  //!< set of databases with granted access
   std::set<std::string, std::less<>> denies_dbs_;  //!< set of databases with denied access
   bool allow_all_;                                 //!< flag to allow access to everything (denied overrides this)
-  std::string default_db_;                         //!< user's default database
+  std::string main_db_;                            //!< user's default database
 };
 #endif
 
+class Role {
+ public:
+  Role() = default;
+
+  explicit Role(const std::string &rolename);
+  Role(const std::string &rolename, const Permissions &permissions);
+#ifdef MG_ENTERPRISE
+  Role(const std::string &rolename, const Permissions &permissions,
+       FineGrainedAccessHandler fine_grained_access_handler, Databases db_access = {});
+#endif
+  Role(const Role &) = default;
+  Role &operator=(const Role &) = default;
+  Role(Role &&) noexcept = default;
+  Role &operator=(Role &&) noexcept = default;
+  ~Role() = default;
+
+  const std::string &rolename() const;
+  const Permissions &permissions() const;
+  Permissions &permissions();
+  Permissions GetPermissions() const { return permissions_; }
+#ifdef MG_ENTERPRISE
+  const FineGrainedAccessHandler &fine_grained_access_handler() const;
+  FineGrainedAccessHandler &fine_grained_access_handler();
+  const FineGrainedAccessPermissions &GetFineGrainedAccessLabelPermissions() const;
+  const FineGrainedAccessPermissions &GetFineGrainedAccessEdgeTypePermissions() const;
+#endif
+
+#ifdef MG_ENTERPRISE
+  Databases &db_access() { return db_access_; }
+  const Databases &db_access() const { return db_access_; }
+
+  bool DeniesDB(std::string_view db_name) const { return db_access_.Denies(db_name); }
+  bool GrantsDB(std::string_view db_name) const { return db_access_.Grants(db_name); }
+  bool HasAccess(std::string_view db_name) const { return !DeniesDB(db_name) && GrantsDB(db_name); }
+#endif
+
+  nlohmann::json Serialize() const;
+
+  /// @throw AuthException if unable to deserialize.
+  static Role Deserialize(const nlohmann::json &data);
+
+  friend bool operator==(const Role &first, const Role &second);
+
+ private:
+  std::string rolename_;
+  Permissions permissions_;
+#ifdef MG_ENTERPRISE
+  FineGrainedAccessHandler fine_grained_access_handler_;
+  Databases db_access_;
+#endif
+};
+
+bool operator==(const Role &first, const Role &second);
+
 // TODO (mferencevic): Implement password expiry.
 class User final {
  public:
@@ -369,6 +390,10 @@ class User final {
 #ifdef MG_ENTERPRISE
   FineGrainedAccessPermissions GetFineGrainedAccessLabelPermissions() const;
   FineGrainedAccessPermissions GetFineGrainedAccessEdgeTypePermissions() const;
+  FineGrainedAccessPermissions GetUserFineGrainedAccessLabelPermissions() const;
+  FineGrainedAccessPermissions GetUserFineGrainedAccessEdgeTypePermissions() const;
+  FineGrainedAccessPermissions GetRoleFineGrainedAccessLabelPermissions() const;
+  FineGrainedAccessPermissions GetRoleFineGrainedAccessEdgeTypePermissions() const;
   const FineGrainedAccessHandler &fine_grained_access_handler() const;
   FineGrainedAccessHandler &fine_grained_access_handler();
 #endif
@@ -382,6 +407,18 @@ class User final {
 #ifdef MG_ENTERPRISE
   Databases &db_access() { return database_access_; }
   const Databases &db_access() const { return database_access_; }
+
+  bool DeniesDB(std::string_view db_name) const {
+    bool denies = database_access_.Denies(db_name);
+    if (role_) denies |= role_->DeniesDB(db_name);
+    return denies;
+  }
+  bool GrantsDB(std::string_view db_name) const {
+    bool grants = database_access_.Grants(db_name);
+    if (role_) grants |= role_->GrantsDB(db_name);
+    return grants;
+  }
+  bool HasAccess(std::string_view db_name) const { return !DeniesDB(db_name) && GrantsDB(db_name); }
 #endif
 
   nlohmann::json Serialize() const;
@@ -397,7 +434,7 @@ class User final {
   Permissions permissions_;
 #ifdef MG_ENTERPRISE
   FineGrainedAccessHandler fine_grained_access_handler_;
-  Databases database_access_;
+  Databases database_access_{};
 #endif
   std::optional<Role> role_;
 };

src/auth/module.cpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Licensed as a Memgraph Enterprise file under the Memgraph Enterprise
 // License (the "License"); by using this file, you agree to be bound by the terms of the License, and you may not use
@@ -403,7 +403,7 @@ nlohmann::json Module::Call(const nlohmann::json &params, int timeout_millisec)
   return ret;
 }
 
-bool Module::IsUsed() { return !module_executable_path_.empty(); }
+bool Module::IsUsed() const { return !module_executable_path_.empty(); }
 
 void Module::Shutdown() {
   if (pid_ == -1) return;

src/auth/module.hpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Licensed as a Memgraph Enterprise file under the Memgraph Enterprise
 // License (the "License"); by using this file, you agree to be bound by the terms of the License, and you may not use
@@ -49,7 +49,7 @@ class Module final {
   /// specified executable path and can thus be used.
   ///
   /// @return boolean indicating whether the module can be used
-  bool IsUsed();
+  bool IsUsed() const;
 
   ~Module();
 

src/auth/replication_handlers.cpp

@@ -0,0 +1,190 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#include "auth/replication_handlers.hpp"
+
+#include "auth/auth.hpp"
+#include "auth/rpc.hpp"
+#include "license/license.hpp"
+
+namespace memgraph::auth {
+
+void LogWrongMain(const std::optional<utils::UUID> &current_main_uuid, const utils::UUID &main_req_id,
+                  std::string_view rpc_req) {
+  spdlog::error(fmt::format("Received {} with main_id: {} != current_main_uuid: {}", rpc_req, std::string(main_req_id),
+                            current_main_uuid.has_value() ? std::string(current_main_uuid.value()) : ""));
+}
+
+#ifdef MG_ENTERPRISE
+void UpdateAuthDataHandler(memgraph::system::ReplicaHandlerAccessToState &system_state_access,
+                           const std::optional<utils::UUID> &current_main_uuid, auth::SynchedAuth &auth,
+                           slk::Reader *req_reader, slk::Builder *res_builder) {
+  replication::UpdateAuthDataReq req;
+  memgraph::slk::Load(&req, req_reader);
+
+  using memgraph::replication::UpdateAuthDataRes;
+  UpdateAuthDataRes res(false);
+
+  if (!current_main_uuid.has_value() || req.main_uuid != current_main_uuid) [[unlikely]] {
+    LogWrongMain(current_main_uuid, req.main_uuid, replication::UpdateAuthDataReq::kType.name);
+    memgraph::slk::Save(res, res_builder);
+    return;
+  }
+
+  // Note: No need to check epoch, recovery mechanism is done by a full uptodate snapshot
+  //       of the set of databases. Hence no history exists to maintain regarding epoch change.
+  //       If MAIN has changed we need to check this new group_timestamp is consistent with
+  //       what we have so far.
+
+  if (req.expected_group_timestamp != system_state_access.LastCommitedTS()) {
+    spdlog::debug("UpdateAuthDataHandler: bad expected timestamp {},{}", req.expected_group_timestamp,
+                  system_state_access.LastCommitedTS());
+    memgraph::slk::Save(res, res_builder);
+    return;
+  }
+
+  try {
+    // Update
+    if (req.user) auth->SaveUser(*req.user);
+    if (req.role) auth->SaveRole(*req.role);
+    // Success
+    system_state_access.SetLastCommitedTS(req.new_group_timestamp);
+    res = UpdateAuthDataRes(true);
+    spdlog::debug("UpdateAuthDataHandler: SUCCESS updated LCTS to {}", req.new_group_timestamp);
+  } catch (const auth::AuthException & /* not used */) {
+    // Failure
+  }
+
+  memgraph::slk::Save(res, res_builder);
+}
+
+void DropAuthDataHandler(memgraph::system::ReplicaHandlerAccessToState &system_state_access,
+                         const std::optional<utils::UUID> &current_main_uuid, auth::SynchedAuth &auth,
+                         slk::Reader *req_reader, slk::Builder *res_builder) {
+  replication::DropAuthDataReq req;
+  memgraph::slk::Load(&req, req_reader);
+
+  using memgraph::replication::DropAuthDataRes;
+  DropAuthDataRes res(false);
+
+  if (!current_main_uuid.has_value() || req.main_uuid != current_main_uuid) [[unlikely]] {
+    LogWrongMain(current_main_uuid, req.main_uuid, replication::DropAuthDataRes::kType.name);
+    memgraph::slk::Save(res, res_builder);
+    return;
+  }
+
+  // Note: No need to check epoch, recovery mechanism is done by a full uptodate snapshot
+  //       of the set of databases. Hence no history exists to maintain regarding epoch change.
+  //       If MAIN has changed we need to check this new group_timestamp is consistent with
+  //       what we have so far.
+
+  if (req.expected_group_timestamp != system_state_access.LastCommitedTS()) {
+    spdlog::debug("DropAuthDataHandler: bad expected timestamp {},{}", req.expected_group_timestamp,
+                  system_state_access.LastCommitedTS());
+    memgraph::slk::Save(res, res_builder);
+    return;
+  }
+
+  try {
+    // Remove
+    switch (req.type) {
+      case replication::DropAuthDataReq::DataType::USER:
+        auth->RemoveUser(req.name);
+        break;
+      case replication::DropAuthDataReq::DataType::ROLE:
+        auth->RemoveRole(req.name);
+        break;
+    }
+    // Success
+    system_state_access.SetLastCommitedTS(req.new_group_timestamp);
+    res = DropAuthDataRes(true);
+    spdlog::debug("DropAuthDataHandler: SUCCESS updated LCTS to {}", req.new_group_timestamp);
+  } catch (const auth::AuthException & /* not used */) {
+    // Failure
+  }
+
+  memgraph::slk::Save(res, res_builder);
+}
+
+bool SystemRecoveryHandler(auth::SynchedAuth &auth, auth::Auth::Config auth_config,
+                           const std::vector<auth::User> &users, const std::vector<auth::Role> &roles) {
+  return auth.WithLock([&](auto &locked_auth) {
+    // Update config
+    locked_auth.SetConfig(std::move(auth_config));
+    // Get all current users
+    auto old_users = locked_auth.AllUsernames();
+    // Save incoming users
+    for (const auto &user : users) {
+      // Missing users
+      try {
+        locked_auth.SaveUser(user);
+      } catch (const auth::AuthException &) {
+        spdlog::debug("SystemRecoveryHandler: Failed to save user");
+        return false;
+      }
+      const auto it = std::find(old_users.begin(), old_users.end(), user.username());
+      if (it != old_users.end()) old_users.erase(it);
+    }
+    // Delete all the leftover users
+    for (const auto &user : old_users) {
+      if (!locked_auth.RemoveUser(user)) {
+        spdlog::debug("SystemRecoveryHandler: Failed to remove user \"{}\".", user);
+        return false;
+      }
+    }
+
+    // Roles are only supported with a license
+    if (license::global_license_checker.IsEnterpriseValidFast()) {
+      // Get all current roles
+      auto old_roles = locked_auth.AllRolenames();
+      // Save incoming users
+      for (const auto &role : roles) {
+        // Missing users
+        try {
+          locked_auth.SaveRole(role);
+        } catch (const auth::AuthException &) {
+          spdlog::debug("SystemRecoveryHandler: Failed to save user");
+          return false;
+        }
+        const auto it = std::find(old_roles.begin(), old_roles.end(), role.rolename());
+        if (it != old_roles.end()) old_roles.erase(it);
+      }
+      // Delete all the leftover users
+      for (const auto &role : old_roles) {
+        if (!locked_auth.RemoveRole(role)) {
+          spdlog::debug("SystemRecoveryHandler: Failed to remove user \"{}\".", role);
+          return false;
+        }
+      }
+    }
+
+    // Success
+    return true;
+  });
+}
+
+void Register(replication::RoleReplicaData const &data, system::ReplicaHandlerAccessToState &system_state_access,
+              auth::SynchedAuth &auth) {
+  // NOTE: Register even without license as the user could add a license at run-time
+  data.server->rpc_server_.Register<replication::UpdateAuthDataRpc>(
+      [&data, system_state_access, &auth](auto *req_reader, auto *res_builder) mutable {
+        spdlog::debug("Received UpdateAuthDataRpc");
+        UpdateAuthDataHandler(system_state_access, data.uuid_, auth, req_reader, res_builder);
+      });
+  data.server->rpc_server_.Register<replication::DropAuthDataRpc>(
+      [&data, system_state_access, &auth](auto *req_reader, auto *res_builder) mutable {
+        spdlog::debug("Received DropAuthDataRpc");
+        DropAuthDataHandler(system_state_access, data.uuid_, auth, req_reader, res_builder);
+      });
+}
+#endif
+
+}  // namespace memgraph::auth

src/auth/replication_handlers.hpp

@@ -0,0 +1,37 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#include "auth/auth.hpp"
+#include "replication/state.hpp"
+#include "slk/streams.hpp"
+#include "system/state.hpp"
+
+namespace memgraph::auth {
+
+void LogWrongMain(const std::optional<utils::UUID> &current_main_uuid, const utils::UUID &main_req_id,
+                  std::string_view rpc_req);
+
+#ifdef MG_ENTERPRISE
+void UpdateAuthDataHandler(system::ReplicaHandlerAccessToState &system_state_access,
+                           const std::optional<utils::UUID> &current_main_uuid, auth::SynchedAuth &auth,
+                           slk::Reader *req_reader, slk::Builder *res_builder);
+void DropAuthDataHandler(system::ReplicaHandlerAccessToState &system_state_access,
+                         const std::optional<utils::UUID> &current_main_uuid, auth::SynchedAuth &auth,
+                         slk::Reader *req_reader, slk::Builder *res_builder);
+
+bool SystemRecoveryHandler(auth::SynchedAuth &auth, auth::Auth::Config auth_config,
+                           const std::vector<auth::User> &users, const std::vector<auth::Role> &roles);
+void Register(replication::RoleReplicaData const &data, system::ReplicaHandlerAccessToState &system_state_access,
+              auth::SynchedAuth &auth);
+#endif
+}  // namespace memgraph::auth

src/auth/rpc.cpp

@@ -0,0 +1,180 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#include "auth/rpc.hpp"
+
+#include <json/json.hpp>
+#include "auth/auth.hpp"
+#include "slk/serialization.hpp"
+#include "slk/streams.hpp"
+#include "utils/enum.hpp"
+
+namespace memgraph::slk {
+// Serialize code for auth::Role
+void Save(const auth::Role &self, Builder *builder) { memgraph::slk::Save(self.Serialize().dump(), builder); }
+
+namespace {
+auth::Role LoadAuthRole(memgraph::slk::Reader *reader) {
+  std::string tmp;
+  memgraph::slk::Load(&tmp, reader);
+  const auto json = nlohmann::json::parse(tmp);
+  return memgraph::auth::Role::Deserialize(json);
+}
+}  // namespace
+// Deserialize code for auth::Role
+void Load(auth::Role *self, memgraph::slk::Reader *reader) { *self = LoadAuthRole(reader); }
+// Special case for optional<Role>
+template <>
+inline void Load<auth::Role>(std::optional<auth::Role> *obj, Reader *reader) {
+  bool exists = false;
+  Load(&exists, reader);
+  if (exists) {
+    obj->emplace(LoadAuthRole(reader));
+  } else {
+    *obj = std::nullopt;
+  }
+}
+
+// Serialize code for auth::User
+void Save(const auth::User &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.Serialize().dump(), builder);
+  std::optional<auth::Role> role{};
+  if (const auto *role_ptr = self.role(); role_ptr) {
+    role.emplace(*role_ptr);
+  }
+  memgraph::slk::Save(role, builder);
+}
+// Deserialize code for auth::User
+void Load(auth::User *self, memgraph::slk::Reader *reader) {
+  std::string tmp;
+  memgraph::slk::Load(&tmp, reader);
+  const auto json = nlohmann::json::parse(tmp);
+  *self = memgraph::auth::User::Deserialize(json);
+  std::optional<auth::Role> role{};
+  memgraph::slk::Load(&role, reader);
+  if (role)
+    self->SetRole(*role);
+  else
+    self->ClearRole();
+}
+
+// Serialize code for auth::Auth::Config
+void Save(const auth::Auth::Config &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.name_regex_str, builder);
+  memgraph::slk::Save(self.password_regex_str, builder);
+  memgraph::slk::Save(self.password_permit_null, builder);
+}
+// Deserialize code for auth::Auth::Config
+void Load(auth::Auth::Config *self, memgraph::slk::Reader *reader) {
+  std::string name_regex_str{};
+  std::string password_regex_str{};
+  bool password_permit_null{};
+
+  memgraph::slk::Load(&name_regex_str, reader);
+  memgraph::slk::Load(&password_regex_str, reader);
+  memgraph::slk::Load(&password_permit_null, reader);
+
+  *self = auth::Auth::Config{std::move(name_regex_str), std::move(password_regex_str), password_permit_null};
+}
+
+// Serialize code for UpdateAuthDataReq
+void Save(const memgraph::replication::UpdateAuthDataReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.main_uuid, builder);
+  memgraph::slk::Save(self.epoch_id, builder);
+  memgraph::slk::Save(self.expected_group_timestamp, builder);
+  memgraph::slk::Save(self.new_group_timestamp, builder);
+  memgraph::slk::Save(self.user, builder);
+  memgraph::slk::Save(self.role, builder);
+}
+void Load(memgraph::replication::UpdateAuthDataReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->main_uuid, reader);
+  memgraph::slk::Load(&self->epoch_id, reader);
+  memgraph::slk::Load(&self->expected_group_timestamp, reader);
+  memgraph::slk::Load(&self->new_group_timestamp, reader);
+  memgraph::slk::Load(&self->user, reader);
+  memgraph::slk::Load(&self->role, reader);
+}
+
+// Serialize code for UpdateAuthDataRes
+void Save(const memgraph::replication::UpdateAuthDataRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.success, builder);
+}
+void Load(memgraph::replication::UpdateAuthDataRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->success, reader);
+}
+
+// Serialize code for DropAuthDataReq
+void Save(const memgraph::replication::DropAuthDataReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.main_uuid, builder);
+  memgraph::slk::Save(self.epoch_id, builder);
+  memgraph::slk::Save(self.expected_group_timestamp, builder);
+  memgraph::slk::Save(self.new_group_timestamp, builder);
+  memgraph::slk::Save(utils::EnumToNum<2, uint8_t>(self.type), builder);
+  memgraph::slk::Save(self.name, builder);
+}
+void Load(memgraph::replication::DropAuthDataReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->main_uuid, reader);
+  memgraph::slk::Load(&self->epoch_id, reader);
+  memgraph::slk::Load(&self->expected_group_timestamp, reader);
+  memgraph::slk::Load(&self->new_group_timestamp, reader);
+  uint8_t type_tmp = 0;
+  memgraph::slk::Load(&type_tmp, reader);
+  if (!utils::NumToEnum<2>(type_tmp, self->type)) {
+    throw SlkReaderException("Unexpected result line:{}!", __LINE__);
+  }
+  memgraph::slk::Load(&self->name, reader);
+}
+
+// Serialize code for DropAuthDataRes
+void Save(const memgraph::replication::DropAuthDataRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.success, builder);
+}
+void Load(memgraph::replication::DropAuthDataRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->success, reader);
+}
+
+}  // namespace memgraph::slk
+
+namespace memgraph::replication {
+
+constexpr utils::TypeInfo UpdateAuthDataReq::kType{utils::TypeId::REP_UPDATE_AUTH_DATA_REQ, "UpdateAuthDataReq",
+                                                   nullptr};
+
+constexpr utils::TypeInfo UpdateAuthDataRes::kType{utils::TypeId::REP_UPDATE_AUTH_DATA_RES, "UpdateAuthDataRes",
+                                                   nullptr};
+
+constexpr utils::TypeInfo DropAuthDataReq::kType{utils::TypeId::REP_DROP_AUTH_DATA_REQ, "DropAuthDataReq", nullptr};
+
+constexpr utils::TypeInfo DropAuthDataRes::kType{utils::TypeId::REP_DROP_AUTH_DATA_RES, "DropAuthDataRes", nullptr};
+
+void UpdateAuthDataReq::Save(const UpdateAuthDataReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+void UpdateAuthDataReq::Load(UpdateAuthDataReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+void UpdateAuthDataRes::Save(const UpdateAuthDataRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+void UpdateAuthDataRes::Load(UpdateAuthDataRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void DropAuthDataReq::Save(const DropAuthDataReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+void DropAuthDataReq::Load(DropAuthDataReq *self, memgraph::slk::Reader *reader) { memgraph::slk::Load(self, reader); }
+void DropAuthDataRes::Save(const DropAuthDataRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+void DropAuthDataRes::Load(DropAuthDataRes *self, memgraph::slk::Reader *reader) { memgraph::slk::Load(self, reader); }
+
+}  // namespace memgraph::replication

src/auth/rpc.hpp

@@ -0,0 +1,127 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#include <optional>
+
+#include "auth/auth.hpp"
+#include "auth/models.hpp"
+#include "rpc/messages.hpp"
+#include "slk/streams.hpp"
+
+namespace memgraph::replication {
+
+struct UpdateAuthDataReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(UpdateAuthDataReq *self, memgraph::slk::Reader *reader);
+  static void Save(const UpdateAuthDataReq &self, memgraph::slk::Builder *builder);
+  UpdateAuthDataReq() = default;
+  UpdateAuthDataReq(const utils::UUID &main_uuid, std::string epoch_id, uint64_t expected_ts, uint64_t new_ts,
+                    auth::User user)
+      : main_uuid(main_uuid),
+        epoch_id{std::move(epoch_id)},
+        expected_group_timestamp{expected_ts},
+        new_group_timestamp{new_ts},
+        user{std::move(user)} {}
+  UpdateAuthDataReq(const utils::UUID &main_uuid, std::string epoch_id, uint64_t expected_ts, uint64_t new_ts,
+                    auth::Role role)
+      : main_uuid(main_uuid),
+        epoch_id{std::move(epoch_id)},
+        expected_group_timestamp{expected_ts},
+        new_group_timestamp{new_ts},
+        role{std::move(role)} {}
+
+  utils::UUID main_uuid;
+  std::string epoch_id;
+  uint64_t expected_group_timestamp;
+  uint64_t new_group_timestamp;
+  std::optional<auth::User> user;
+  std::optional<auth::Role> role;
+};
+
+struct UpdateAuthDataRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(UpdateAuthDataRes *self, memgraph::slk::Reader *reader);
+  static void Save(const UpdateAuthDataRes &self, memgraph::slk::Builder *builder);
+  UpdateAuthDataRes() = default;
+  explicit UpdateAuthDataRes(bool success) : success{success} {}
+
+  bool success;
+};
+
+using UpdateAuthDataRpc = rpc::RequestResponse<UpdateAuthDataReq, UpdateAuthDataRes>;
+
+struct DropAuthDataReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(DropAuthDataReq *self, memgraph::slk::Reader *reader);
+  static void Save(const DropAuthDataReq &self, memgraph::slk::Builder *builder);
+  DropAuthDataReq() = default;
+
+  enum class DataType { USER, ROLE };
+
+  DropAuthDataReq(const utils::UUID &main_uuid, std::string epoch_id, uint64_t expected_ts, uint64_t new_ts,
+                  DataType type, std::string_view name)
+      : main_uuid(main_uuid),
+        epoch_id{std::move(epoch_id)},
+        expected_group_timestamp{expected_ts},
+        new_group_timestamp{new_ts},
+        type{type},
+        name{name} {}
+
+  utils::UUID main_uuid;
+  std::string epoch_id;
+  uint64_t expected_group_timestamp;
+  uint64_t new_group_timestamp;
+  DataType type;
+  std::string name;
+};
+
+struct DropAuthDataRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(DropAuthDataRes *self, memgraph::slk::Reader *reader);
+  static void Save(const DropAuthDataRes &self, memgraph::slk::Builder *builder);
+  DropAuthDataRes() = default;
+  explicit DropAuthDataRes(bool success) : success{success} {}
+
+  bool success;
+};
+
+using DropAuthDataRpc = rpc::RequestResponse<DropAuthDataReq, DropAuthDataRes>;
+
+}  // namespace memgraph::replication
+
+namespace memgraph::slk {
+
+void Save(const auth::Role &self, memgraph::slk::Builder *builder);
+void Load(auth::Role *self, memgraph::slk::Reader *reader);
+void Save(const auth::User &self, memgraph::slk::Builder *builder);
+void Load(auth::User *self, memgraph::slk::Reader *reader);
+void Save(const auth::Auth::Config &self, memgraph::slk::Builder *builder);
+void Load(auth::Auth::Config *self, memgraph::slk::Reader *reader);
+
+void Save(const memgraph::replication::UpdateAuthDataRes &self, memgraph::slk::Builder *builder);
+void Load(memgraph::replication::UpdateAuthDataRes *self, memgraph::slk::Reader *reader);
+void Save(const memgraph::replication::UpdateAuthDataReq & /*self*/, memgraph::slk::Builder * /*builder*/);
+void Load(memgraph::replication::UpdateAuthDataReq * /*self*/, memgraph::slk::Reader * /*reader*/);
+void Save(const memgraph::replication::DropAuthDataRes &self, memgraph::slk::Builder *builder);
+void Load(memgraph::replication::DropAuthDataRes *self, memgraph::slk::Reader *reader);
+void Save(const memgraph::replication::DropAuthDataReq & /*self*/, memgraph::slk::Builder * /*builder*/);
+void Load(memgraph::replication::DropAuthDataReq * /*self*/, memgraph::slk::Reader * /*reader*/);
+}  // namespace memgraph::slk

src/communication/bolt/client.cpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -15,6 +15,9 @@
 #include "communication/bolt/v1/value.hpp"
 #include "utils/logging.hpp"
 
+#include "communication/bolt/v1/fmt.hpp"
+#include "io/network/fmt.hpp"
+
 namespace {
 constexpr uint8_t kBoltV43Version[4] = {0x00, 0x00, 0x03, 0x04};
 constexpr uint8_t kEmptyBoltVersion[4] = {0x00, 0x00, 0x00, 0x00};

src/communication/bolt/v1/fmt.hpp

@@ -0,0 +1,27 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#if FMT_VERSION > 90000
+#include <fmt/ostream.h>
+
+#include "communication/bolt/v1/value.hpp"
+
+template <>
+class fmt::formatter<memgraph::communication::bolt::Value> : public fmt::ostream_formatter {};
+
+template <>
+class fmt::formatter<std::vector<memgraph::communication::bolt::Value>> : public fmt::ostream_formatter {};
+
+template <>
+class fmt::formatter<std::map<std::string, memgraph::communication::bolt::Value>> : public fmt::ostream_formatter {};
+#endif

src/communication/fmt.hpp

@@ -11,11 +11,10 @@
 
 #pragma once
 
-#ifdef MG_ENTERPRISE
+#if FMT_VERSION > 90000
+#include <fmt/ostream.h>
+#include <boost/asio/ip/tcp.hpp>
 
-#include <cstdint>
-
-namespace memgraph::coordination {
-enum class DoFailoverStatus : uint8_t { SUCCESS, ALL_REPLICAS_DOWN, MAIN_ALIVE, RPC_FAILED };
-}  // namespace memgraph::coordination
+template <>
+class fmt::formatter<boost::asio::ip::tcp::endpoint> : public fmt::ostream_formatter {};
 #endif

src/communication/http/listener.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -21,6 +21,7 @@
 #include <boost/beast/core.hpp>
 
 #include "communication/context.hpp"
+#include "communication/fmt.hpp"
 #include "communication/http/session.hpp"
 #include "utils/spin_lock.hpp"
 #include "utils/synchronized.hpp"
@@ -82,7 +83,7 @@ class Listener final : public std::enable_shared_from_this<Listener<TRequestHand
       return;
     }
 
-    spdlog::info("HTTP server is listening on {}:{}", endpoint.address(), endpoint.port());
+    spdlog::info("HTTP server is listening on {}", endpoint);
   }
 
   void DoAccept() {

src/communication/listener.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -23,6 +23,7 @@
 
 #include "communication/session.hpp"
 #include "io/network/epoll.hpp"
+#include "io/network/fmt.hpp"
 #include "io/network/socket.hpp"
 #include "utils/logging.hpp"
 #include "utils/signals.hpp"

src/communication/server.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -22,6 +22,7 @@
 
 #include "communication/init.hpp"
 #include "communication/listener.hpp"
+#include "io/network/fmt.hpp"
 #include "io/network/socket.hpp"
 #include "utils/logging.hpp"
 #include "utils/message.hpp"

src/communication/v2/server.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -26,6 +26,7 @@
 #include <boost/asio/ip/tcp.hpp>
 
 #include "communication/context.hpp"
+#include "communication/fmt.hpp"
 #include "communication/init.hpp"
 #include "communication/v2/listener.hpp"
 #include "communication/v2/pool.hpp"
@@ -129,7 +130,7 @@ bool Server<TSession, TSessionContext>::Start() {
   listener_->Start();
 
   spdlog::info("{} server is fully armed and operational", service_name_);
-  spdlog::info("{} listening on {}", service_name_, endpoint_.address());
+  spdlog::info("{} listening on {}", service_name_, endpoint_);
   context_thread_pool_.Run();
 
   return true;

src/communication/v2/session.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -47,6 +47,7 @@
 #include "communication/buffer.hpp"
 #include "communication/context.hpp"
 #include "communication/exceptions.hpp"
+#include "communication/fmt.hpp"
 #include "dbms/global.hpp"
 #include "utils/event_counter.hpp"
 #include "utils/logging.hpp"
@@ -212,14 +213,11 @@ class WebsocketSession : public std::enable_shared_from_this<WebsocketSession<TS
       session_.Execute();
       DoRead();
     } catch (const SessionClosedException &e) {
-      spdlog::info("{} client {}:{} closed the connection.", service_name_, remote_endpoint_.address(),
-                   remote_endpoint_.port());
+      spdlog::info("{} client {} closed the connection.", service_name_, remote_endpoint_);
       DoClose();
     } catch (const std::exception &e) {
-      spdlog::error(
-          "Exception was thrown while processing event in {} session "
-          "associated with {}:{}",
-          service_name_, remote_endpoint_.address(), remote_endpoint_.port());
+      spdlog::error("Exception was thrown while processing event in {} session associated with {}", service_name_,
+                    remote_endpoint_);
       spdlog::debug("Exception message: {}", e.what());
       DoClose();
     }
@@ -376,8 +374,7 @@ class Session final : public std::enable_shared_from_this<Session<TSession, TSes
       socket.lowest_layer().non_blocking(false);
     });
     timeout_timer_.expires_at(boost::asio::steady_timer::time_point::max());
-    spdlog::info("Accepted a connection from {}: {}:{}", service_name_, remote_endpoint_.address(),
-                 remote_endpoint_.port());
+    spdlog::info("Accepted a connection from {}: {}", service_name_, remote_endpoint_);
   }
 
   void DoRead() {
@@ -437,14 +434,11 @@ class Session final : public std::enable_shared_from_this<Session<TSession, TSes
       session_.Execute();
       DoRead();
     } catch (const SessionClosedException &e) {
-      spdlog::info("{} client {}:{} closed the connection.", service_name_, remote_endpoint_.address(),
-                   remote_endpoint_.port());
+      spdlog::info("{} client {} closed the connection.", service_name_, remote_endpoint_);
       DoShutdown();
     } catch (const std::exception &e) {
-      spdlog::error(
-          "Exception was thrown while processing event in {} session "
-          "associated with {}:{}",
-          service_name_, remote_endpoint_.address(), remote_endpoint_.port());
+      spdlog::error("Exception was thrown while processing event in {} session associated with {}", service_name_,
+                    remote_endpoint_);
       spdlog::debug("Exception message: {}", e.what());
       DoShutdown();
     }

src/communication/websocket/auth.cpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -12,19 +12,44 @@
 #include "communication/websocket/auth.hpp"
 
 #include <string>
+#include "utils/variant_helpers.hpp"
 
 namespace memgraph::communication::websocket {
 
 bool SafeAuth::Authenticate(const std::string &username, const std::string &password) const {
-  return auth_->Lock()->Authenticate(username, password).has_value();
+  user_or_role_ = auth_->Lock()->Authenticate(username, password);
+  return user_or_role_.has_value();
 }
 
-bool SafeAuth::HasUserPermission(const std::string &username, const auth::Permission permission) const {
-  if (const auto user = auth_->ReadLock()->GetUser(username); user) {
-    return user->GetPermissions().Has(permission) == auth::PermissionLevel::GRANT;
+bool SafeAuth::HasPermission(const auth::Permission permission) const {
+  auto locked_auth = auth_->ReadLock();
+  // Update if cache invalidated
+  if (!locked_auth->UpToDate(auth_epoch_) && user_or_role_) {
+    bool success = true;
+    std::visit(utils::Overloaded{[&](auth::User &user) {
+                                   auto tmp = locked_auth->GetUser(user.username());
+                                   if (!tmp) success = false;
+                                   user = std::move(*tmp);
+                                 },
+                                 [&](auth::Role &role) {
+                                   auto tmp = locked_auth->GetRole(role.rolename());
+                                   if (!tmp) success = false;
+                                   role = std::move(*tmp);
+                                 }},
+               *user_or_role_);
+    // Missing user/role; delete from cache
+    if (!success) user_or_role_.reset();
   }
+  // Check permissions
+  if (user_or_role_) {
+    return std::visit(utils::Overloaded{[&](auto &user_or_role) {
+                        return user_or_role.GetPermissions().Has(permission) == auth::PermissionLevel::GRANT;
+                      }},
+                      *user_or_role_);
+  }
+  // NOTE: websocket authenticates only if there is a user, so no need to check if access controlled
   return false;
 }
 
-bool SafeAuth::HasAnyUsers() const { return auth_->ReadLock()->HasUsers(); }
+bool SafeAuth::AccessControlled() const { return auth_->ReadLock()->AccessControlled(); }
 }  // namespace memgraph::communication::websocket

src/communication/websocket/auth.hpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -14,8 +14,6 @@
 #include <string>
 
 #include "auth/auth.hpp"
-#include "utils/spin_lock.hpp"
-#include "utils/synchronized.hpp"
 
 namespace memgraph::communication::websocket {
 
@@ -23,22 +21,24 @@ class AuthenticationInterface {
  public:
   virtual bool Authenticate(const std::string &username, const std::string &password) const = 0;
 
-  virtual bool HasUserPermission(const std::string &username, auth::Permission permission) const = 0;
+  virtual bool HasPermission(auth::Permission permission) const = 0;
 
-  virtual bool HasAnyUsers() const = 0;
+  virtual bool AccessControlled() const = 0;
 };
 
 class SafeAuth : public AuthenticationInterface {
  public:
-  explicit SafeAuth(utils::Synchronized<auth::Auth, utils::WritePrioritizedRWLock> *auth) : auth_{auth} {}
+  explicit SafeAuth(auth::SynchedAuth *auth) : auth_{auth} {}
 
   bool Authenticate(const std::string &username, const std::string &password) const override;
 
-  bool HasUserPermission(const std::string &username, auth::Permission permission) const override;
+  bool HasPermission(auth::Permission permission) const override;
 
-  bool HasAnyUsers() const override;
+  bool AccessControlled() const override;
 
  private:
-  utils::Synchronized<auth::Auth, utils::WritePrioritizedRWLock> *auth_;
+  auth::SynchedAuth *auth_;
+  mutable std::optional<auth::UserOrRole> user_or_role_;
+  mutable auth::Auth::Epoch auth_epoch_{};
 };
 }  // namespace memgraph::communication::websocket

src/communication/websocket/listener.cpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -10,6 +10,7 @@
 // licenses/APL.txt.
 
 #include "communication/websocket/listener.hpp"
+#include "communication/fmt.hpp"
 
 namespace memgraph::communication::websocket {
 namespace {
@@ -61,7 +62,7 @@ Listener::Listener(boost::asio::io_context &ioc, ServerContext *context, tcp::en
     return;
   }
 
-  spdlog::info("WebSocket server is listening on {}:{}", endpoint.address(), endpoint.port());
+  spdlog::info("WebSocket server is listening on {}", endpoint);
 }
 
 void Listener::DoAccept() {

src/communication/websocket/session.cpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -80,7 +80,7 @@ bool Session::Run() {
     return false;
   }
 
-  authenticated_ = !auth_.HasAnyUsers();
+  authenticated_ = !auth_.AccessControlled();
   connected_.store(true, std::memory_order_relaxed);
 
   // run on the strand
@@ -162,7 +162,7 @@ utils::BasicResult<std::string> Session::Authorize(const nlohmann::json &creds)
     return {"Authentication failed!"};
   }
 #ifdef MG_ENTERPRISE
-  if (!auth_.HasUserPermission(creds.at("username").get<std::string>(), auth::Permission::WEBSOCKET)) {
+  if (!auth_.HasPermission(auth::Permission::WEBSOCKET)) {
     return {"Authorization failed!"};
   }
 #endif

src/coordination/CMakeLists.txt

@@ -8,22 +8,34 @@ target_sources(mg-coordination
         include/coordination/coordinator_server.hpp
         include/coordination/coordinator_config.hpp
         include/coordination/coordinator_exceptions.hpp
-        include/coordination/coordinator_instance.hpp
         include/coordination/coordinator_slk.hpp
-        include/coordination/coordinator_data.hpp
-        include/coordination/constants.hpp
-        include/coordination/failover_status.hpp
-        include/coordination/coordinator_cluster_config.hpp
+        include/coordination/coordinator_instance.hpp
+        include/coordination/coordinator_handlers.hpp
+        include/coordination/instance_status.hpp
+        include/coordination/replication_instance.hpp
+        include/coordination/raft_state.hpp
+        include/coordination/rpc_errors.hpp
+
+        include/nuraft/coordinator_log_store.hpp
+        include/nuraft/coordinator_state_machine.hpp
+        include/nuraft/coordinator_state_manager.hpp
 
         PRIVATE
         coordinator_client.cpp
         coordinator_state.cpp
         coordinator_rpc.cpp
         coordinator_server.cpp
-        coordinator_data.cpp
+        coordinator_handlers.cpp
+        coordinator_instance.cpp
+        replication_instance.cpp
+        raft_state.cpp
+
+        coordinator_log_store.cpp
+        coordinator_state_machine.cpp
+        coordinator_state_manager.cpp
 )
 target_include_directories(mg-coordination PUBLIC include)
 
 target_link_libraries(mg-coordination
-    PUBLIC mg::utils mg::rpc mg::slk mg::io mg::repl_coord_glue lib::rangev3 nuraft
+    PUBLIC mg::utils mg::rpc mg::slk mg::io mg::repl_coord_glue lib::rangev3 nuraft mg-replication_handler
 )

src/coordination/coordinator_client.cpp

@@ -9,6 +9,7 @@
 // by the Apache License, Version 2.0, included in the file
 // licenses/APL.txt.
 
+#include "utils/uuid.hpp"
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_client.hpp"
@@ -16,91 +17,156 @@
 #include "coordination/coordinator_config.hpp"
 #include "coordination/coordinator_rpc.hpp"
 #include "replication_coordination_glue/messages.hpp"
+#include "utils/result.hpp"
 
 namespace memgraph::coordination {
 
 namespace {
-auto CreateClientContext(const memgraph::coordination::CoordinatorClientConfig &config)
+auto CreateClientContext(memgraph::coordination::CoordinatorClientConfig const &config)
     -> communication::ClientContext {
   return (config.ssl) ? communication::ClientContext{config.ssl->key_file, config.ssl->cert_file}
                       : communication::ClientContext{};
 }
 }  // namespace
 
-CoordinatorClient::CoordinatorClient(CoordinatorData *coord_data, CoordinatorClientConfig config,
+CoordinatorClient::CoordinatorClient(CoordinatorInstance *coord_instance, CoordinatorClientConfig config,
                                      HealthCheckCallback succ_cb, HealthCheckCallback fail_cb)
     : rpc_context_{CreateClientContext(config)},
       rpc_client_{io::network::Endpoint(io::network::Endpoint::needs_resolving, config.ip_address, config.port),
                   &rpc_context_},
       config_{std::move(config)},
-      coord_data_{coord_data},
+      coord_instance_{coord_instance},
       succ_cb_{std::move(succ_cb)},
       fail_cb_{std::move(fail_cb)} {}
 
 auto CoordinatorClient::InstanceName() const -> std::string { return config_.instance_name; }
 auto CoordinatorClient::SocketAddress() const -> std::string { return rpc_client_.Endpoint().SocketAddress(); }
 
+auto CoordinatorClient::InstanceDownTimeoutSec() const -> std::chrono::seconds {
+  return config_.instance_down_timeout_sec;
+}
+
+auto CoordinatorClient::InstanceGetUUIDFrequencySec() const -> std::chrono::seconds {
+  return config_.instance_get_uuid_frequency_sec;
+}
+
 void CoordinatorClient::StartFrequentCheck() {
-  MG_ASSERT(config_.health_check_frequency_sec > std::chrono::seconds(0),
+  if (instance_checker_.IsRunning()) {
+    return;
+  }
+
+  MG_ASSERT(config_.instance_health_check_frequency_sec > std::chrono::seconds(0),
             "Health check frequency must be greater than 0");
 
   instance_checker_.Run(
-      "Coord checker", config_.health_check_frequency_sec, [this, instance_name = config_.instance_name] {
+      config_.instance_name, config_.instance_health_check_frequency_sec,
+      [this, instance_name = config_.instance_name] {
         try {
           spdlog::trace("Sending frequent heartbeat to machine {} on {}", instance_name,
                         rpc_client_.Endpoint().SocketAddress());
-          auto stream{rpc_client_.Stream<memgraph::replication_coordination_glue::FrequentHeartbeatRpc>()};
-          stream.AwaitResponse();
-          succ_cb_(coord_data_, instance_name);
-        } catch (const rpc::RpcFailedException &) {
-          fail_cb_(coord_data_, instance_name);
+          {  // NOTE: This is intentionally scoped so that stream lock could get released.
+            auto stream{rpc_client_.Stream<memgraph::replication_coordination_glue::FrequentHeartbeatRpc>()};
+            stream.AwaitResponse();
+          }
+          succ_cb_(coord_instance_, instance_name);
+        } catch (rpc::RpcFailedException const &) {
+          fail_cb_(coord_instance_, instance_name);
         }
       });
 }
 
 void CoordinatorClient::StopFrequentCheck() { instance_checker_.Stop(); }
-
 void CoordinatorClient::PauseFrequentCheck() { instance_checker_.Pause(); }
 void CoordinatorClient::ResumeFrequentCheck() { instance_checker_.Resume(); }
 
-auto CoordinatorClient::SetSuccCallback(HealthCheckCallback succ_cb) -> void { succ_cb_ = std::move(succ_cb); }
-auto CoordinatorClient::SetFailCallback(HealthCheckCallback fail_cb) -> void { fail_cb_ = std::move(fail_cb); }
-
-auto CoordinatorClient::ReplicationClientInfo() const -> const CoordinatorClientConfig::ReplicationClientInfo & {
-  return config_.replication_client_info;
+auto CoordinatorClient::SetCallbacks(HealthCheckCallback succ_cb, HealthCheckCallback fail_cb) -> void {
+  succ_cb_ = std::move(succ_cb);
+  fail_cb_ = std::move(fail_cb);
 }
 
-auto CoordinatorClient::ResetReplicationClientInfo() -> void {
-  // TODO (antoniofilipovic) Sync with Andi on this one
-  // config_.replication_client_info.reset();
-}
+auto CoordinatorClient::ReplicationClientInfo() const -> ReplClientInfo { return config_.replication_client_info; }
 
-auto CoordinatorClient::SendPromoteReplicaToMainRpc(
-    std::vector<CoordinatorClientConfig::ReplicationClientInfo> replication_clients_info) const -> bool {
+auto CoordinatorClient::SendPromoteReplicaToMainRpc(const utils::UUID &uuid,
+                                                    ReplicationClientsInfo replication_clients_info) const -> bool {
   try {
-    auto stream{rpc_client_.Stream<PromoteReplicaToMainRpc>(std::move(replication_clients_info))};
+    auto stream{rpc_client_.Stream<PromoteReplicaToMainRpc>(uuid, std::move(replication_clients_info))};
     if (!stream.AwaitResponse().success) {
-      spdlog::error("Failed to receive successful RPC failover response!");
+      spdlog::error("Failed to receive successful PromoteReplicaToMainRpc response!");
       return false;
     }
     return true;
-  } catch (const rpc::RpcFailedException &) {
-    spdlog::error("RPC error occurred while sending failover RPC!");
+  } catch (rpc::RpcFailedException const &) {
+    spdlog::error("RPC error occurred while sending PromoteReplicaToMainRpc!");
   }
   return false;
 }
 
-auto CoordinatorClient::SendSetToReplicaRpc(CoordinatorClient::ReplClientInfo replication_client_info) const -> bool {
+auto CoordinatorClient::DemoteToReplica() const -> bool {
+  auto const &instance_name = config_.instance_name;
   try {
-    auto stream{rpc_client_.Stream<SetMainToReplicaRpc>(std::move(replication_client_info))};
+    auto stream{rpc_client_.Stream<DemoteMainToReplicaRpc>(config_.replication_client_info)};
     if (!stream.AwaitResponse().success) {
-      spdlog::error("Failed to set main to replica!");
+      spdlog::error("Failed to receive successful RPC response for setting instance {} to replica!", instance_name);
       return false;
     }
     spdlog::info("Sent request RPC from coordinator to instance to set it as replica!");
     return true;
+  } catch (rpc::RpcFailedException const &) {
+    spdlog::error("Failed to set instance {} to replica!", instance_name);
+  }
+  return false;
+}
+
+auto CoordinatorClient::SendSwapMainUUIDRpc(const utils::UUID &uuid) const -> bool {
+  try {
+    auto stream{rpc_client_.Stream<replication_coordination_glue::SwapMainUUIDRpc>(uuid)};
+    if (!stream.AwaitResponse().success) {
+      spdlog::error("Failed to receive successful RPC swapping of uuid response!");
+      return false;
+    }
+    return true;
   } catch (const rpc::RpcFailedException &) {
-    spdlog::error("Failed to send failover RPC from coordinator to new main!");
+    spdlog::error("RPC error occurred while sending swapping uuid RPC!");
+  }
+  return false;
+}
+
+auto CoordinatorClient::SendUnregisterReplicaRpc(std::string const &instance_name) const -> bool {
+  try {
+    auto stream{rpc_client_.Stream<UnregisterReplicaRpc>(instance_name)};
+    if (!stream.AwaitResponse().success) {
+      spdlog::error("Failed to receive successful RPC response for unregistering replica!");
+      return false;
+    }
+    return true;
+  } catch (rpc::RpcFailedException const &) {
+    spdlog::error("Failed to unregister replica!");
+  }
+  return false;
+}
+
+auto CoordinatorClient::SendGetInstanceUUIDRpc() const
+    -> utils::BasicResult<GetInstanceUUIDError, std::optional<utils::UUID>> {
+  try {
+    auto stream{rpc_client_.Stream<GetInstanceUUIDRpc>()};
+    auto res = stream.AwaitResponse();
+    return res.uuid;
+  } catch (const rpc::RpcFailedException &) {
+    spdlog::error("RPC error occured while sending GetInstance UUID RPC");
+    return GetInstanceUUIDError::RPC_EXCEPTION;
+  }
+}
+
+auto CoordinatorClient::SendEnableWritingOnMainRpc() const -> bool {
+  try {
+    auto stream{rpc_client_.Stream<EnableWritingOnMainRpc>()};
+    if (!stream.AwaitResponse().success) {
+      spdlog::error("Failed to receive successful RPC response for enabling writing on main!");
+      return false;
+    }
+    return true;
+  } catch (rpc::RpcFailedException const &) {
+    spdlog::error("Failed to enable writing on main!");
   }
   return false;
 }

src/coordination/coordinator_data.cpp

@@ -1,221 +0,0 @@
-// Copyright 2024 Memgraph Ltd.
-//
-// Use of this software is governed by the Business Source License
-// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
-// License, and you may not use this file except in compliance with the Business Source License.
-//
-// As of the Change Date specified in that file, in accordance with
-// the Business Source License, use of this software will be governed
-// by the Apache License, Version 2.0, included in the file
-// licenses/APL.txt.
-
-#include "coordination/coordinator_instance.hpp"
-#include "coordination/register_main_replica_coordinator_status.hpp"
-#ifdef MG_ENTERPRISE
-
-#include "coordination/coordinator_data.hpp"
-
-#include <range/v3/view.hpp>
-#include <shared_mutex>
-#include "libnuraft/nuraft.hxx"
-
-namespace memgraph::coordination {
-
-CoordinatorData::CoordinatorData() {
-  auto find_instance = [](CoordinatorData *coord_data, std::string_view instance_name) -> CoordinatorInstance & {
-    auto instance = std::ranges::find_if(
-        coord_data->registered_instances_,
-        [instance_name](const CoordinatorInstance &instance) { return instance.InstanceName() == instance_name; });
-
-    MG_ASSERT(instance != coord_data->registered_instances_.end(), "Instance {} not found during callback!",
-              instance_name);
-    return *instance;
-  };
-
-  replica_succ_cb_ = [find_instance](CoordinatorData *coord_data, std::string_view instance_name) -> void {
-    auto lock = std::lock_guard{coord_data->coord_data_lock_};
-    spdlog::trace("Instance {} performing replica successful callback", instance_name);
-    auto &instance = find_instance(coord_data, instance_name);
-    MG_ASSERT(instance.IsReplica(), "Instance {} is not a replica!", instance_name);
-    instance.UpdateLastResponseTime();
-  };
-
-  replica_fail_cb_ = [find_instance](CoordinatorData *coord_data, std::string_view instance_name) -> void {
-    auto lock = std::lock_guard{coord_data->coord_data_lock_};
-    spdlog::trace("Instance {} performing replica failure callback", instance_name);
-    auto &instance = find_instance(coord_data, instance_name);
-    MG_ASSERT(instance.IsReplica(), "Instance {} is not a replica!", instance_name);
-    instance.UpdateInstanceStatus();
-  };
-
-  main_succ_cb_ = [find_instance](CoordinatorData *coord_data, std::string_view instance_name) -> void {
-    auto lock = std::lock_guard{coord_data->coord_data_lock_};
-    spdlog::trace("Instance {} performing main successful callback", instance_name);
-    auto &instance = find_instance(coord_data, instance_name);
-    MG_ASSERT(instance.IsMain(), "Instance {} is not a main!", instance_name);
-    instance.UpdateLastResponseTime();
-  };
-
-  main_fail_cb_ = [this, find_instance](CoordinatorData *coord_data, std::string_view instance_name) -> void {
-    auto lock = std::lock_guard{coord_data->coord_data_lock_};
-    spdlog::trace("Instance {} performing main failure callback", instance_name);
-    auto &instance = find_instance(coord_data, instance_name);
-    MG_ASSERT(instance.IsMain(), "Instance {} is not a main!", instance_name);
-    if (bool main_alive = instance.UpdateInstanceStatus(); !main_alive) {
-      spdlog::info("Main instance {} is not alive, starting automatic failover", instance_name);
-      switch (auto failover_status = DoFailover(); failover_status) {
-        using enum DoFailoverStatus;
-        case ALL_REPLICAS_DOWN:
-          spdlog::warn("Failover aborted since all replicas are down!");
-          break;
-        case MAIN_ALIVE:
-          spdlog::warn("Failover aborted since main is alive!");
-          break;
-        case RPC_FAILED:
-          spdlog::warn("Failover aborted since promoting replica to main failed!");
-          break;
-        case SUCCESS:
-          break;
-      }
-    }
-  };
-}
-
-auto CoordinatorData::DoFailover() -> DoFailoverStatus {
-  using ReplicationClientInfo = CoordinatorClientConfig::ReplicationClientInfo;
-
-  auto replica_instances = registered_instances_ | ranges::views::filter(&CoordinatorInstance::IsReplica);
-
-  auto chosen_replica_instance = std::ranges::find_if(replica_instances, &CoordinatorInstance::IsAlive);
-  if (chosen_replica_instance == replica_instances.end()) {
-    return DoFailoverStatus::ALL_REPLICAS_DOWN;
-  }
-
-  chosen_replica_instance->PrepareForFailover();
-
-  std::vector<ReplicationClientInfo> repl_clients_info;
-  repl_clients_info.reserve(std::ranges::distance(replica_instances));
-
-  auto const not_chosen_replica_instance = [&chosen_replica_instance](const CoordinatorInstance &instance) {
-    return instance != *chosen_replica_instance;
-  };
-  auto const not_main = [](const CoordinatorInstance &instance) { return !instance.IsMain(); };
-
-  // TODO (antoniofilipovic): Should we send also data on old MAIN???
-  // TODO: (andi) Don't send replicas which aren't alive
-  for (const auto &unchosen_replica_instance :
-       replica_instances | ranges::views::filter(not_chosen_replica_instance) | ranges::views::filter(not_main)) {
-    repl_clients_info.emplace_back(unchosen_replica_instance.client_.ReplicationClientInfo());
-  }
-
-  if (!chosen_replica_instance->client_.SendPromoteReplicaToMainRpc(std::move(repl_clients_info))) {
-    chosen_replica_instance->RestoreAfterFailedFailover();
-    return DoFailoverStatus::RPC_FAILED;
-  }
-
-  auto old_main = std::ranges::find_if(registered_instances_, &CoordinatorInstance::IsMain);
-  // TODO: (andi) For performing restoration we will have to improve this
-  old_main->client_.PauseFrequentCheck();
-
-  chosen_replica_instance->PostFailover(main_succ_cb_, main_fail_cb_);
-
-  return DoFailoverStatus::SUCCESS;
-}
-
-auto CoordinatorData::ShowInstances() const -> std::vector<CoordinatorInstanceStatus> {
-  std::vector<CoordinatorInstanceStatus> instances_status;
-  instances_status.reserve(registered_instances_.size());
-
-  auto const stringify_repl_role = [](const CoordinatorInstance &instance) -> std::string {
-    if (!instance.IsAlive()) return "";
-    if (instance.IsMain()) return "main";
-    return "replica";
-  };
-
-  auto const instance_to_status =
-      [&stringify_repl_role](const CoordinatorInstance &instance) -> CoordinatorInstanceStatus {
-    return {.instance_name = instance.InstanceName(),
-            .socket_address = instance.SocketAddress(),
-            .replication_role = stringify_repl_role(instance),
-            .is_alive = instance.IsAlive()};
-  };
-
-  {
-    auto lock = std::shared_lock{coord_data_lock_};
-    std::ranges::transform(registered_instances_, std::back_inserter(instances_status), instance_to_status);
-  }
-
-  return instances_status;
-}
-
-auto CoordinatorData::SetInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus {
-  auto lock = std::lock_guard{coord_data_lock_};
-
-  // Find replica we already registered
-  auto registered_replica = std::find_if(
-      registered_instances_.begin(), registered_instances_.end(),
-      [instance_name](const CoordinatorInstance &instance) { return instance.InstanceName() == instance_name; });
-
-  // if replica not found...
-  if (registered_replica == registered_instances_.end()) {
-    spdlog::error("You didn't register instance with given name {}", instance_name);
-    return SetInstanceToMainCoordinatorStatus::NO_INSTANCE_WITH_NAME;
-  }
-
-  registered_replica->client_.PauseFrequentCheck();
-
-  std::vector<CoordinatorClientConfig::ReplicationClientInfo> repl_clients_info;
-  repl_clients_info.reserve(registered_instances_.size() - 1);
-  std::ranges::for_each(registered_instances_,
-                        [registered_replica, &repl_clients_info](const CoordinatorInstance &replica) {
-                          if (replica != *registered_replica) {
-                            repl_clients_info.emplace_back(replica.client_.ReplicationClientInfo());
-                          }
-                        });
-
-  // PROMOTE REPLICA TO MAIN
-  // THIS SHOULD FAIL HERE IF IT IS DOWN
-  if (auto result = registered_replica->client_.SendPromoteReplicaToMainRpc(std::move(repl_clients_info)); !result) {
-    registered_replica->client_.ResumeFrequentCheck();
-    return SetInstanceToMainCoordinatorStatus::COULD_NOT_PROMOTE_TO_MAIN;
-  }
-
-  registered_replica->client_.SetSuccCallback(main_succ_cb_);
-  registered_replica->client_.SetFailCallback(main_fail_cb_);
-  registered_replica->replication_role_ = replication_coordination_glue::ReplicationRole::MAIN;
-  registered_replica->client_.ResumeFrequentCheck();
-
-  return SetInstanceToMainCoordinatorStatus::SUCCESS;
-}
-
-auto CoordinatorData::RegisterInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus {
-  auto lock = std::lock_guard{coord_data_lock_};
-  if (std::ranges::any_of(registered_instances_, [&config](const CoordinatorInstance &instance) {
-        return instance.InstanceName() == config.instance_name;
-      })) {
-    return RegisterInstanceCoordinatorStatus::NAME_EXISTS;
-  }
-
-  if (std::ranges::any_of(registered_instances_, [&config](const CoordinatorInstance &instance) {
-        spdlog::trace("Comparing {} with {}", instance.SocketAddress(), config.SocketAddress());
-        return instance.SocketAddress() == config.SocketAddress();
-      })) {
-    return RegisterInstanceCoordinatorStatus::END_POINT_EXISTS;
-  }
-
-  CoordinatorClientConfig::ReplicationClientInfo replication_client_info_copy = config.replication_client_info;
-
-  // TODO (antoniofilipovic) create and then push back
-  auto *instance = &registered_instances_.emplace_back(this, std::move(config), replica_succ_cb_, replica_fail_cb_,
-                                                       replication_coordination_glue::ReplicationRole::REPLICA);
-  if (auto res = instance->client_.SendSetToReplicaRpc(replication_client_info_copy); !res) {
-    return RegisterInstanceCoordinatorStatus::RPC_FAILED;
-  }
-
-  instance->client_.StartFrequentCheck();
-
-  return RegisterInstanceCoordinatorStatus::SUCCESS;
-}
-
-}  // namespace memgraph::coordination
-#endif

src/coordination/coordinator_handlers.cpp

@@ -0,0 +1,218 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+#include "coordination/coordinator_handlers.hpp"
+
+#include <range/v3/view.hpp>
+
+#include "coordination/coordinator_rpc.hpp"
+#include "coordination/include/coordination/coordinator_server.hpp"
+#include "replication/state.hpp"
+
+namespace memgraph::dbms {
+
+void CoordinatorHandlers::Register(memgraph::coordination::CoordinatorServer &server,
+                                   replication::ReplicationHandler &replication_handler) {
+  server.Register<coordination::PromoteReplicaToMainRpc>(
+      [&](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received PromoteReplicaToMainRpc");
+        CoordinatorHandlers::PromoteReplicaToMainHandler(replication_handler, req_reader, res_builder);
+      });
+
+  server.Register<coordination::DemoteMainToReplicaRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received DemoteMainToReplicaRpc from coordinator server");
+        CoordinatorHandlers::DemoteMainToReplicaHandler(replication_handler, req_reader, res_builder);
+      });
+
+  server.Register<replication_coordination_glue::SwapMainUUIDRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received SwapMainUUIDRPC on coordinator server");
+        CoordinatorHandlers::SwapMainUUIDHandler(replication_handler, req_reader, res_builder);
+      });
+
+  server.Register<coordination::UnregisterReplicaRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received UnregisterReplicaRpc on coordinator server");
+        CoordinatorHandlers::UnregisterReplicaHandler(replication_handler, req_reader, res_builder);
+      });
+
+  server.Register<coordination::EnableWritingOnMainRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received EnableWritingOnMainRpc on coordinator server");
+        CoordinatorHandlers::EnableWritingOnMainHandler(replication_handler, req_reader, res_builder);
+      });
+
+  server.Register<coordination::GetInstanceUUIDRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received GetInstanceUUIDRpc on coordinator server");
+        CoordinatorHandlers::GetInstanceUUIDHandler(replication_handler, req_reader, res_builder);
+      });
+}
+
+void CoordinatorHandlers::SwapMainUUIDHandler(replication::ReplicationHandler &replication_handler,
+                                              slk::Reader *req_reader, slk::Builder *res_builder) {
+  if (!replication_handler.IsReplica()) {
+    spdlog::error("Setting main uuid must be performed on replica.");
+    slk::Save(replication_coordination_glue::SwapMainUUIDRes{false}, res_builder);
+    return;
+  }
+
+  replication_coordination_glue::SwapMainUUIDReq req;
+  slk::Load(&req, req_reader);
+  spdlog::info(fmt::format("Set replica data UUID  to main uuid {}", std::string(req.uuid)));
+  std::get<memgraph::replication::RoleReplicaData>(replication_handler.GetReplState().ReplicationData()).uuid_ =
+      req.uuid;
+
+  slk::Save(replication_coordination_glue::SwapMainUUIDRes{true}, res_builder);
+}
+
+void CoordinatorHandlers::DemoteMainToReplicaHandler(replication::ReplicationHandler &replication_handler,
+                                                     slk::Reader *req_reader, slk::Builder *res_builder) {
+  spdlog::info("Executing DemoteMainToReplicaHandler");
+
+  coordination::DemoteMainToReplicaReq req;
+  slk::Load(&req, req_reader);
+
+  const replication::ReplicationServerConfig clients_config{
+      .ip_address = req.replication_client_info.replication_ip_address,
+      .port = req.replication_client_info.replication_port};
+
+  if (!replication_handler.SetReplicationRoleReplica(clients_config, std::nullopt)) {
+    spdlog::error("Demoting main to replica failed!");
+    slk::Save(coordination::DemoteMainToReplicaRes{false}, res_builder);
+    return;
+  }
+
+  slk::Save(coordination::DemoteMainToReplicaRes{true}, res_builder);
+}
+
+void CoordinatorHandlers::GetInstanceUUIDHandler(replication::ReplicationHandler &replication_handler,
+                                                 slk::Reader * /*req_reader*/, slk::Builder *res_builder) {
+  spdlog::info("Executing GetInstanceUUIDHandler");
+
+  slk::Save(coordination::GetInstanceUUIDRes{replication_handler.GetReplicaUUID()}, res_builder);
+}
+
+void CoordinatorHandlers::PromoteReplicaToMainHandler(replication::ReplicationHandler &replication_handler,
+                                                      slk::Reader *req_reader, slk::Builder *res_builder) {
+  if (!replication_handler.IsReplica()) {
+    spdlog::error("Failover must be performed on replica!");
+    slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+    return;
+  }
+  coordination::PromoteReplicaToMainReq req;
+  slk::Load(&req, req_reader);
+
+  // This can fail because of disk. If it does, the cluster state could get inconsistent.
+  // We don't handle disk issues.
+  if (const bool success = replication_handler.DoReplicaToMainPromotion(req.main_uuid_); !success) {
+    spdlog::error("Promoting replica to main failed!");
+    slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+    return;
+  }
+
+  auto const converter = [](const auto &repl_info_config) {
+    return replication::ReplicationClientConfig{
+        .name = repl_info_config.instance_name,
+        .mode = repl_info_config.replication_mode,
+        .ip_address = repl_info_config.replication_ip_address,
+        .port = repl_info_config.replication_port,
+    };
+  };
+
+  // registering replicas
+  for (auto const &config : req.replication_clients_info | ranges::views::transform(converter)) {
+    auto instance_client = replication_handler.RegisterReplica(config);
+    if (instance_client.HasError()) {
+      using enum memgraph::replication::RegisterReplicaError;
+      switch (instance_client.GetError()) {
+        // Can't happen, checked on the coordinator side
+        case memgraph::query::RegisterReplicaError::NAME_EXISTS:
+          spdlog::error("Replica with the same name already exists!");
+          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+          return;
+        // Can't happen, checked on the coordinator side
+        case memgraph::query::RegisterReplicaError::ENDPOINT_EXISTS:
+          spdlog::error("Replica with the same endpoint already exists!");
+          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+          return;
+        // We don't handle disk issues
+        case memgraph::query::RegisterReplicaError::COULD_NOT_BE_PERSISTED:
+          spdlog::error("Registered replica could not be persisted!");
+          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+          return;
+        case memgraph::query::RegisterReplicaError::ERROR_ACCEPTING_MAIN:
+          spdlog::error("Replica didn't accept change of main!");
+          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
+          return;
+        case memgraph::query::RegisterReplicaError::CONNECTION_FAILED:
+          // Connection failure is not a fatal error
+          break;
+      }
+    }
+  }
+  spdlog::info("Promote replica to main was success {}", std::string(req.main_uuid_));
+  slk::Save(coordination::PromoteReplicaToMainRes{true}, res_builder);
+}
+
+void CoordinatorHandlers::UnregisterReplicaHandler(replication::ReplicationHandler &replication_handler,
+                                                   slk::Reader *req_reader, slk::Builder *res_builder) {
+  if (!replication_handler.IsMain()) {
+    spdlog::error("Unregistering replica must be performed on main.");
+    slk::Save(coordination::UnregisterReplicaRes{false}, res_builder);
+    return;
+  }
+
+  coordination::UnregisterReplicaReq req;
+  slk::Load(&req, req_reader);
+
+  auto res = replication_handler.UnregisterReplica(req.instance_name);
+  switch (res) {
+    using enum memgraph::query::UnregisterReplicaResult;
+    case SUCCESS:
+      slk::Save(coordination::UnregisterReplicaRes{true}, res_builder);
+      break;
+    case NOT_MAIN:
+      spdlog::error("Unregistering replica must be performed on main.");
+      slk::Save(coordination::UnregisterReplicaRes{false}, res_builder);
+      break;
+    case CAN_NOT_UNREGISTER:
+      spdlog::error("Could not unregister replica.");
+      slk::Save(coordination::UnregisterReplicaRes{false}, res_builder);
+      break;
+    case COULD_NOT_BE_PERSISTED:
+      spdlog::error("Could not persist replica unregistration.");
+      slk::Save(coordination::UnregisterReplicaRes{false}, res_builder);
+      break;
+  }
+}
+
+void CoordinatorHandlers::EnableWritingOnMainHandler(replication::ReplicationHandler &replication_handler,
+                                                     slk::Reader * /*req_reader*/, slk::Builder *res_builder) {
+  if (!replication_handler.IsMain()) {
+    spdlog::error("Enable writing on main must be performed on main!");
+    slk::Save(coordination::EnableWritingOnMainRes{false}, res_builder);
+    return;
+  }
+
+  if (!replication_handler.GetReplState().EnableWritingOnMain()) {
+    spdlog::error("Enabling writing on main failed!");
+    slk::Save(coordination::EnableWritingOnMainRes{false}, res_builder);
+    return;
+  }
+
+  slk::Save(coordination::EnableWritingOnMainRes{true}, res_builder);
+}
+
+}  // namespace memgraph::dbms
+#endif

src/coordination/coordinator_instance.cpp

@@ -0,0 +1,347 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_instance.hpp"
+
+#include "coordination/coordinator_exceptions.hpp"
+#include "coordination/fmt.hpp"
+#include "nuraft/coordinator_state_machine.hpp"
+#include "nuraft/coordinator_state_manager.hpp"
+#include "utils/counter.hpp"
+#include "utils/functional.hpp"
+
+#include <range/v3/view.hpp>
+#include <shared_mutex>
+
+namespace memgraph::coordination {
+
+using nuraft::ptr;
+using nuraft::srv_config;
+
+CoordinatorInstance::CoordinatorInstance()
+    : raft_state_(RaftState::MakeRaftState(
+          [this] { std::ranges::for_each(repl_instances_, &ReplicationInstance::StartFrequentCheck); },
+          [this] { std::ranges::for_each(repl_instances_, &ReplicationInstance::StopFrequentCheck); })) {
+  auto find_repl_instance = [](CoordinatorInstance *self,
+                               std::string_view repl_instance_name) -> ReplicationInstance & {
+    auto repl_instance =
+        std::ranges::find_if(self->repl_instances_, [repl_instance_name](ReplicationInstance const &instance) {
+          return instance.InstanceName() == repl_instance_name;
+        });
+
+    MG_ASSERT(repl_instance != self->repl_instances_.end(), "Instance {} not found during callback!",
+              repl_instance_name);
+    return *repl_instance;
+  };
+
+  replica_succ_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+    auto lock = std::lock_guard{self->coord_instance_lock_};
+    spdlog::trace("Instance {} performing replica successful callback", repl_instance_name);
+    auto &repl_instance = find_repl_instance(self, repl_instance_name);
+
+    // We need to get replicas UUID from time to time to ensure replica is listening to correct main
+    // and that it didn't go down for less time than we could notice
+    // We need to get id of main replica is listening to
+    // and swap if necessary
+    if (!repl_instance.EnsureReplicaHasCorrectMainUUID(self->GetMainUUID())) {
+      spdlog::error("Failed to swap uuid for replica instance {} which is alive", repl_instance.InstanceName());
+      return;
+    }
+
+    repl_instance.OnSuccessPing();
+  };
+
+  replica_fail_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+    auto lock = std::lock_guard{self->coord_instance_lock_};
+    spdlog::trace("Instance {} performing replica failure callback", repl_instance_name);
+    auto &repl_instance = find_repl_instance(self, repl_instance_name);
+    repl_instance.OnFailPing();
+  };
+
+  main_succ_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+    auto lock = std::lock_guard{self->coord_instance_lock_};
+    spdlog::trace("Instance {} performing main successful callback", repl_instance_name);
+
+    auto &repl_instance = find_repl_instance(self, repl_instance_name);
+
+    if (repl_instance.IsAlive()) {
+      repl_instance.OnSuccessPing();
+      return;
+    }
+
+    const auto &repl_instance_uuid = repl_instance.GetMainUUID();
+    MG_ASSERT(repl_instance_uuid.has_value(), "Instance must have uuid set.");
+
+    auto const curr_main_uuid = self->GetMainUUID();
+    if (curr_main_uuid == repl_instance_uuid.value()) {
+      if (!repl_instance.EnableWritingOnMain()) {
+        spdlog::error("Failed to enable writing on main instance {}", repl_instance_name);
+        return;
+      }
+
+      repl_instance.OnSuccessPing();
+      return;
+    }
+
+    // TODO(antoniof) make demoteToReplica idempotent since main can be demoted to replica but
+    // swapUUID can fail
+    if (repl_instance.DemoteToReplica(self->replica_succ_cb_, self->replica_fail_cb_)) {
+      repl_instance.OnSuccessPing();
+      spdlog::info("Instance {} demoted to replica", repl_instance_name);
+    } else {
+      spdlog::error("Instance {} failed to become replica", repl_instance_name);
+      return;
+    }
+
+    if (!repl_instance.SendSwapAndUpdateUUID(curr_main_uuid)) {
+      spdlog::error(fmt::format("Failed to swap uuid for demoted main instance {}", repl_instance.InstanceName()));
+      return;
+    }
+  };
+
+  main_fail_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+    auto lock = std::lock_guard{self->coord_instance_lock_};
+    spdlog::trace("Instance {} performing main failure callback", repl_instance_name);
+    auto &repl_instance = find_repl_instance(self, repl_instance_name);
+    repl_instance.OnFailPing();
+    const auto &repl_instance_uuid = repl_instance.GetMainUUID();
+    MG_ASSERT(repl_instance_uuid.has_value(), "Instance must have uuid set");
+
+    if (!repl_instance.IsAlive() && self->GetMainUUID() == repl_instance_uuid.value()) {
+      spdlog::info("Cluster without main instance, trying automatic failover");
+      self->TryFailover();  // TODO: (andi) Initiate failover
+    }
+  };
+}
+
+auto CoordinatorInstance::ShowInstances() const -> std::vector<InstanceStatus> {
+  auto const coord_instances = raft_state_.GetAllCoordinators();
+
+  auto const stringify_repl_role = [](ReplicationInstance const &instance) -> std::string {
+    if (!instance.IsAlive()) return "unknown";
+    if (instance.IsMain()) return "main";
+    return "replica";
+  };
+
+  auto const repl_instance_to_status = [&stringify_repl_role](ReplicationInstance const &instance) -> InstanceStatus {
+    return {.instance_name = instance.InstanceName(),
+            .coord_socket_address = instance.SocketAddress(),
+            .cluster_role = stringify_repl_role(instance),
+            .is_alive = instance.IsAlive()};
+  };
+
+  auto const coord_instance_to_status = [](ptr<srv_config> const &instance) -> InstanceStatus {
+    return {.instance_name = "coordinator_" + std::to_string(instance->get_id()),
+            .raft_socket_address = instance->get_endpoint(),
+            .cluster_role = "coordinator",
+            .is_alive = true};  // TODO: (andi) Get this info from RAFT and test it or when we will move
+                                // CoordinatorState to every instance, we can be smarter about this using our RPC.
+  };
+
+  auto instances_status = utils::fmap(coord_instance_to_status, coord_instances);
+  {
+    auto lock = std::shared_lock{coord_instance_lock_};
+    std::ranges::transform(repl_instances_, std::back_inserter(instances_status), repl_instance_to_status);
+  }
+
+  return instances_status;
+}
+
+auto CoordinatorInstance::TryFailover() -> void {
+  auto alive_replicas = repl_instances_ | ranges::views::filter(&ReplicationInstance::IsReplica) |
+                        ranges::views::filter(&ReplicationInstance::IsAlive);
+
+  if (ranges::empty(alive_replicas)) {
+    spdlog::warn("Failover failed since all replicas are down!");
+    return;
+  }
+
+  // TODO: Smarter choice
+  auto new_main = ranges::begin(alive_replicas);
+
+  new_main->PauseFrequentCheck();
+  utils::OnScopeExit scope_exit{[&new_main] { new_main->ResumeFrequentCheck(); }};
+
+  auto const is_not_new_main = [&new_main](ReplicationInstance &instance) {
+    return instance.InstanceName() != new_main->InstanceName();
+  };
+
+  auto const new_main_uuid = utils::UUID{};
+  // If for some replicas swap fails, for others on successful ping we will revert back on next change
+  // or we will do failover first again and then it will be consistent again
+  for (auto &other_replica_instance : alive_replicas | ranges::views::filter(is_not_new_main)) {
+    if (!other_replica_instance.SendSwapAndUpdateUUID(new_main_uuid)) {
+      spdlog::error(fmt::format("Failed to swap uuid for instance {} which is alive, aborting failover",
+                                other_replica_instance.InstanceName()));
+      return;
+    }
+  }
+
+  auto repl_clients_info = repl_instances_ | ranges::views::filter(is_not_new_main) |
+                           ranges::views::transform(&ReplicationInstance::ReplicationClientInfo) |
+                           ranges::to<ReplicationClientsInfo>();
+
+  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), main_succ_cb_, main_fail_cb_)) {
+    spdlog::warn("Failover failed since promoting replica to main failed!");
+    return;
+  }
+  // TODO: (andi) This should be replicated across all coordinator instances with Raft log
+  SetMainUUID(new_main_uuid);
+  spdlog::info("Failover successful! Instance {} promoted to main.", new_main->InstanceName());
+}
+
+// TODO: (andi) Make sure you cannot put coordinator instance to the main
+auto CoordinatorInstance::SetReplicationInstanceToMain(std::string instance_name)
+    -> SetInstanceToMainCoordinatorStatus {
+  auto lock = std::lock_guard{coord_instance_lock_};
+
+  if (std::ranges::any_of(repl_instances_, &ReplicationInstance::IsMain)) {
+    return SetInstanceToMainCoordinatorStatus::MAIN_ALREADY_EXISTS;
+  }
+
+  auto const is_new_main = [&instance_name](ReplicationInstance const &instance) {
+    return instance.InstanceName() == instance_name;
+  };
+  auto new_main = std::ranges::find_if(repl_instances_, is_new_main);
+
+  if (new_main == repl_instances_.end()) {
+    spdlog::error("Instance {} not registered. Please register it using REGISTER INSTANCE {}", instance_name,
+                  instance_name);
+    return SetInstanceToMainCoordinatorStatus::NO_INSTANCE_WITH_NAME;
+  }
+
+  new_main->PauseFrequentCheck();
+  utils::OnScopeExit scope_exit{[&new_main] { new_main->ResumeFrequentCheck(); }};
+
+  auto const is_not_new_main = [&instance_name](ReplicationInstance const &instance) {
+    return instance.InstanceName() != instance_name;
+  };
+
+  auto const new_main_uuid = utils::UUID{};
+
+  for (auto &other_instance : repl_instances_ | ranges::views::filter(is_not_new_main)) {
+    if (!other_instance.SendSwapAndUpdateUUID(new_main_uuid)) {
+      spdlog::error(
+          fmt::format("Failed to swap uuid for instance {}, aborting failover", other_instance.InstanceName()));
+      return SetInstanceToMainCoordinatorStatus::SWAP_UUID_FAILED;
+    }
+  }
+
+  ReplicationClientsInfo repl_clients_info;
+  repl_clients_info.reserve(repl_instances_.size() - 1);
+  std::ranges::transform(repl_instances_ | ranges::views::filter(is_not_new_main),
+                         std::back_inserter(repl_clients_info), &ReplicationInstance::ReplicationClientInfo);
+
+  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), main_succ_cb_, main_fail_cb_)) {
+    return SetInstanceToMainCoordinatorStatus::COULD_NOT_PROMOTE_TO_MAIN;
+  }
+
+  // TODO: (andi) This should be replicated across all coordinator instances with Raft log
+  SetMainUUID(new_main_uuid);
+  spdlog::info("Instance {} promoted to main", instance_name);
+  return SetInstanceToMainCoordinatorStatus::SUCCESS;
+}
+
+auto CoordinatorInstance::RegisterReplicationInstance(CoordinatorClientConfig config)
+    -> RegisterInstanceCoordinatorStatus {
+  auto lock = std::lock_guard{coord_instance_lock_};
+
+  auto instance_name = config.instance_name;
+
+  auto const name_matches = [&instance_name](ReplicationInstance const &instance) {
+    return instance.InstanceName() == instance_name;
+  };
+
+  if (std::ranges::any_of(repl_instances_, name_matches)) {
+    return RegisterInstanceCoordinatorStatus::NAME_EXISTS;
+  }
+
+  auto const socket_address_matches = [&config](ReplicationInstance const &instance) {
+    return instance.SocketAddress() == config.SocketAddress();
+  };
+
+  if (std::ranges::any_of(repl_instances_, socket_address_matches)) {
+    return RegisterInstanceCoordinatorStatus::ENDPOINT_EXISTS;
+  }
+
+  if (!raft_state_.RequestLeadership()) {
+    return RegisterInstanceCoordinatorStatus::NOT_LEADER;
+  }
+
+  auto const res = raft_state_.AppendRegisterReplicationInstance(instance_name);
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for registering instance {}. Most likely the reason is that the instance is not "
+        "the "
+        "leader.",
+        config.instance_name);
+    return RegisterInstanceCoordinatorStatus::RAFT_COULD_NOT_ACCEPT;
+  }
+
+  spdlog::info("Request for registering instance {} accepted", instance_name);
+  try {
+    repl_instances_.emplace_back(this, std::move(config), replica_succ_cb_, replica_fail_cb_);
+  } catch (CoordinatorRegisterInstanceException const &) {
+    return RegisterInstanceCoordinatorStatus::RPC_FAILED;
+  }
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to register instance {} with error code {}", instance_name, res->get_result_code());
+    return RegisterInstanceCoordinatorStatus::RAFT_COULD_NOT_APPEND;
+  }
+
+  spdlog::info("Instance {} registered", instance_name);
+  return RegisterInstanceCoordinatorStatus::SUCCESS;
+}
+
+auto CoordinatorInstance::UnregisterReplicationInstance(std::string instance_name)
+    -> UnregisterInstanceCoordinatorStatus {
+  auto lock = std::lock_guard{coord_instance_lock_};
+
+  auto const name_matches = [&instance_name](ReplicationInstance const &instance) {
+    return instance.InstanceName() == instance_name;
+  };
+
+  auto inst_to_remove = std::ranges::find_if(repl_instances_, name_matches);
+  if (inst_to_remove == repl_instances_.end()) {
+    return UnregisterInstanceCoordinatorStatus::NO_INSTANCE_WITH_NAME;
+  }
+
+  if (inst_to_remove->IsMain() && inst_to_remove->IsAlive()) {
+    return UnregisterInstanceCoordinatorStatus::IS_MAIN;
+  }
+
+  inst_to_remove->StopFrequentCheck();
+  auto curr_main = std::ranges::find_if(repl_instances_, &ReplicationInstance::IsMain);
+  MG_ASSERT(curr_main != repl_instances_.end(), "There must be a main instance when unregistering a replica");
+  if (!curr_main->SendUnregisterReplicaRpc(instance_name)) {
+    inst_to_remove->StartFrequentCheck();
+    return UnregisterInstanceCoordinatorStatus::RPC_FAILED;
+  }
+  std::erase_if(repl_instances_, name_matches);
+
+  return UnregisterInstanceCoordinatorStatus::SUCCESS;
+}
+
+auto CoordinatorInstance::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
+    -> void {
+  raft_state_.AddCoordinatorInstance(raft_server_id, raft_port, std::move(raft_address));
+}
+
+auto CoordinatorInstance::GetMainUUID() const -> utils::UUID { return main_uuid_; }
+
+// TODO: (andi) Add to the RAFT log.
+auto CoordinatorInstance::SetMainUUID(utils::UUID new_uuid) -> void { main_uuid_ = new_uuid; }
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/coordinator_log_store.cpp

@@ -0,0 +1,201 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "nuraft/coordinator_log_store.hpp"
+
+#include "coordination/coordinator_exceptions.hpp"
+#include "utils/logging.hpp"
+
+namespace memgraph::coordination {
+
+using nuraft::cs_new;
+
+namespace {
+
+ptr<log_entry> MakeClone(const ptr<log_entry> &entry) {
+  return cs_new<log_entry>(entry->get_term(), buffer::clone(entry->get_buf()), entry->get_val_type(),
+                           entry->get_timestamp());
+}
+
+}  // namespace
+
+CoordinatorLogStore::CoordinatorLogStore() : start_idx_(1) {
+  ptr<buffer> buf = buffer::alloc(sizeof(uint64_t));
+  logs_[0] = cs_new<log_entry>(0, buf);
+}
+
+CoordinatorLogStore::~CoordinatorLogStore() {}
+
+auto CoordinatorLogStore::FindOrDefault_(uint64_t index) const -> ptr<log_entry> {
+  auto entry = logs_.find(index);
+  if (entry == logs_.end()) {
+    entry = logs_.find(0);
+  }
+  return entry->second;
+}
+
+uint64_t CoordinatorLogStore::next_slot() const {
+  auto lock = std::lock_guard{logs_lock_};
+  return start_idx_ + logs_.size() - 1;
+}
+
+uint64_t CoordinatorLogStore::start_index() const { return start_idx_; }
+
+ptr<log_entry> CoordinatorLogStore::last_entry() const {
+  auto lock = std::lock_guard{logs_lock_};
+
+  uint64_t const last_idx = start_idx_ + logs_.size() - 1;
+  auto const last_src = FindOrDefault_(last_idx - 1);
+
+  return MakeClone(last_src);
+}
+
+uint64_t CoordinatorLogStore::append(ptr<log_entry> &entry) {
+  ptr<log_entry> clone = MakeClone(entry);
+  uint64_t next_slot{0};
+  {
+    auto lock = std::lock_guard{logs_lock_};
+    next_slot = start_idx_ + logs_.size() - 1;
+    logs_[next_slot] = clone;
+  }
+  return next_slot;
+}
+
+void CoordinatorLogStore::write_at(uint64_t index, ptr<log_entry> &entry) {
+  ptr<log_entry> clone = MakeClone(entry);
+
+  // Discard all logs equal to or greater than `index.
+  {
+    auto lock = std::lock_guard{logs_lock_};
+    auto itr = logs_.lower_bound(index);
+    while (itr != logs_.end()) {
+      itr = logs_.erase(itr);
+    }
+    logs_[index] = clone;
+  }
+}
+
+ptr<std::vector<ptr<log_entry>>> CoordinatorLogStore::log_entries(uint64_t start, uint64_t end) {
+  auto ret = cs_new<std::vector<ptr<log_entry>>>();
+  ret->resize(end - start);
+
+  for (uint64_t i = start, curr_index = 0; i < end; ++i, ++curr_index) {
+    ptr<log_entry> src = nullptr;
+    {
+      auto lock = std::lock_guard{logs_lock_};
+      if (auto const entry = logs_.find(i); entry != logs_.end()) {
+        src = entry->second;
+      } else {
+        throw RaftCouldNotFindEntryException("Could not find entry at index {}", i);
+      }
+    }
+    (*ret)[curr_index] = MakeClone(src);
+  }
+  return ret;
+}
+
+ptr<log_entry> CoordinatorLogStore::entry_at(uint64_t index) {
+  ptr<log_entry> src = nullptr;
+  {
+    auto lock = std::lock_guard{logs_lock_};
+    src = FindOrDefault_(index);
+  }
+  return MakeClone(src);
+}
+
+uint64_t CoordinatorLogStore::term_at(uint64_t index) {
+  uint64_t term = 0;
+  {
+    auto lock = std::lock_guard{logs_lock_};
+    term = FindOrDefault_(index)->get_term();
+  }
+  return term;
+}
+
+ptr<buffer> CoordinatorLogStore::pack(uint64_t index, int32 cnt) {
+  std::vector<ptr<buffer>> logs;
+
+  size_t size_total = 0;
+  uint64_t const end_index = index + cnt;
+  for (uint64_t i = index; i < end_index; ++i) {
+    ptr<log_entry> le = nullptr;
+    {
+      auto lock = std::lock_guard{logs_lock_};
+      le = logs_[i];
+    }
+    MG_ASSERT(le.get(), "Could not find log entry at index {}", i);
+    auto buf = le->serialize();
+    size_total += buf->size();
+    logs.push_back(buf);
+  }
+
+  auto buf_out = buffer::alloc(sizeof(int32) + cnt * sizeof(int32) + size_total);
+  buf_out->pos(0);
+  buf_out->put((int32)cnt);
+
+  for (auto &entry : logs) {
+    buf_out->put(static_cast<int32>(entry->size()));
+    buf_out->put(*entry);
+  }
+  return buf_out;
+}
+
+void CoordinatorLogStore::apply_pack(uint64_t index, buffer &pack) {
+  pack.pos(0);
+  int32 const num_logs = pack.get_int();
+
+  for (int32 i = 0; i < num_logs; ++i) {
+    uint64_t cur_idx = index + i;
+    int32 buf_size = pack.get_int();
+
+    ptr<buffer> buf_local = buffer::alloc(buf_size);
+    pack.get(buf_local);
+
+    ptr<log_entry> le = log_entry::deserialize(*buf_local);
+    {
+      auto lock = std::lock_guard{logs_lock_};
+      logs_[cur_idx] = le;
+    }
+  }
+
+  {
+    auto lock = std::lock_guard{logs_lock_};
+    auto const entry = logs_.upper_bound(0);
+    if (entry != logs_.end()) {
+      start_idx_ = entry->first;
+    } else {
+      start_idx_ = 1;
+    }
+  }
+}
+
+// NOTE: Remove all logs up to given 'last_log_index' (inclusive).
+bool CoordinatorLogStore::compact(uint64_t last_log_index) {
+  auto lock = std::lock_guard{logs_lock_};
+  for (uint64_t ii = start_idx_; ii <= last_log_index; ++ii) {
+    auto const entry = logs_.find(ii);
+    if (entry != logs_.end()) {
+      logs_.erase(entry);
+    }
+  }
+
+  if (start_idx_ <= last_log_index) {
+    start_idx_ = last_log_index + 1;
+  }
+  return true;
+}
+
+bool CoordinatorLogStore::flush() { return true; }
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/coordinator_rpc.cpp

@@ -36,19 +36,64 @@ void PromoteReplicaToMainRes::Load(PromoteReplicaToMainRes *self, memgraph::slk:
   memgraph::slk::Load(self, reader);
 }
 
-void SetMainToReplicaReq::Save(const SetMainToReplicaReq &self, memgraph::slk::Builder *builder) {
+void DemoteMainToReplicaReq::Save(const DemoteMainToReplicaReq &self, memgraph::slk::Builder *builder) {
   memgraph::slk::Save(self, builder);
 }
 
-void SetMainToReplicaReq::Load(SetMainToReplicaReq *self, memgraph::slk::Reader *reader) {
+void DemoteMainToReplicaReq::Load(DemoteMainToReplicaReq *self, memgraph::slk::Reader *reader) {
   memgraph::slk::Load(self, reader);
 }
 
-void SetMainToReplicaRes::Save(const SetMainToReplicaRes &self, memgraph::slk::Builder *builder) {
+void DemoteMainToReplicaRes::Save(const DemoteMainToReplicaRes &self, memgraph::slk::Builder *builder) {
   memgraph::slk::Save(self, builder);
 }
 
-void SetMainToReplicaRes::Load(SetMainToReplicaRes *self, memgraph::slk::Reader *reader) {
+void DemoteMainToReplicaRes::Load(DemoteMainToReplicaRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void UnregisterReplicaReq::Save(UnregisterReplicaReq const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void UnregisterReplicaReq::Load(UnregisterReplicaReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void UnregisterReplicaRes::Save(UnregisterReplicaRes const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void UnregisterReplicaRes::Load(UnregisterReplicaRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void EnableWritingOnMainRes::Save(EnableWritingOnMainRes const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void EnableWritingOnMainRes::Load(EnableWritingOnMainRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void EnableWritingOnMainReq::Save(EnableWritingOnMainReq const &self, memgraph::slk::Builder *builder) {}
+
+void EnableWritingOnMainReq::Load(EnableWritingOnMainReq *self, memgraph::slk::Reader *reader) {}
+
+// GetInstanceUUID
+void GetInstanceUUIDReq::Save(const GetInstanceUUIDReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void GetInstanceUUIDReq::Load(GetInstanceUUIDReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
+void GetInstanceUUIDRes::Save(const GetInstanceUUIDRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void GetInstanceUUIDRes::Load(GetInstanceUUIDRes *self, memgraph::slk::Reader *reader) {
   memgraph::slk::Load(self, reader);
 }
 
@@ -60,14 +105,35 @@ constexpr utils::TypeInfo coordination::PromoteReplicaToMainReq::kType{utils::Ty
 constexpr utils::TypeInfo coordination::PromoteReplicaToMainRes::kType{utils::TypeId::COORD_FAILOVER_RES,
                                                                        "CoordPromoteReplicaToMainRes", nullptr};
 
-constexpr utils::TypeInfo coordination::SetMainToReplicaReq::kType{utils::TypeId::COORD_SET_REPL_MAIN_REQ,
-                                                                   "CoordSetReplMainReq", nullptr};
+constexpr utils::TypeInfo coordination::DemoteMainToReplicaReq::kType{utils::TypeId::COORD_SET_REPL_MAIN_REQ,
+                                                                      "CoordDemoteToReplicaReq", nullptr};
 
-constexpr utils::TypeInfo coordination::SetMainToReplicaRes::kType{utils::TypeId::COORD_SET_REPL_MAIN_RES,
-                                                                   "CoordSetReplMainRes", nullptr};
+constexpr utils::TypeInfo coordination::DemoteMainToReplicaRes::kType{utils::TypeId::COORD_SET_REPL_MAIN_RES,
+
+                                                                      "CoordDemoteToReplicaRes", nullptr};
+
+constexpr utils::TypeInfo coordination::UnregisterReplicaReq::kType{utils::TypeId::COORD_UNREGISTER_REPLICA_REQ,
+                                                                    "UnregisterReplicaReq", nullptr};
+
+constexpr utils::TypeInfo coordination::UnregisterReplicaRes::kType{utils::TypeId::COORD_UNREGISTER_REPLICA_RES,
+                                                                    "UnregisterReplicaRes", nullptr};
+
+constexpr utils::TypeInfo coordination::EnableWritingOnMainReq::kType{utils::TypeId::COORD_ENABLE_WRITING_ON_MAIN_REQ,
+                                                                      "CoordEnableWritingOnMainReq", nullptr};
+
+constexpr utils::TypeInfo coordination::EnableWritingOnMainRes::kType{utils::TypeId::COORD_ENABLE_WRITING_ON_MAIN_RES,
+                                                                      "CoordEnableWritingOnMainRes", nullptr};
+
+constexpr utils::TypeInfo coordination::GetInstanceUUIDReq::kType{utils::TypeId::COORD_GET_UUID_REQ, "CoordGetUUIDReq",
+                                                                  nullptr};
+
+constexpr utils::TypeInfo coordination::GetInstanceUUIDRes::kType{utils::TypeId::COORD_GET_UUID_RES, "CoordGetUUIDRes",
+                                                                  nullptr};
 
 namespace slk {
 
+// PromoteReplicaToMainRpc
+
 void Save(const memgraph::coordination::PromoteReplicaToMainRes &self, memgraph::slk::Builder *builder) {
   memgraph::slk::Save(self.success, builder);
 }
@@ -77,29 +143,76 @@ void Load(memgraph::coordination::PromoteReplicaToMainRes *self, memgraph::slk::
 }
 
 void Save(const memgraph::coordination::PromoteReplicaToMainReq &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.main_uuid_, builder);
   memgraph::slk::Save(self.replication_clients_info, builder);
 }
 
 void Load(memgraph::coordination::PromoteReplicaToMainReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->main_uuid_, reader);
   memgraph::slk::Load(&self->replication_clients_info, reader);
 }
 
-void Save(const memgraph::coordination::SetMainToReplicaReq &self, memgraph::slk::Builder *builder) {
+// DemoteMainToReplicaRpc
+void Save(const memgraph::coordination::DemoteMainToReplicaReq &self, memgraph::slk::Builder *builder) {
   memgraph::slk::Save(self.replication_client_info, builder);
 }
 
-void Load(memgraph::coordination::SetMainToReplicaReq *self, memgraph::slk::Reader *reader) {
+void Load(memgraph::coordination::DemoteMainToReplicaReq *self, memgraph::slk::Reader *reader) {
   memgraph::slk::Load(&self->replication_client_info, reader);
 }
 
-void Save(const memgraph::coordination::SetMainToReplicaRes &self, memgraph::slk::Builder *builder) {
+void Save(const memgraph::coordination::DemoteMainToReplicaRes &self, memgraph::slk::Builder *builder) {
   memgraph::slk::Save(self.success, builder);
 }
 
-void Load(memgraph::coordination::SetMainToReplicaRes *self, memgraph::slk::Reader *reader) {
+void Load(memgraph::coordination::DemoteMainToReplicaRes *self, memgraph::slk::Reader *reader) {
   memgraph::slk::Load(&self->success, reader);
 }
 
+// UnregisterReplicaRpc
+
+void Save(memgraph::coordination::UnregisterReplicaReq const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.instance_name, builder);
+}
+
+void Load(memgraph::coordination::UnregisterReplicaReq *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->instance_name, reader);
+}
+
+void Save(memgraph::coordination::UnregisterReplicaRes const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.success, builder);
+}
+
+void Load(memgraph::coordination::UnregisterReplicaRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->success, reader);
+}
+
+void Save(memgraph::coordination::EnableWritingOnMainRes const &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.success, builder);
+}
+
+void Load(memgraph::coordination::EnableWritingOnMainRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->success, reader);
+}
+
+// GetInstanceUUIDRpc
+
+void Save(const memgraph::coordination::GetInstanceUUIDReq & /*self*/, memgraph::slk::Builder * /*builder*/) {
+  /* nothing to serialize*/
+}
+
+void Load(memgraph::coordination::GetInstanceUUIDReq * /*self*/, memgraph::slk::Reader * /*reader*/) {
+  /* nothing to serialize*/
+}
+
+void Save(const memgraph::coordination::GetInstanceUUIDRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.uuid, builder);
+}
+
+void Load(memgraph::coordination::GetInstanceUUIDRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->uuid, reader);
+}
+
 }  // namespace slk
 
 }  // namespace memgraph

src/coordination/coordinator_server.cpp

@@ -12,7 +12,7 @@
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_server.hpp"
-#include "replication_coordination_glue/messages.hpp"
+#include "replication_coordination_glue/handler.hpp"
 
 namespace memgraph::coordination {
 

src/coordination/coordinator_state.cpp

@@ -25,7 +25,7 @@
 namespace memgraph::coordination {
 
 CoordinatorState::CoordinatorState() {
-  MG_ASSERT(!(FLAGS_coordinator && FLAGS_coordinator_server_port),
+  MG_ASSERT(!(FLAGS_raft_server_id && FLAGS_coordinator_server_port),
             "Instance cannot be a coordinator and have registered coordinator server.");
 
   spdlog::info("Executing coordinator constructor");
@@ -41,43 +41,53 @@ CoordinatorState::CoordinatorState() {
   }
 }
 
-auto CoordinatorState::RegisterInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus {
-  MG_ASSERT(std::holds_alternative<CoordinatorData>(data_),
+auto CoordinatorState::RegisterReplicationInstance(CoordinatorClientConfig config)
+    -> RegisterInstanceCoordinatorStatus {
+  MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot register replica since variant holds wrong alternative");
 
   return std::visit(
-      memgraph::utils::Overloaded{
-          [](const CoordinatorMainReplicaData & /*coordinator_main_replica_data*/) {
-            return RegisterInstanceCoordinatorStatus::NOT_COORDINATOR;
-          },
-          [config](CoordinatorData &coordinator_data) { return coordinator_data.RegisterInstance(config); }},
+      memgraph::utils::Overloaded{[](const CoordinatorMainReplicaData & /*coordinator_main_replica_data*/) {
+                                    return RegisterInstanceCoordinatorStatus::NOT_COORDINATOR;
+                                  },
+                                  [config](CoordinatorInstance &coordinator_instance) {
+                                    return coordinator_instance.RegisterReplicationInstance(config);
+                                  }},
       data_);
 }
 
-auto CoordinatorState::SetInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus {
-  MG_ASSERT(std::holds_alternative<CoordinatorData>(data_),
+auto CoordinatorState::UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus {
+  MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
+            "Coordinator cannot unregister instance since variant holds wrong alternative");
+
+  return std::visit(
+      memgraph::utils::Overloaded{[](const CoordinatorMainReplicaData & /*coordinator_main_replica_data*/) {
+                                    return UnregisterInstanceCoordinatorStatus::NOT_COORDINATOR;
+                                  },
+                                  [&instance_name](CoordinatorInstance &coordinator_instance) {
+                                    return coordinator_instance.UnregisterReplicationInstance(instance_name);
+                                  }},
+      data_);
+}
+
+auto CoordinatorState::SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus {
+  MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot register replica since variant holds wrong alternative");
 
   return std::visit(
       memgraph::utils::Overloaded{[](const CoordinatorMainReplicaData & /*coordinator_main_replica_data*/) {
                                     return SetInstanceToMainCoordinatorStatus::NOT_COORDINATOR;
                                   },
-                                  [&instance_name](CoordinatorData &coordinator_data) {
-                                    return coordinator_data.SetInstanceToMain(instance_name);
+                                  [&instance_name](CoordinatorInstance &coordinator_instance) {
+                                    return coordinator_instance.SetReplicationInstanceToMain(instance_name);
                                   }},
       data_);
 }
 
-auto CoordinatorState::ShowInstances() const -> std::vector<CoordinatorInstanceStatus> {
-  MG_ASSERT(std::holds_alternative<CoordinatorData>(data_),
+auto CoordinatorState::ShowInstances() const -> std::vector<InstanceStatus> {
+  MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Can't call show instances on data_, as variant holds wrong alternative");
-  return std::get<CoordinatorData>(data_).ShowInstances();
-}
-
-[[nodiscard]] auto CoordinatorState::DoFailover() -> DoFailoverStatus {
-  MG_ASSERT(std::holds_alternative<CoordinatorData>(data_), "Cannot do failover since variant holds wrong alternative");
-  auto &coord_state = std::get<CoordinatorData>(data_);
-  return coord_state.DoFailover();
+  return std::get<CoordinatorInstance>(data_).ShowInstances();
 }
 
 auto CoordinatorState::GetCoordinatorServer() const -> CoordinatorServer & {
@@ -85,5 +95,13 @@ auto CoordinatorState::GetCoordinatorServer() const -> CoordinatorServer & {
             "Cannot get coordinator server since variant holds wrong alternative");
   return *std::get<CoordinatorMainReplicaData>(data_).coordinator_server_;
 }
+
+auto CoordinatorState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
+    -> void {
+  MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
+            "Coordinator cannot register replica since variant holds wrong alternative");
+  return std::get<CoordinatorInstance>(data_).AddCoordinatorInstance(raft_server_id, raft_port, raft_address);
+}
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/coordinator_state_machine.cpp

@@ -0,0 +1,111 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "nuraft/coordinator_state_machine.hpp"
+
+namespace memgraph::coordination {
+
+auto CoordinatorStateMachine::EncodeRegisterReplicationInstance(const std::string &name) -> ptr<buffer> {
+  std::string str_log = name + "_replica";
+  ptr<buffer> log = buffer::alloc(sizeof(uint32_t) + str_log.size());
+  buffer_serializer bs(log);
+  bs.put_str(str_log);
+  return log;
+}
+
+auto CoordinatorStateMachine::DecodeRegisterReplicationInstance(buffer &data) -> std::string {
+  buffer_serializer bs(data);
+  return bs.get_str();
+}
+
+auto CoordinatorStateMachine::pre_commit(ulong const log_idx, buffer &data) -> ptr<buffer> {
+  buffer_serializer bs(data);
+  std::string str = bs.get_str();
+
+  spdlog::info("pre_commit {} : {}", log_idx, str);
+  return nullptr;
+}
+
+auto CoordinatorStateMachine::commit(ulong const log_idx, buffer &data) -> ptr<buffer> {
+  buffer_serializer bs(data);
+  std::string str = bs.get_str();
+
+  spdlog::info("commit {} : {}", log_idx, str);
+
+  last_committed_idx_ = log_idx;
+  return nullptr;
+}
+
+auto CoordinatorStateMachine::commit_config(ulong const log_idx, ptr<cluster_config> & /*new_conf*/) -> void {
+  last_committed_idx_ = log_idx;
+}
+
+auto CoordinatorStateMachine::rollback(ulong const log_idx, buffer &data) -> void {
+  buffer_serializer bs(data);
+  std::string str = bs.get_str();
+
+  spdlog::info("rollback {} : {}", log_idx, str);
+}
+
+auto CoordinatorStateMachine::read_logical_snp_obj(snapshot & /*snapshot*/, void *& /*user_snp_ctx*/, ulong /*obj_id*/,
+                                                   ptr<buffer> &data_out, bool &is_last_obj) -> int {
+  // Put dummy data.
+  data_out = buffer::alloc(sizeof(int32));
+  buffer_serializer bs(data_out);
+  bs.put_i32(0);
+
+  is_last_obj = true;
+  return 0;
+}
+
+auto CoordinatorStateMachine::save_logical_snp_obj(snapshot &s, ulong &obj_id, buffer & /*data*/, bool /*is_first_obj*/,
+                                                   bool /*is_last_obj*/) -> void {
+  spdlog::info("save snapshot {} term {} object ID", s.get_last_log_idx(), s.get_last_log_term(), obj_id);
+  // Request next object.
+  obj_id++;
+}
+
+auto CoordinatorStateMachine::apply_snapshot(snapshot &s) -> bool {
+  spdlog::info("apply snapshot {} term {}", s.get_last_log_idx(), s.get_last_log_term());
+  {
+    auto lock = std::lock_guard{last_snapshot_lock_};
+    ptr<buffer> snp_buf = s.serialize();
+    last_snapshot_ = snapshot::deserialize(*snp_buf);
+  }
+  return true;
+}
+
+auto CoordinatorStateMachine::free_user_snp_ctx(void *&user_snp_ctx) -> void {}
+
+auto CoordinatorStateMachine::last_snapshot() -> ptr<snapshot> {
+  auto lock = std::lock_guard{last_snapshot_lock_};
+  return last_snapshot_;
+}
+
+auto CoordinatorStateMachine::last_commit_index() -> ulong { return last_committed_idx_; }
+
+auto CoordinatorStateMachine::create_snapshot(snapshot &s, async_result<bool>::handler_type &when_done) -> void {
+  spdlog::info("create snapshot {} term {}", s.get_last_log_idx(), s.get_last_log_term());
+  // Clone snapshot from `s`.
+  {
+    auto lock = std::lock_guard{last_snapshot_lock_};
+    ptr<buffer> snp_buf = s.serialize();
+    last_snapshot_ = snapshot::deserialize(*snp_buf);
+  }
+  ptr<std::exception> except(nullptr);
+  bool ret = true;
+  when_done(ret, except);
+}
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/coordinator_state_manager.cpp

@@ -0,0 +1,68 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "nuraft/coordinator_state_manager.hpp"
+
+namespace memgraph::coordination {
+
+using nuraft::cluster_config;
+using nuraft::cs_new;
+using nuraft::srv_config;
+using nuraft::srv_state;
+using nuraft::state_mgr;
+
+CoordinatorStateManager::CoordinatorStateManager(int srv_id, std::string const &endpoint)
+    : my_id_(srv_id), my_endpoint_(endpoint), cur_log_store_(cs_new<CoordinatorLogStore>()) {
+  my_srv_config_ = cs_new<srv_config>(srv_id, endpoint);
+
+  // Initial cluster config: contains only one server (myself).
+  cluster_config_ = cs_new<cluster_config>();
+  cluster_config_->get_servers().push_back(my_srv_config_);
+}
+
+auto CoordinatorStateManager::load_config() -> ptr<cluster_config> {
+  // Just return in-memory data in this example.
+  // May require reading from disk here, if it has been written to disk.
+  return cluster_config_;
+}
+
+auto CoordinatorStateManager::save_config(cluster_config const &config) -> void {
+  // Just keep in memory in this example.
+  // Need to write to disk here, if want to make it durable.
+  ptr<buffer> buf = config.serialize();
+  cluster_config_ = cluster_config::deserialize(*buf);
+}
+
+auto CoordinatorStateManager::save_state(srv_state const &state) -> void {
+  // Just keep in memory in this example.
+  // Need to write to disk here, if want to make it durable.
+  ptr<buffer> buf = state.serialize();
+  saved_state_ = srv_state::deserialize(*buf);
+}
+
+auto CoordinatorStateManager::read_state() -> ptr<srv_state> {
+  // Just return in-memory data in this example.
+  // May require reading from disk here, if it has been written to disk.
+  return saved_state_;
+}
+
+auto CoordinatorStateManager::load_log_store() -> ptr<log_store> { return cur_log_store_; }
+
+auto CoordinatorStateManager::server_id() -> int32 { return my_id_; }
+
+auto CoordinatorStateManager::system_exit(int const exit_code) -> void {}
+
+auto CoordinatorStateManager::GetSrvConfig() const -> ptr<srv_config> { return my_srv_config_; }
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/fmt.hpp

@@ -0,0 +1,60 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#if FMT_VERSION > 90000
+#include <fmt/ostream.h>
+#include <string>
+
+#include <libnuraft/nuraft.hxx>
+#include "utils/logging.hpp"
+
+inline std::string ToString(const nuraft::cmd_result_code &code) {
+  switch (code) {
+    case nuraft::cmd_result_code::OK:
+      return "OK";
+    case nuraft::cmd_result_code::FAILED:
+      return "FAILED";
+    case nuraft::cmd_result_code::RESULT_NOT_EXIST_YET:
+      return "RESULT_NOT_EXIST_YET";
+    case nuraft::cmd_result_code::TERM_MISMATCH:
+      return "TERM_MISMATCH";
+    case nuraft::cmd_result_code::SERVER_IS_LEAVING:
+      return "SERVER_IS_LEAVING";
+    case nuraft::cmd_result_code::CANNOT_REMOVE_LEADER:
+      return "CANNOT_REMOVE_LEADER";
+    case nuraft::cmd_result_code::SERVER_NOT_FOUND:
+      return "SERVER_NOT_FOUND";
+    case nuraft::cmd_result_code::SERVER_IS_JOINING:
+      return "SERVER_IS_JOINING";
+    case nuraft::cmd_result_code::CONFIG_CHANGING:
+      return "CONFIG_CHANGING";
+    case nuraft::cmd_result_code::SERVER_ALREADY_EXISTS:
+      return "SERVER_ALREADY_EXISTS";
+    case nuraft::cmd_result_code::BAD_REQUEST:
+      return "BAD_REQUEST";
+    case nuraft::cmd_result_code::NOT_LEADER:
+      return "NOT_LEADER";
+    case nuraft::cmd_result_code::TIMEOUT:
+      return "TIMEOUT";
+    case nuraft::cmd_result_code::CANCELLED:
+      return "CANCELLED";
+  }
+  LOG_FATAL("ToString of a nuraft::cmd_result_code -> check missing switch case");
+}
+inline std::ostream &operator<<(std::ostream &os, const nuraft::cmd_result_code &code) {
+  os << ToString(code);
+  return os;
+}
+template <>
+class fmt::formatter<nuraft::cmd_result_code> : public fmt::ostream_formatter {};
+#endif

src/coordination/include/coordination/coordinator_client.hpp

@@ -15,20 +15,21 @@
 
 #include "coordination/coordinator_config.hpp"
 #include "rpc/client.hpp"
+#include "rpc_errors.hpp"
+#include "utils/result.hpp"
 #include "utils/scheduler.hpp"
+#include "utils/uuid.hpp"
 
 namespace memgraph::coordination {
 
-class CoordinatorData;
-using HealthCheckCallback = std::function<void(CoordinatorData *, std::string_view)>;
+class CoordinatorInstance;
+using HealthCheckCallback = std::function<void(CoordinatorInstance *, std::string_view)>;
+using ReplicationClientsInfo = std::vector<ReplClientInfo>;
 
 class CoordinatorClient {
  public:
-  using ReplClientInfo = CoordinatorClientConfig::ReplicationClientInfo;
-  using ReplicationClientsInfo = std::vector<ReplClientInfo>;
-
-  explicit CoordinatorClient(CoordinatorData *coord_data_, CoordinatorClientConfig config, HealthCheckCallback succ_cb,
-                             HealthCheckCallback fail_cb);
+  explicit CoordinatorClient(CoordinatorInstance *coord_instance, CoordinatorClientConfig config,
+                             HealthCheckCallback succ_cb, HealthCheckCallback fail_cb);
 
   ~CoordinatorClient() = default;
 
@@ -46,15 +47,28 @@ class CoordinatorClient {
   auto InstanceName() const -> std::string;
   auto SocketAddress() const -> std::string;
 
-  auto SendPromoteReplicaToMainRpc(ReplicationClientsInfo replication_clients_info) const -> bool;
+  [[nodiscard]] auto DemoteToReplica() const -> bool;
 
-  auto ReplicationClientInfo() const -> const ReplClientInfo &;
-  auto ResetReplicationClientInfo() -> void;
+  auto SendPromoteReplicaToMainRpc(const utils::UUID &uuid, ReplicationClientsInfo replication_clients_info) const
+      -> bool;
 
-  auto SendSetToReplicaRpc(ReplClientInfo replication_client_info) const -> bool;
+  auto SendSwapMainUUIDRpc(const utils::UUID &uuid) const -> bool;
 
-  auto SetSuccCallback(HealthCheckCallback succ_cb) -> void;
-  auto SetFailCallback(HealthCheckCallback fail_cb) -> void;
+  auto SendUnregisterReplicaRpc(std::string const &instance_name) const -> bool;
+
+  auto SendEnableWritingOnMainRpc() const -> bool;
+
+  auto SendGetInstanceUUIDRpc() const -> memgraph::utils::BasicResult<GetInstanceUUIDError, std::optional<utils::UUID>>;
+
+  auto ReplicationClientInfo() const -> ReplClientInfo;
+
+  auto SetCallbacks(HealthCheckCallback succ_cb, HealthCheckCallback fail_cb) -> void;
+
+  auto RpcClient() -> rpc::Client & { return rpc_client_; }
+
+  auto InstanceDownTimeoutSec() const -> std::chrono::seconds;
+
+  auto InstanceGetUUIDFrequencySec() const -> std::chrono::seconds;
 
   friend bool operator==(CoordinatorClient const &first, CoordinatorClient const &second) {
     return first.config_ == second.config_;
@@ -63,12 +77,11 @@ class CoordinatorClient {
  private:
   utils::Scheduler instance_checker_;
 
-  // TODO: (andi) Pimpl?
   communication::ClientContext rpc_context_;
   mutable rpc::Client rpc_client_;
 
   CoordinatorClientConfig config_;
-  CoordinatorData *coord_data_;
+  CoordinatorInstance *coord_instance_;
   HealthCheckCallback succ_cb_;
   HealthCheckCallback fail_cb_;
 };

src/coordination/include/coordination/coordinator_config.hpp

@@ -28,13 +28,13 @@ struct CoordinatorClientConfig {
   std::string instance_name;
   std::string ip_address;
   uint16_t port{};
-  std::chrono::seconds health_check_frequency_sec{1};
+  std::chrono::seconds instance_health_check_frequency_sec{1};
+  std::chrono::seconds instance_down_timeout_sec{5};
+  std::chrono::seconds instance_get_uuid_frequency_sec{10};
 
   auto SocketAddress() const -> std::string { return ip_address + ":" + std::to_string(port); }
 
-  // Info which coordinator will send to new main when performing failover
   struct ReplicationClientInfo {
-    // Must be the same as CoordinatorClientConfig's instance_name
     std::string instance_name;
     replication_coordination_glue::ReplicationMode replication_mode{};
     std::string replication_ip_address;
@@ -43,7 +43,6 @@ struct CoordinatorClientConfig {
     friend bool operator==(ReplicationClientInfo const &, ReplicationClientInfo const &) = default;
   };
 
-  // Each instance has replication config in case it fails
   ReplicationClientInfo replication_client_info;
 
   struct SSL {
@@ -58,6 +57,8 @@ struct CoordinatorClientConfig {
   friend bool operator==(CoordinatorClientConfig const &, CoordinatorClientConfig const &) = default;
 };
 
+using ReplClientInfo = CoordinatorClientConfig::ReplicationClientInfo;
+
 struct CoordinatorServerConfig {
   std::string ip_address;
   uint16_t port{};

src/coordination/include/coordination/coordinator_data.hpp

@@ -1,49 +0,0 @@
-// Copyright 2024 Memgraph Ltd.
-//
-// Use of this software is governed by the Business Source License
-// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
-// License, and you may not use this file except in compliance with the Business Source License.
-//
-// As of the Change Date specified in that file, in accordance with
-// the Business Source License, use of this software will be governed
-// by the Apache License, Version 2.0, included in the file
-// licenses/APL.txt.
-
-#pragma once
-
-#ifdef MG_ENTERPRISE
-
-#include "coordination/coordinator_instance.hpp"
-#include "coordination/coordinator_instance_status.hpp"
-#include "coordination/coordinator_server.hpp"
-#include "coordination/failover_status.hpp"
-#include "coordination/register_main_replica_coordinator_status.hpp"
-#include "utils/rw_lock.hpp"
-
-#include <list>
-
-namespace memgraph::coordination {
-class CoordinatorData {
- public:
-  CoordinatorData();
-
-  [[nodiscard]] auto DoFailover() -> DoFailoverStatus;
-
-  [[nodiscard]] auto RegisterInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
-  [[nodiscard]] auto SetInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
-
-  auto ShowInstances() const -> std::vector<CoordinatorInstanceStatus>;
-
- private:
-  mutable utils::RWLock coord_data_lock_{utils::RWLock::Priority::READ};
-  HealthCheckCallback main_succ_cb_, main_fail_cb_, replica_succ_cb_, replica_fail_cb_;
-  // Must be std::list because we rely on pointer stability
-  std::list<CoordinatorInstance> registered_instances_;
-};
-
-struct CoordinatorMainReplicaData {
-  std::unique_ptr<CoordinatorServer> coordinator_server_;
-};
-
-}  // namespace memgraph::coordination
-#endif

src/coordination/include/coordination/coordinator_exceptions.hpp

@@ -16,16 +16,71 @@
 #include "utils/exceptions.hpp"
 
 namespace memgraph::coordination {
-class CoordinatorFailoverException final : public utils::BasicException {
+class CoordinatorRegisterInstanceException final : public utils::BasicException {
  public:
-  explicit CoordinatorFailoverException(const std::string_view what) noexcept
-      : BasicException("Failover didn't complete successfully: " + std::string(what)) {}
+  explicit CoordinatorRegisterInstanceException(const std::string_view what) noexcept
+      : BasicException("Failed to create instance: " + std::string(what)) {}
 
   template <class... Args>
-  explicit CoordinatorFailoverException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
-      : CoordinatorFailoverException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+  explicit CoordinatorRegisterInstanceException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : CoordinatorRegisterInstanceException(fmt::format(fmt, std::forward<Args>(args)...)) {}
 
-  SPECIALIZE_GET_EXCEPTION_NAME(CoordinatorFailoverException)
+  SPECIALIZE_GET_EXCEPTION_NAME(CoordinatorRegisterInstanceException)
+};
+
+class RaftServerStartException final : public utils::BasicException {
+ public:
+  explicit RaftServerStartException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit RaftServerStartException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : RaftServerStartException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(RaftServerStartException)
+};
+
+class RaftAddServerException final : public utils::BasicException {
+ public:
+  explicit RaftAddServerException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit RaftAddServerException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : RaftAddServerException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(RaftAddServerException)
+};
+
+class RaftBecomeLeaderException final : public utils::BasicException {
+ public:
+  explicit RaftBecomeLeaderException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit RaftBecomeLeaderException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : RaftBecomeLeaderException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(RaftBecomeLeaderException)
+};
+
+class RaftCouldNotFindEntryException final : public utils::BasicException {
+ public:
+  explicit RaftCouldNotFindEntryException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit RaftCouldNotFindEntryException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : RaftCouldNotFindEntryException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(RaftCouldNotFindEntryException)
+};
+
+class RaftCouldNotParseFlagsException final : public utils::BasicException {
+ public:
+  explicit RaftCouldNotParseFlagsException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit RaftCouldNotParseFlagsException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : RaftCouldNotParseFlagsException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(RaftCouldNotParseFlagsException)
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/coordinator_handlers.hpp

@@ -0,0 +1,48 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_server.hpp"
+#include "replication_handler/replication_handler.hpp"
+#include "slk/streams.hpp"
+
+namespace memgraph::dbms {
+
+class DbmsHandler;
+
+class CoordinatorHandlers {
+ public:
+  static void Register(memgraph::coordination::CoordinatorServer &server,
+                       replication::ReplicationHandler &replication_handler);
+
+ private:
+  static void PromoteReplicaToMainHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                          slk::Builder *res_builder);
+  static void DemoteMainToReplicaHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                         slk::Builder *res_builder);
+  static void SwapMainUUIDHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                  slk::Builder *res_builder);
+
+  static void UnregisterReplicaHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                       slk::Builder *res_builder);
+  static void EnableWritingOnMainHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                         slk::Builder *res_builder);
+
+  static void GetInstanceUUIDHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                     slk::Builder *res_builder);
+};
+
+}  // namespace memgraph::dbms
+
+#endif

src/coordination/include/coordination/coordinator_instance.hpp

@@ -13,64 +13,47 @@
 
 #ifdef MG_ENTERPRISE
 
-#include "coordination/coordinator_client.hpp"
-#include "coordination/coordinator_cluster_config.hpp"
-#include "replication_coordination_glue/role.hpp"
+#include "coordination/coordinator_server.hpp"
+#include "coordination/instance_status.hpp"
+#include "coordination/raft_state.hpp"
+#include "coordination/register_main_replica_coordinator_status.hpp"
+#include "coordination/replication_instance.hpp"
+#include "utils/rw_lock.hpp"
+#include "utils/thread_pool.hpp"
+
+#include <list>
 
 namespace memgraph::coordination {
 
-class CoordinatorData;
-
 class CoordinatorInstance {
  public:
-  CoordinatorInstance(CoordinatorData *data, CoordinatorClientConfig config, HealthCheckCallback succ_cb,
-                      HealthCheckCallback fail_cb, replication_coordination_glue::ReplicationRole replication_role)
-      : client_(data, std::move(config), std::move(succ_cb), std::move(fail_cb)),
-        replication_role_(replication_role),
-        is_alive_(true) {}
+  CoordinatorInstance();
 
-  CoordinatorInstance(CoordinatorInstance const &other) = delete;
-  CoordinatorInstance &operator=(CoordinatorInstance const &other) = delete;
-  CoordinatorInstance(CoordinatorInstance &&other) noexcept = delete;
-  CoordinatorInstance &operator=(CoordinatorInstance &&other) noexcept = delete;
-  ~CoordinatorInstance() = default;
+  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus;
 
-  auto UpdateInstanceStatus() -> bool {
-    is_alive_ = std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now() - last_response_time_)
-                    .count() < CoordinatorClusterConfig::alive_response_time_difference_sec_;
-    return is_alive_;
-  }
-  auto UpdateLastResponseTime() -> void { last_response_time_ = std::chrono::system_clock::now(); }
+  [[nodiscard]] auto SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
 
-  auto InstanceName() const -> std::string { return client_.InstanceName(); }
-  auto SocketAddress() const -> std::string { return client_.SocketAddress(); }
-  auto IsAlive() const -> bool { return is_alive_; }
+  auto ShowInstances() const -> std::vector<InstanceStatus>;
 
-  auto IsReplica() const -> bool {
-    return replication_role_ == replication_coordination_glue::ReplicationRole::REPLICA;
-  }
-  auto IsMain() const -> bool { return replication_role_ == replication_coordination_glue::ReplicationRole::MAIN; }
+  auto TryFailover() -> void;
 
-  auto PrepareForFailover() -> void { client_.PauseFrequentCheck(); }
-  auto RestoreAfterFailedFailover() -> void { client_.ResumeFrequentCheck(); }
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
 
-  auto PostFailover(HealthCheckCallback main_succ_cb, HealthCheckCallback main_fail_cb) -> void {
-    replication_role_ = replication_coordination_glue::ReplicationRole::MAIN;
-    client_.SetSuccCallback(std::move(main_succ_cb));
-    client_.SetFailCallback(std::move(main_fail_cb));
-    // Comment with Andi but we shouldn't delete this, what if this MAIN FAILS AGAIN
-    // client_.ResetReplicationClientInfo();
-    client_.ResumeFrequentCheck();
-  }
+  auto GetMainUUID() const -> utils::UUID;
 
-  CoordinatorClient client_;
-  replication_coordination_glue::ReplicationRole replication_role_;
-  std::chrono::system_clock::time_point last_response_time_{};
-  bool is_alive_{false};
+  auto SetMainUUID(utils::UUID new_uuid) -> void;
 
-  friend bool operator==(CoordinatorInstance const &first, CoordinatorInstance const &second) {
-    return first.client_ == second.client_ && first.replication_role_ == second.replication_role_;
-  }
+ private:
+  HealthCheckCallback main_succ_cb_, main_fail_cb_, replica_succ_cb_, replica_fail_cb_;
+
+  // NOTE: Must be std::list because we rely on pointer stability
+  std::list<ReplicationInstance> repl_instances_;
+  mutable utils::RWLock coord_instance_lock_{utils::RWLock::Priority::READ};
+
+  utils::UUID main_uuid_;
+
+  RaftState raft_state_;
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/coordinator_rpc.hpp

@@ -11,6 +11,7 @@
 
 #pragma once
 
+#include "utils/uuid.hpp"
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_config.hpp"
@@ -26,10 +27,13 @@ struct PromoteReplicaToMainReq {
   static void Load(PromoteReplicaToMainReq *self, memgraph::slk::Reader *reader);
   static void Save(const PromoteReplicaToMainReq &self, memgraph::slk::Builder *builder);
 
-  explicit PromoteReplicaToMainReq(std::vector<CoordinatorClientConfig::ReplicationClientInfo> replication_clients_info)
-      : replication_clients_info(std::move(replication_clients_info)) {}
+  explicit PromoteReplicaToMainReq(const utils::UUID &uuid,
+                                   std::vector<CoordinatorClientConfig::ReplicationClientInfo> replication_clients_info)
+      : main_uuid_(uuid), replication_clients_info(std::move(replication_clients_info)) {}
   PromoteReplicaToMainReq() = default;
 
+  // get uuid here
+  utils::UUID main_uuid_;
   std::vector<CoordinatorClientConfig::ReplicationClientInfo> replication_clients_info;
 };
 
@@ -48,56 +52,145 @@ struct PromoteReplicaToMainRes {
 
 using PromoteReplicaToMainRpc = rpc::RequestResponse<PromoteReplicaToMainReq, PromoteReplicaToMainRes>;
 
-struct SetMainToReplicaReq {
+struct DemoteMainToReplicaReq {
   static const utils::TypeInfo kType;
   static const utils::TypeInfo &GetTypeInfo() { return kType; }
 
-  static void Load(SetMainToReplicaReq *self, memgraph::slk::Reader *reader);
-  static void Save(const SetMainToReplicaReq &self, memgraph::slk::Builder *builder);
+  static void Load(DemoteMainToReplicaReq *self, memgraph::slk::Reader *reader);
+  static void Save(const DemoteMainToReplicaReq &self, memgraph::slk::Builder *builder);
 
-  explicit SetMainToReplicaReq(CoordinatorClientConfig::ReplicationClientInfo replication_client_info)
+  explicit DemoteMainToReplicaReq(CoordinatorClientConfig::ReplicationClientInfo replication_client_info)
       : replication_client_info(std::move(replication_client_info)) {}
 
-  SetMainToReplicaReq() = default;
+  DemoteMainToReplicaReq() = default;
 
   CoordinatorClientConfig::ReplicationClientInfo replication_client_info;
 };
 
-struct SetMainToReplicaRes {
+struct DemoteMainToReplicaRes {
   static const utils::TypeInfo kType;
   static const utils::TypeInfo &GetTypeInfo() { return kType; }
 
-  static void Load(SetMainToReplicaRes *self, memgraph::slk::Reader *reader);
-  static void Save(const SetMainToReplicaRes &self, memgraph::slk::Builder *builder);
+  static void Load(DemoteMainToReplicaRes *self, memgraph::slk::Reader *reader);
+  static void Save(const DemoteMainToReplicaRes &self, memgraph::slk::Builder *builder);
 
-  explicit SetMainToReplicaRes(bool success) : success(success) {}
-  SetMainToReplicaRes() = default;
+  explicit DemoteMainToReplicaRes(bool success) : success(success) {}
+  DemoteMainToReplicaRes() = default;
 
   bool success;
 };
 
-using SetMainToReplicaRpc = rpc::RequestResponse<SetMainToReplicaReq, SetMainToReplicaRes>;
+using DemoteMainToReplicaRpc = rpc::RequestResponse<DemoteMainToReplicaReq, DemoteMainToReplicaRes>;
+
+struct UnregisterReplicaReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(UnregisterReplicaReq *self, memgraph::slk::Reader *reader);
+  static void Save(UnregisterReplicaReq const &self, memgraph::slk::Builder *builder);
+
+  explicit UnregisterReplicaReq(std::string instance_name) : instance_name(std::move(instance_name)) {}
+
+  UnregisterReplicaReq() = default;
+
+  std::string instance_name;
+};
+
+struct UnregisterReplicaRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(UnregisterReplicaRes *self, memgraph::slk::Reader *reader);
+  static void Save(const UnregisterReplicaRes &self, memgraph::slk::Builder *builder);
+
+  explicit UnregisterReplicaRes(bool success) : success(success) {}
+  UnregisterReplicaRes() = default;
+
+  bool success;
+};
+
+using UnregisterReplicaRpc = rpc::RequestResponse<UnregisterReplicaReq, UnregisterReplicaRes>;
+
+struct EnableWritingOnMainReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(EnableWritingOnMainReq *self, memgraph::slk::Reader *reader);
+  static void Save(EnableWritingOnMainReq const &self, memgraph::slk::Builder *builder);
+
+  EnableWritingOnMainReq() = default;
+};
+
+struct EnableWritingOnMainRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(EnableWritingOnMainRes *self, memgraph::slk::Reader *reader);
+  static void Save(EnableWritingOnMainRes const &self, memgraph::slk::Builder *builder);
+
+  explicit EnableWritingOnMainRes(bool success) : success(success) {}
+  EnableWritingOnMainRes() = default;
+
+  bool success;
+};
+
+using EnableWritingOnMainRpc = rpc::RequestResponse<EnableWritingOnMainReq, EnableWritingOnMainRes>;
+
+struct GetInstanceUUIDReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(GetInstanceUUIDReq *self, memgraph::slk::Reader *reader);
+  static void Save(const GetInstanceUUIDReq &self, memgraph::slk::Builder *builder);
+
+  GetInstanceUUIDReq() = default;
+};
+
+struct GetInstanceUUIDRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(GetInstanceUUIDRes *self, memgraph::slk::Reader *reader);
+  static void Save(const GetInstanceUUIDRes &self, memgraph::slk::Builder *builder);
+
+  explicit GetInstanceUUIDRes(std::optional<utils::UUID> uuid) : uuid(uuid) {}
+  GetInstanceUUIDRes() = default;
+
+  std::optional<utils::UUID> uuid;
+};
+
+using GetInstanceUUIDRpc = rpc::RequestResponse<GetInstanceUUIDReq, GetInstanceUUIDRes>;
 
 }  // namespace memgraph::coordination
 
 // SLK serialization declarations
 namespace memgraph::slk {
 
+// PromoteReplicaToMainRpc
 void Save(const memgraph::coordination::PromoteReplicaToMainRes &self, memgraph::slk::Builder *builder);
-
 void Load(memgraph::coordination::PromoteReplicaToMainRes *self, memgraph::slk::Reader *reader);
-
 void Save(const memgraph::coordination::PromoteReplicaToMainReq &self, memgraph::slk::Builder *builder);
-
 void Load(memgraph::coordination::PromoteReplicaToMainReq *self, memgraph::slk::Reader *reader);
 
-void Save(const memgraph::coordination::SetMainToReplicaRes &self, memgraph::slk::Builder *builder);
+// DemoteMainToReplicaRpc
+void Save(const memgraph::coordination::DemoteMainToReplicaRes &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::DemoteMainToReplicaRes *self, memgraph::slk::Reader *reader);
+void Save(const memgraph::coordination::DemoteMainToReplicaReq &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::DemoteMainToReplicaReq *self, memgraph::slk::Reader *reader);
 
-void Load(memgraph::coordination::SetMainToReplicaRes *self, memgraph::slk::Reader *reader);
+// GetInstanceUUIDRpc
+void Save(const memgraph::coordination::GetInstanceUUIDReq &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::GetInstanceUUIDReq *self, memgraph::slk::Reader *reader);
+void Save(const memgraph::coordination::GetInstanceUUIDRes &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::GetInstanceUUIDRes *self, memgraph::slk::Reader *reader);
+// UnregisterReplicaRpc
+void Save(memgraph::coordination::UnregisterReplicaRes const &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::UnregisterReplicaRes *self, memgraph::slk::Reader *reader);
+void Save(memgraph::coordination::UnregisterReplicaReq const &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::UnregisterReplicaReq *self, memgraph::slk::Reader *reader);
 
-void Save(const memgraph::coordination::SetMainToReplicaReq &self, memgraph::slk::Builder *builder);
-
-void Load(memgraph::coordination::SetMainToReplicaReq *self, memgraph::slk::Reader *reader);
+void Save(memgraph::coordination::EnableWritingOnMainRes const &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::EnableWritingOnMainRes *self, memgraph::slk::Reader *reader);
 
 }  // namespace memgraph::slk
 

src/coordination/include/coordination/coordinator_state.hpp

@@ -13,10 +13,9 @@
 
 #ifdef MG_ENTERPRISE
 
-#include "coordination/coordinator_data.hpp"
-#include "coordination/coordinator_instance_status.hpp"
+#include "coordination/coordinator_instance.hpp"
 #include "coordination/coordinator_server.hpp"
-#include "coordination/failover_status.hpp"
+#include "coordination/instance_status.hpp"
 #include "coordination/register_main_replica_coordinator_status.hpp"
 
 #include <variant>
@@ -28,25 +27,30 @@ class CoordinatorState {
   CoordinatorState();
   ~CoordinatorState() = default;
 
-  CoordinatorState(const CoordinatorState &) = delete;
-  CoordinatorState &operator=(const CoordinatorState &) = delete;
+  CoordinatorState(CoordinatorState const &) = delete;
+  CoordinatorState &operator=(CoordinatorState const &) = delete;
 
   CoordinatorState(CoordinatorState &&) noexcept = delete;
   CoordinatorState &operator=(CoordinatorState &&) noexcept = delete;
 
-  [[nodiscard]] auto RegisterInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus;
 
-  [[nodiscard]] auto SetInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
+  [[nodiscard]] auto SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
 
-  auto ShowInstances() const -> std::vector<CoordinatorInstanceStatus>;
+  auto ShowInstances() const -> std::vector<InstanceStatus>;
 
-  // The client code must check that the server exists before calling this method.
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+
+  // NOTE: The client code must check that the server exists before calling this method.
   auto GetCoordinatorServer() const -> CoordinatorServer &;
 
-  [[nodiscard]] auto DoFailover() -> DoFailoverStatus;
-
  private:
-  std::variant<CoordinatorData, CoordinatorMainReplicaData> data_;
+  struct CoordinatorMainReplicaData {
+    std::unique_ptr<CoordinatorServer> coordinator_server_;
+  };
+
+  std::variant<CoordinatorInstance, CoordinatorMainReplicaData> data_;
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/instance_status.hpp

@@ -19,10 +19,13 @@
 
 namespace memgraph::coordination {
 
-struct CoordinatorInstanceStatus {
+// TODO: (andi) For phase IV. Some instances won't have raft_socket_address, coord_socket_address, replication_role and
+// cluster role... At the end, all instances will have everything.
+struct InstanceStatus {
   std::string instance_name;
-  std::string socket_address;
-  std::string replication_role;
+  std::string raft_socket_address;
+  std::string coord_socket_address;
+  std::string cluster_role;
   bool is_alive;
 };
 

src/coordination/include/coordination/raft_state.hpp

@@ -0,0 +1,79 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include <flags/replication.hpp>
+
+#include <libnuraft/nuraft.hxx>
+
+namespace memgraph::coordination {
+
+using BecomeLeaderCb = std::function<void()>;
+using BecomeFollowerCb = std::function<void()>;
+
+using nuraft::buffer;
+using nuraft::logger;
+using nuraft::ptr;
+using nuraft::raft_launcher;
+using nuraft::raft_server;
+using nuraft::srv_config;
+using nuraft::state_machine;
+using nuraft::state_mgr;
+using raft_result = nuraft::cmd_result<ptr<buffer>>;
+
+class RaftState {
+ private:
+  explicit RaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb, uint32_t raft_server_id,
+                     uint32_t raft_port, std::string raft_address);
+
+  auto InitRaftServer() -> void;
+
+ public:
+  RaftState() = delete;
+  RaftState(RaftState const &other) = default;
+  RaftState &operator=(RaftState const &other) = default;
+  RaftState(RaftState &&other) noexcept = default;
+  RaftState &operator=(RaftState &&other) noexcept = default;
+  ~RaftState();
+
+  static auto MakeRaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb) -> RaftState;
+
+  auto InstanceName() const -> std::string;
+  auto RaftSocketAddress() const -> std::string;
+
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+  auto GetAllCoordinators() const -> std::vector<ptr<srv_config>>;
+
+  auto RequestLeadership() -> bool;
+  auto IsLeader() const -> bool;
+
+  auto AppendRegisterReplicationInstance(std::string const &instance) -> ptr<raft_result>;
+
+  // TODO: (andi) I think variables below can be abstracted
+  uint32_t raft_server_id_;
+  uint32_t raft_port_;
+  std::string raft_address_;
+
+  ptr<state_machine> state_machine_;
+  ptr<state_mgr> state_manager_;
+  ptr<raft_server> raft_server_;
+  ptr<logger> logger_;
+  raft_launcher launcher_;
+
+  BecomeLeaderCb become_leader_cb_;
+  BecomeFollowerCb become_follower_cb_;
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/include/coordination/register_main_replica_coordinator_status.hpp

@@ -19,18 +19,31 @@ namespace memgraph::coordination {
 
 enum class RegisterInstanceCoordinatorStatus : uint8_t {
   NAME_EXISTS,
-  END_POINT_EXISTS,
-  COULD_NOT_BE_PERSISTED,
+  ENDPOINT_EXISTS,
   NOT_COORDINATOR,
   RPC_FAILED,
+  NOT_LEADER,
+  RAFT_COULD_NOT_ACCEPT,
+  RAFT_COULD_NOT_APPEND,
   SUCCESS
 };
 
+enum class UnregisterInstanceCoordinatorStatus : uint8_t {
+  NO_INSTANCE_WITH_NAME,
+  IS_MAIN,
+  NOT_COORDINATOR,
+  NOT_LEADER,
+  RPC_FAILED,
+  SUCCESS,
+};
+
 enum class SetInstanceToMainCoordinatorStatus : uint8_t {
   NO_INSTANCE_WITH_NAME,
+  MAIN_ALREADY_EXISTS,
   NOT_COORDINATOR,
   SUCCESS,
   COULD_NOT_PROMOTE_TO_MAIN,
+  SWAP_UUID_FAILED
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/replication_instance.hpp

@@ -0,0 +1,99 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_client.hpp"
+#include "coordination/coordinator_exceptions.hpp"
+#include "replication_coordination_glue/role.hpp"
+
+#include <libnuraft/nuraft.hxx>
+#include "utils/result.hpp"
+#include "utils/uuid.hpp"
+
+namespace memgraph::coordination {
+
+class CoordinatorInstance;
+
+class ReplicationInstance {
+ public:
+  ReplicationInstance(CoordinatorInstance *peer, CoordinatorClientConfig config, HealthCheckCallback succ_cb,
+                      HealthCheckCallback fail_cb);
+
+  ReplicationInstance(ReplicationInstance const &other) = delete;
+  ReplicationInstance &operator=(ReplicationInstance const &other) = delete;
+  ReplicationInstance(ReplicationInstance &&other) noexcept = delete;
+  ReplicationInstance &operator=(ReplicationInstance &&other) noexcept = delete;
+  ~ReplicationInstance() = default;
+
+  auto OnSuccessPing() -> void;
+  auto OnFailPing() -> bool;
+  auto IsReadyForUUIDPing() -> bool;
+
+  void UpdateReplicaLastResponseUUID();
+
+  auto IsAlive() const -> bool;
+
+  auto InstanceName() const -> std::string;
+  auto SocketAddress() const -> std::string;
+
+  auto IsReplica() const -> bool;
+  auto IsMain() const -> bool;
+
+  auto PromoteToMain(utils::UUID uuid, ReplicationClientsInfo repl_clients_info, HealthCheckCallback main_succ_cb,
+                     HealthCheckCallback main_fail_cb) -> bool;
+  auto DemoteToReplica(HealthCheckCallback replica_succ_cb, HealthCheckCallback replica_fail_cb) -> bool;
+
+  auto StartFrequentCheck() -> void;
+  auto StopFrequentCheck() -> void;
+  auto PauseFrequentCheck() -> void;
+  auto ResumeFrequentCheck() -> void;
+
+  auto ReplicationClientInfo() const -> ReplClientInfo;
+
+  auto EnsureReplicaHasCorrectMainUUID(utils::UUID const &curr_main_uuid) -> bool;
+
+  auto SendSwapAndUpdateUUID(const utils::UUID &new_main_uuid) -> bool;
+  auto SendUnregisterReplicaRpc(std::string const &instance_name) -> bool;
+
+
+  auto SendGetInstanceUUID() -> utils::BasicResult<coordination::GetInstanceUUIDError, std::optional<utils::UUID>>;
+  auto GetClient() -> CoordinatorClient &;
+
+  auto EnableWritingOnMain() -> bool;
+
+  auto SetNewMainUUID(utils::UUID const &main_uuid) -> void;
+  auto ResetMainUUID() -> void;
+  auto GetMainUUID() const -> const std::optional<utils::UUID> &;
+
+ private:
+  CoordinatorClient client_;
+  replication_coordination_glue::ReplicationRole replication_role_;
+  std::chrono::system_clock::time_point last_response_time_{};
+  bool is_alive_{false};
+  std::chrono::system_clock::time_point last_check_of_uuid_{};
+
+  // for replica this is main uuid of current main
+  // for "main" main this same as in CoordinatorData
+  // it is set to nullopt when replica is down
+  // TLDR; when replica is down and comes back up we reset uuid of main replica is listening to
+  // so we need to send swap uuid again
+  std::optional<utils::UUID> main_uuid_;
+
+  friend bool operator==(ReplicationInstance const &first, ReplicationInstance const &second) {
+    return first.client_ == second.client_ && first.replication_role_ == second.replication_role_;
+  }
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/include/coordination/rpc_errors.hpp

@@ -9,14 +9,6 @@
 // by the Apache License, Version 2.0, included in the file
 // licenses/APL.txt.
 
-#pragma once
-
 namespace memgraph::coordination {
-
-#ifdef MG_EXPERIMENTAL_HIGH_AVAILABILITY
-constexpr bool allow_ha = true;
-#else
-constexpr bool allow_ha = false;
-#endif
-
+enum class GetInstanceUUIDError { NO_RESPONSE, RPC_EXCEPTION };
 }  // namespace memgraph::coordination

src/coordination/include/nuraft/coordinator_log_store.hpp

@@ -0,0 +1,70 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include <libnuraft/nuraft.hxx>
+
+namespace memgraph::coordination {
+
+using nuraft::buffer;
+using nuraft::int32;
+using nuraft::int64;
+using nuraft::log_entry;
+using nuraft::log_store;
+using nuraft::ptr;
+using nuraft::raft_server;
+
+class CoordinatorLogStore : public log_store {
+ public:
+  CoordinatorLogStore();
+  CoordinatorLogStore(CoordinatorLogStore const &) = delete;
+  CoordinatorLogStore &operator=(CoordinatorLogStore const &) = delete;
+  CoordinatorLogStore(CoordinatorLogStore &&) = delete;
+  CoordinatorLogStore &operator=(CoordinatorLogStore &&) = delete;
+  ~CoordinatorLogStore() override;
+
+  ulong next_slot() const override;
+
+  ulong start_index() const override;
+
+  ptr<log_entry> last_entry() const override;
+
+  ulong append(ptr<log_entry> &entry) override;
+
+  void write_at(ulong index, ptr<log_entry> &entry) override;
+
+  ptr<std::vector<ptr<log_entry>>> log_entries(ulong start, ulong end) override;
+
+  ptr<log_entry> entry_at(ulong index) override;
+
+  ulong term_at(ulong index) override;
+
+  ptr<buffer> pack(ulong index, int32 cnt) override;
+
+  void apply_pack(ulong index, buffer &pack) override;
+
+  bool compact(ulong last_log_index) override;
+
+  bool flush() override;
+
+ private:
+  auto FindOrDefault_(ulong index) const -> ptr<log_entry>;
+
+  std::map<ulong, ptr<log_entry>> logs_;
+  mutable std::mutex logs_lock_;
+  std::atomic<ulong> start_idx_;
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/include/nuraft/coordinator_state_machine.hpp

@@ -0,0 +1,76 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include <spdlog/spdlog.h>
+#include <libnuraft/nuraft.hxx>
+
+namespace memgraph::coordination {
+
+using nuraft::async_result;
+using nuraft::buffer;
+using nuraft::buffer_serializer;
+using nuraft::cluster_config;
+using nuraft::int32;
+using nuraft::ptr;
+using nuraft::snapshot;
+using nuraft::state_machine;
+
+class CoordinatorStateMachine : public state_machine {
+ public:
+  CoordinatorStateMachine() = default;
+  CoordinatorStateMachine(CoordinatorStateMachine const &) = delete;
+  CoordinatorStateMachine &operator=(CoordinatorStateMachine const &) = delete;
+  CoordinatorStateMachine(CoordinatorStateMachine &&) = delete;
+  CoordinatorStateMachine &operator=(CoordinatorStateMachine &&) = delete;
+  ~CoordinatorStateMachine() override {}
+
+  static auto EncodeRegisterReplicationInstance(const std::string &name) -> ptr<buffer>;
+
+  static auto DecodeRegisterReplicationInstance(buffer &data) -> std::string;
+
+  auto pre_commit(ulong log_idx, buffer &data) -> ptr<buffer> override;
+
+  auto commit(ulong log_idx, buffer &data) -> ptr<buffer> override;
+
+  auto commit_config(ulong log_idx, ptr<cluster_config> & /*new_conf*/) -> void override;
+
+  auto rollback(ulong log_idx, buffer &data) -> void override;
+
+  auto read_logical_snp_obj(snapshot & /*snapshot*/, void *& /*user_snp_ctx*/, ulong /*obj_id*/, ptr<buffer> &data_out,
+                            bool &is_last_obj) -> int override;
+
+  auto save_logical_snp_obj(snapshot &s, ulong &obj_id, buffer & /*data*/, bool /*is_first_obj*/, bool /*is_last_obj*/)
+      -> void override;
+
+  auto apply_snapshot(snapshot &s) -> bool override;
+
+  auto free_user_snp_ctx(void *&user_snp_ctx) -> void override;
+
+  auto last_snapshot() -> ptr<snapshot> override;
+
+  auto last_commit_index() -> ulong override;
+
+  auto create_snapshot(snapshot &s, async_result<bool>::handler_type &when_done) -> void override;
+
+ private:
+  std::atomic<uint64_t> last_committed_idx_{0};
+
+  ptr<snapshot> last_snapshot_;
+
+  std::mutex last_snapshot_lock_;
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/include/nuraft/coordinator_state_manager.hpp

@@ -0,0 +1,66 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include "nuraft/coordinator_log_store.hpp"
+
+#include <spdlog/spdlog.h>
+#include <libnuraft/nuraft.hxx>
+
+namespace memgraph::coordination {
+
+using nuraft::cluster_config;
+using nuraft::cs_new;
+using nuraft::srv_config;
+using nuraft::srv_state;
+using nuraft::state_mgr;
+
+class CoordinatorStateManager : public state_mgr {
+ public:
+  explicit CoordinatorStateManager(int srv_id, std::string const &endpoint);
+
+  CoordinatorStateManager(CoordinatorStateManager const &) = delete;
+  CoordinatorStateManager &operator=(CoordinatorStateManager const &) = delete;
+  CoordinatorStateManager(CoordinatorStateManager &&) = delete;
+  CoordinatorStateManager &operator=(CoordinatorStateManager &&) = delete;
+
+  ~CoordinatorStateManager() override = default;
+
+  auto load_config() -> ptr<cluster_config> override;
+
+  auto save_config(cluster_config const &config) -> void override;
+
+  auto save_state(srv_state const &state) -> void override;
+
+  auto read_state() -> ptr<srv_state> override;
+
+  auto load_log_store() -> ptr<log_store> override;
+
+  auto server_id() -> int32 override;
+
+  auto system_exit(int exit_code) -> void override;
+
+  auto GetSrvConfig() const -> ptr<srv_config>;
+
+ private:
+  int my_id_;
+  std::string my_endpoint_;
+  ptr<CoordinatorLogStore> cur_log_store_;
+  ptr<srv_config> my_srv_config_;
+  ptr<cluster_config> cluster_config_;
+  ptr<srv_state> saved_state_;
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/raft_state.cpp

@@ -0,0 +1,140 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/raft_state.hpp"
+
+#include "coordination/coordinator_exceptions.hpp"
+#include "nuraft/coordinator_state_machine.hpp"
+#include "nuraft/coordinator_state_manager.hpp"
+#include "utils/counter.hpp"
+
+namespace memgraph::coordination {
+
+using nuraft::asio_service;
+using nuraft::cb_func;
+using nuraft::CbReturnCode;
+using nuraft::cmd_result;
+using nuraft::cs_new;
+using nuraft::ptr;
+using nuraft::raft_params;
+using nuraft::raft_server;
+using nuraft::srv_config;
+using raft_result = cmd_result<ptr<buffer>>;
+
+RaftState::RaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb, uint32_t raft_server_id,
+                     uint32_t raft_port, std::string raft_address)
+    : raft_server_id_(raft_server_id),
+      raft_port_(raft_port),
+      raft_address_(std::move(raft_address)),
+      state_machine_(cs_new<CoordinatorStateMachine>()),
+      state_manager_(
+          cs_new<CoordinatorStateManager>(raft_server_id_, raft_address_ + ":" + std::to_string(raft_port_))),
+      logger_(nullptr),
+      become_leader_cb_(std::move(become_leader_cb)),
+      become_follower_cb_(std::move(become_follower_cb)) {}
+
+auto RaftState::InitRaftServer() -> void {
+  asio_service::options asio_opts;
+  asio_opts.thread_pool_size_ = 1;  // TODO: (andi) Improve this
+
+  raft_params params;
+  params.heart_beat_interval_ = 100;
+  params.election_timeout_lower_bound_ = 200;
+  params.election_timeout_upper_bound_ = 400;
+  // 5 logs are preserved before the last snapshot
+  params.reserved_log_items_ = 5;
+  // Create snapshot for every 5 log appends
+  params.snapshot_distance_ = 5;
+  params.client_req_timeout_ = 3000;
+  params.return_method_ = raft_params::blocking;
+
+  raft_server::init_options init_opts;
+  init_opts.raft_callback_ = [this](cb_func::Type event_type, cb_func::Param *param) -> nuraft::CbReturnCode {
+    if (event_type == cb_func::BecomeLeader) {
+      spdlog::info("Node {} became leader", param->leaderId);
+      become_leader_cb_();
+    } else if (event_type == cb_func::BecomeFollower) {
+      spdlog::info("Node {} became follower", param->myId);
+      become_follower_cb_();
+    }
+    return CbReturnCode::Ok;
+  };
+
+  raft_launcher launcher;
+
+  raft_server_ = launcher.init(state_machine_, state_manager_, logger_, static_cast<int>(raft_port_), asio_opts, params,
+                               init_opts);
+
+  if (!raft_server_) {
+    throw RaftServerStartException("Failed to launch raft server on {}:{}", raft_address_, raft_port_);
+  }
+
+  auto maybe_stop = utils::ResettableCounter<20>();
+  do {
+    if (raft_server_->is_initialized()) {
+      return;
+    }
+    std::this_thread::sleep_for(std::chrono::milliseconds(250));
+  } while (!maybe_stop());
+
+  throw RaftServerStartException("Failed to initialize raft server on {}:{}", raft_address_, raft_port_);
+}
+
+auto RaftState::MakeRaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb) -> RaftState {
+  uint32_t raft_server_id{0};
+  uint32_t raft_port{0};
+  try {
+    raft_server_id = FLAGS_raft_server_id;
+    raft_port = FLAGS_raft_server_port;
+  } catch (std::exception const &e) {
+    throw RaftCouldNotParseFlagsException("Failed to parse flags: {}", e.what());
+  }
+
+  auto raft_state =
+      RaftState(std::move(become_leader_cb), std::move(become_follower_cb), raft_server_id, raft_port, "127.0.0.1");
+  raft_state.InitRaftServer();
+  return raft_state;
+}
+
+RaftState::~RaftState() { launcher_.shutdown(); }
+
+auto RaftState::InstanceName() const -> std::string { return "coordinator_" + std::to_string(raft_server_id_); }
+
+auto RaftState::RaftSocketAddress() const -> std::string { return raft_address_ + ":" + std::to_string(raft_port_); }
+
+auto RaftState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void {
+  auto const endpoint = raft_address + ":" + std::to_string(raft_port);
+  srv_config const srv_config_to_add(static_cast<int>(raft_server_id), endpoint);
+  if (!raft_server_->add_srv(srv_config_to_add)->get_accepted()) {
+    throw RaftAddServerException("Failed to add server {} to the cluster", endpoint);
+  }
+  spdlog::info("Request to add server {} to the cluster accepted", endpoint);
+}
+
+auto RaftState::GetAllCoordinators() const -> std::vector<ptr<srv_config>> {
+  std::vector<ptr<srv_config>> all_srv_configs;
+  raft_server_->get_srv_config_all(all_srv_configs);
+  return all_srv_configs;
+}
+
+auto RaftState::IsLeader() const -> bool { return raft_server_->is_leader(); }
+
+auto RaftState::RequestLeadership() -> bool { return raft_server_->is_leader() || raft_server_->request_leadership(); }
+
+auto RaftState::AppendRegisterReplicationInstance(std::string const &instance) -> ptr<raft_result> {
+  auto new_log = CoordinatorStateMachine::EncodeRegisterReplicationInstance(instance);
+  return raft_server_->append_entries({new_log});
+}
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/replication_instance.cpp

@@ -0,0 +1,138 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/replication_instance.hpp"
+
+#include "replication_coordination_glue/handler.hpp"
+#include "utils/result.hpp"
+
+namespace memgraph::coordination {
+
+ReplicationInstance::ReplicationInstance(CoordinatorInstance *peer, CoordinatorClientConfig config,
+                                         HealthCheckCallback succ_cb, HealthCheckCallback fail_cb)
+    : client_(peer, std::move(config), std::move(succ_cb), std::move(fail_cb)),
+      replication_role_(replication_coordination_glue::ReplicationRole::REPLICA) {
+  if (!client_.DemoteToReplica()) {
+    throw CoordinatorRegisterInstanceException("Failed to demote instance {} to replica", client_.InstanceName());
+  }
+
+  client_.StartFrequentCheck();
+}
+
+auto ReplicationInstance::OnSuccessPing() -> void {
+  last_response_time_ = std::chrono::system_clock::now();
+  is_alive_ = true;
+}
+
+auto ReplicationInstance::OnFailPing() -> bool {
+  auto elapsed_time = std::chrono::system_clock::now() - last_response_time_;
+  is_alive_ = elapsed_time < client_.InstanceDownTimeoutSec();
+  return is_alive_;
+}
+
+auto ReplicationInstance::IsReadyForUUIDPing() -> bool {
+  return std::chrono::duration_cast<std::chrono::seconds>(std::chrono::system_clock::now() - last_check_of_uuid_) >
+         client_.InstanceGetUUIDFrequencySec();
+}
+
+auto ReplicationInstance::InstanceName() const -> std::string { return client_.InstanceName(); }
+auto ReplicationInstance::SocketAddress() const -> std::string { return client_.SocketAddress(); }
+auto ReplicationInstance::IsAlive() const -> bool { return is_alive_; }
+
+auto ReplicationInstance::IsReplica() const -> bool {
+  return replication_role_ == replication_coordination_glue::ReplicationRole::REPLICA;
+}
+auto ReplicationInstance::IsMain() const -> bool {
+  return replication_role_ == replication_coordination_glue::ReplicationRole::MAIN;
+}
+
+auto ReplicationInstance::PromoteToMain(utils::UUID new_uuid, ReplicationClientsInfo repl_clients_info,
+                                        HealthCheckCallback main_succ_cb, HealthCheckCallback main_fail_cb) -> bool {
+  if (!client_.SendPromoteReplicaToMainRpc(new_uuid, std::move(repl_clients_info))) {
+    return false;
+  }
+
+  replication_role_ = replication_coordination_glue::ReplicationRole::MAIN;
+  main_uuid_ = new_uuid;
+  client_.SetCallbacks(std::move(main_succ_cb), std::move(main_fail_cb));
+
+  return true;
+}
+
+auto ReplicationInstance::DemoteToReplica(HealthCheckCallback replica_succ_cb, HealthCheckCallback replica_fail_cb)
+    -> bool {
+  if (!client_.DemoteToReplica()) {
+    return false;
+  }
+
+  replication_role_ = replication_coordination_glue::ReplicationRole::REPLICA;
+  client_.SetCallbacks(std::move(replica_succ_cb), std::move(replica_fail_cb));
+
+  return true;
+}
+
+auto ReplicationInstance::StartFrequentCheck() -> void { client_.StartFrequentCheck(); }
+auto ReplicationInstance::StopFrequentCheck() -> void { client_.StopFrequentCheck(); }
+auto ReplicationInstance::PauseFrequentCheck() -> void { client_.PauseFrequentCheck(); }
+auto ReplicationInstance::ResumeFrequentCheck() -> void { client_.ResumeFrequentCheck(); }
+
+auto ReplicationInstance::ReplicationClientInfo() const -> CoordinatorClientConfig::ReplicationClientInfo {
+  return client_.ReplicationClientInfo();
+}
+
+auto ReplicationInstance::GetClient() -> CoordinatorClient & { return client_; }
+
+auto ReplicationInstance::SetNewMainUUID(utils::UUID const &main_uuid) -> void { main_uuid_ = main_uuid; }
+auto ReplicationInstance::ResetMainUUID() -> void { main_uuid_ = std::nullopt; }
+auto ReplicationInstance::GetMainUUID() const -> std::optional<utils::UUID> const & { return main_uuid_; }
+
+auto ReplicationInstance::EnsureReplicaHasCorrectMainUUID(utils::UUID const &curr_main_uuid) -> bool {
+  if (!IsReadyForUUIDPing()) {
+    return true;
+  }
+  auto res = SendGetInstanceUUID();
+  if (res.HasError()) {
+    return false;
+  }
+  UpdateReplicaLastResponseUUID();
+
+  if (res.GetValue().has_value() && res.GetValue().value() == curr_main_uuid) {
+    return true;
+  }
+
+  return SendSwapAndUpdateUUID(curr_main_uuid);
+}
+
+auto ReplicationInstance::SendSwapAndUpdateUUID(const utils::UUID &new_main_uuid) -> bool {
+  if (!replication_coordination_glue::SendSwapMainUUIDRpc(client_.RpcClient(), new_main_uuid)) {
+    return false;
+  }
+  SetNewMainUUID(new_main_uuid);
+  return true;
+}
+
+auto ReplicationInstance::SendUnregisterReplicaRpc(std::string const &instance_name) -> bool {
+  return client_.SendUnregisterReplicaRpc(instance_name);
+}
+
+auto ReplicationInstance::EnableWritingOnMain() -> bool { return client_.SendEnableWritingOnMainRpc(); }
+
+auto ReplicationInstance::SendGetInstanceUUID()
+    -> utils::BasicResult<coordination::GetInstanceUUIDError, std::optional<utils::UUID>> {
+  return client_.SendGetInstanceUUIDRpc();
+}
+
+void ReplicationInstance::UpdateReplicaLastResponseUUID() { last_check_of_uuid_ = std::chrono::system_clock::now(); }
+
+}  // namespace memgraph::coordination
+#endif

src/dbms/CMakeLists.txt

@@ -1,2 +1,10 @@
-add_library(mg-dbms STATIC dbms_handler.cpp database.cpp replication_handler.cpp coordinator_handler.cpp replication_client.cpp inmemory/replication_handlers.cpp coordinator_handlers.cpp)
-target_link_libraries(mg-dbms mg-utils mg-storage-v2 mg-query mg-replication mg-coordination)
+add_library(mg-dbms STATIC
+        dbms_handler.cpp
+        database.cpp
+        coordinator_handler.cpp
+        inmemory/replication_handlers.cpp
+        replication_handlers.cpp
+        rpc.cpp
+
+)
+target_link_libraries(mg-dbms mg-utils mg-storage-v2 mg-query mg-auth mg-replication mg-coordination)

src/dbms/constants.hpp

@@ -16,10 +16,4 @@ namespace memgraph::dbms {
 constexpr std::string_view kDefaultDB = "memgraph";        //!< Name of the default database
 constexpr std::string_view kMultiTenantDir = "databases";  //!< Name of the multi-tenant directory
 
-#ifdef MG_EXPERIMENTAL_REPLICATION_MULTITENANCY
-constexpr bool allow_mt_repl = true;
-#else
-constexpr bool allow_mt_repl = false;
-#endif
-
 }  // namespace memgraph::dbms

src/dbms/coordinator_handler.cpp

@@ -9,30 +9,41 @@
 // by the Apache License, Version 2.0, included in the file
 // licenses/APL.txt.
 
-#include "coordination/register_main_replica_coordinator_status.hpp"
 #ifdef MG_ENTERPRISE
 
 #include "dbms/coordinator_handler.hpp"
 
-#include "dbms/dbms_handler.hpp"
+#include "coordination/register_main_replica_coordinator_status.hpp"
 
 namespace memgraph::dbms {
 
-CoordinatorHandler::CoordinatorHandler(DbmsHandler &dbms_handler) : dbms_handler_(dbms_handler) {}
+CoordinatorHandler::CoordinatorHandler(coordination::CoordinatorState &coordinator_state)
+    : coordinator_state_(coordinator_state) {}
 
-auto CoordinatorHandler::RegisterInstance(memgraph::coordination::CoordinatorClientConfig config)
+auto CoordinatorHandler::RegisterReplicationInstance(memgraph::coordination::CoordinatorClientConfig config)
     -> coordination::RegisterInstanceCoordinatorStatus {
-  return dbms_handler_.CoordinatorState().RegisterInstance(config);
+  return coordinator_state_.RegisterReplicationInstance(config);
 }
 
-auto CoordinatorHandler::SetInstanceToMain(std::string instance_name)
+auto CoordinatorHandler::UnregisterReplicationInstance(std::string instance_name)
+    -> coordination::UnregisterInstanceCoordinatorStatus {
+  return coordinator_state_.UnregisterReplicationInstance(std::move(instance_name));
+}
+
+auto CoordinatorHandler::SetReplicationInstanceToMain(std::string instance_name)
     -> coordination::SetInstanceToMainCoordinatorStatus {
-  return dbms_handler_.CoordinatorState().SetInstanceToMain(std::move(instance_name));
+  return coordinator_state_.SetReplicationInstanceToMain(std::move(instance_name));
 }
 
-auto CoordinatorHandler::ShowInstances() const -> std::vector<coordination::CoordinatorInstanceStatus> {
-  return dbms_handler_.CoordinatorState().ShowInstances();
+auto CoordinatorHandler::ShowInstances() const -> std::vector<coordination::InstanceStatus> {
+  return coordinator_state_.ShowInstances();
 }
+
+auto CoordinatorHandler::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
+    -> void {
+  coordinator_state_.AddCoordinatorInstance(raft_server_id, raft_port, std::move(raft_address));
+}
+
 }  // namespace memgraph::dbms
 
 #endif

src/dbms/coordinator_handler.hpp

@@ -13,15 +13,11 @@
 
 #ifdef MG_ENTERPRISE
 
-#include "utils/result.hpp"
-
 #include "coordination/coordinator_config.hpp"
-#include "coordination/coordinator_instance_status.hpp"
-#include "coordination/failover_status.hpp"
+#include "coordination/coordinator_state.hpp"
+#include "coordination/instance_status.hpp"
 #include "coordination/register_main_replica_coordinator_status.hpp"
 
-#include <cstdint>
-#include <optional>
 #include <vector>
 
 namespace memgraph::dbms {
@@ -30,17 +26,23 @@ class DbmsHandler;
 
 class CoordinatorHandler {
  public:
-  explicit CoordinatorHandler(DbmsHandler &dbms_handler);
+  explicit CoordinatorHandler(coordination::CoordinatorState &coordinator_state);
 
-  auto RegisterInstance(coordination::CoordinatorClientConfig config)
+  // TODO: (andi) When moving coordinator state on same instances, rename from RegisterReplicationInstance to
+  // RegisterInstance
+  auto RegisterReplicationInstance(coordination::CoordinatorClientConfig config)
       -> coordination::RegisterInstanceCoordinatorStatus;
 
-  auto SetInstanceToMain(std::string instance_name) -> coordination::SetInstanceToMainCoordinatorStatus;
+  auto UnregisterReplicationInstance(std::string instance_name) -> coordination::UnregisterInstanceCoordinatorStatus;
 
-  auto ShowInstances() const -> std::vector<coordination::CoordinatorInstanceStatus>;
+  auto SetReplicationInstanceToMain(std::string instance_name) -> coordination::SetInstanceToMainCoordinatorStatus;
+
+  auto ShowInstances() const -> std::vector<coordination::InstanceStatus>;
+
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
 
  private:
-  DbmsHandler &dbms_handler_;
+  coordination::CoordinatorState &coordinator_state_;
 };
 
 }  // namespace memgraph::dbms

src/dbms/coordinator_handlers.cpp

@@ -1,153 +0,0 @@
-// Copyright 2024 Memgraph Ltd.
-//
-// Use of this software is governed by the Business Source License
-// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
-// License, and you may not use this file except in compliance with the Business Source License.
-//
-// As of the Change Date specified in that file, in accordance with
-// the Business Source License, use of this software will be governed
-// by the Apache License, Version 2.0, included in the file
-// licenses/APL.txt.
-
-#ifdef MG_ENTERPRISE
-
-#include "dbms/coordinator_handlers.hpp"
-#include "dbms/utils.hpp"
-
-#include "coordination/coordinator_exceptions.hpp"
-#include "coordination/coordinator_rpc.hpp"
-#include "dbms/dbms_handler.hpp"
-#include "dbms/replication_client.hpp"
-
-#include "range/v3/view.hpp"
-
-namespace memgraph::dbms {
-
-void CoordinatorHandlers::Register(DbmsHandler &dbms_handler) {
-  auto &server = dbms_handler.CoordinatorState().GetCoordinatorServer();
-
-  server.Register<coordination::PromoteReplicaToMainRpc>(
-      [&dbms_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
-        spdlog::info("Received PromoteReplicaToMainRpc");
-        CoordinatorHandlers::PromoteReplicaToMainHandler(dbms_handler, req_reader, res_builder);
-      });
-
-  server.Register<coordination::SetMainToReplicaRpc>(
-      [&dbms_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
-        spdlog::info("Received SetMainToReplicaRpc from coordinator server");
-        CoordinatorHandlers::SetMainToReplicaHandler(dbms_handler, req_reader, res_builder);
-      });
-}
-
-void CoordinatorHandlers::SetMainToReplicaHandler(DbmsHandler &dbms_handler, slk::Reader *req_reader,
-                                                  slk::Builder *res_builder) {
-  auto &repl_state = dbms_handler.ReplicationState();
-
-  if (!repl_state.IsMain()) {
-    spdlog::error("Setting to replica must be performed on main.");
-    slk::Save(coordination::SetMainToReplicaRes{false}, res_builder);
-    return;
-  }
-
-  coordination::SetMainToReplicaReq req;
-  slk::Load(&req, req_reader);
-
-  replication::ReplicationServerConfig clients_config{.ip_address = req.replication_client_info.replication_ip_address,
-                                                      .port = req.replication_client_info.replication_port};
-
-  if (bool success = memgraph::dbms::SetReplicationRoleReplica(dbms_handler, clients_config); !success) {
-    spdlog::error("Setting main to replica failed!");
-    slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-    return;
-  }
-
-  slk::Save(coordination::PromoteReplicaToMainRes{true}, res_builder);
-}
-
-void CoordinatorHandlers::PromoteReplicaToMainHandler(DbmsHandler &dbms_handler, slk::Reader *req_reader,
-                                                      slk::Builder *res_builder) {
-  auto &repl_state = dbms_handler.ReplicationState();
-
-  if (!repl_state.IsReplica()) {
-    spdlog::error("Failover must be performed on replica!");
-    slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-    return;
-  }
-
-  auto repl_server_config = std::get<replication::RoleReplicaData>(repl_state.ReplicationData()).config;
-
-  // This can fail because of disk. If it does, the cluster state could get inconsistent.
-  // We don't handle disk issues.
-  if (bool success = memgraph::dbms::DoReplicaToMainPromotion(dbms_handler); !success) {
-    spdlog::error("Promoting replica to main failed!");
-    slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-    return;
-  }
-
-  coordination::PromoteReplicaToMainReq req;
-  slk::Load(&req, req_reader);
-
-  auto const converter = [](const auto &repl_info_config) {
-    return replication::ReplicationClientConfig{
-        .name = repl_info_config.instance_name,
-        .mode = repl_info_config.replication_mode,
-        .ip_address = repl_info_config.replication_ip_address,
-        .port = repl_info_config.replication_port,
-    };
-  };
-
-  MG_ASSERT(
-      std::get<replication::RoleMainData>(repl_state.ReplicationData()).registered_replicas_.empty(),
-      "No replicas should be registered after promoting replica to main and before registering replication clients!");
-
-  // registering replicas
-  for (auto const &config : req.replication_clients_info | ranges::views::transform(converter)) {
-    auto instance_client = repl_state.RegisterReplica(config);
-    if (instance_client.HasError()) {
-      switch (instance_client.GetError()) {
-        // Can't happen, we are already replica
-        case memgraph::replication::RegisterReplicaError::NOT_MAIN:
-          spdlog::error("Failover must be performed to main!");
-          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-          return;
-        // Can't happen, checked on the coordinator side
-        case memgraph::replication::RegisterReplicaError::NAME_EXISTS:
-          spdlog::error("Replica with the same name already exists!");
-          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-          return;
-        // Can't happen, checked on the coordinator side
-        case memgraph::replication::RegisterReplicaError::ENDPOINT_EXISTS:
-          spdlog::error("Replica with the same endpoint already exists!");
-          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-          return;
-        // We don't handle disk issues
-        case memgraph::replication::RegisterReplicaError::COULD_NOT_BE_PERSISTED:
-          spdlog::error("Registered replica could not be persisted!");
-          slk::Save(coordination::PromoteReplicaToMainRes{false}, res_builder);
-          return;
-        case memgraph::replication::RegisterReplicaError::SUCCESS:
-          break;
-      }
-    }
-    if (!allow_mt_repl && dbms_handler.All().size() > 1) {
-      spdlog::warn("Multi-tenant replication is currently not supported!");
-    }
-
-    auto &instance_client_ref = *instance_client.GetValue();
-
-    // Update system before enabling individual storage <-> replica clients
-    dbms_handler.SystemRestore(instance_client_ref);
-
-    // TODO: (andi) Policy for register all databases
-    // Will be resolved after deciding about choosing new replica
-    const bool all_clients_good = memgraph::dbms::RegisterAllDatabasesClients(dbms_handler, instance_client_ref);
-    MG_ASSERT(all_clients_good, "Failed to register one or more databases to the REPLICA \"{}\".", config.name);
-
-    StartReplicaClient(dbms_handler, instance_client_ref);
-  }
-
-  slk::Save(coordination::PromoteReplicaToMainRes{true}, res_builder);
-}
-
-}  // namespace memgraph::dbms
-#endif

src/dbms/coordinator_handlers.hpp

@@ -1,34 +0,0 @@
-// Copyright 2024 Memgraph Ltd.
-//
-// Use of this software is governed by the Business Source License
-// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
-// License, and you may not use this file except in compliance with the Business Source License.
-//
-// As of the Change Date specified in that file, in accordance with
-// the Business Source License, use of this software will be governed
-// by the Apache License, Version 2.0, included in the file
-// licenses/APL.txt.
-
-#pragma once
-
-#ifdef MG_ENTERPRISE
-
-#include "slk/serialization.hpp"
-
-namespace memgraph::dbms {
-
-class DbmsHandler;
-
-class CoordinatorHandlers {
- public:
-  static void Register(DbmsHandler &dbms_handler);
-
- private:
-  static void PromoteReplicaToMainHandler(DbmsHandler &dbms_handler, slk::Reader *req_reader,
-                                          slk::Builder *res_builder);
-  static void SetMainToReplicaHandler(DbmsHandler &dbms_handler, slk::Reader *req_reader, slk::Builder *res_builder);
-};
-
-}  // namespace memgraph::dbms
-
-#endif

src/dbms/database.cpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -11,10 +11,7 @@
 
 #include "dbms/database.hpp"
 #include "dbms/inmemory/storage_helper.hpp"
-#include "dbms/replication_handler.hpp"
-#include "flags/storage_mode.hpp"
 #include "storage/v2/disk/storage.hpp"
-#include "storage/v2/inmemory/storage.hpp"
 #include "storage/v2/storage_mode.hpp"
 
 template struct memgraph::utils::Gatekeeper<memgraph::dbms::Database>;

src/dbms/dbms_handler.cpp

@@ -11,29 +11,76 @@
 
 #include "dbms/dbms_handler.hpp"
 
-#include "dbms/coordinator_handlers.hpp"
-#include "flags/replication.hpp"
-
 #include <cstdint>
 #include <filesystem>
 
 #include "dbms/constants.hpp"
 #include "dbms/global.hpp"
-#include "dbms/replication_client.hpp"
+#include "flags/experimental.hpp"
 #include "spdlog/spdlog.h"
+#include "system/include/system/system.hpp"
 #include "utils/exceptions.hpp"
 #include "utils/logging.hpp"
 #include "utils/uuid.hpp"
 
 namespace memgraph::dbms {
 
-#ifdef MG_ENTERPRISE
-
 namespace {
-constexpr std::string_view kDBPrefix = "database:";                               // Key prefix for database durability
-constexpr std::string_view kLastCommitedSystemTsKey = "last_commited_system_ts";  // Key for timestamp durability
+constexpr std::string_view kDBPrefix = "database:";  // Key prefix for database durability
+
+std::string RegisterReplicaErrorToString(query::RegisterReplicaError error) {
+  switch (error) {
+    using enum query::RegisterReplicaError;
+    case NAME_EXISTS:
+      return "NAME_EXISTS";
+    case ENDPOINT_EXISTS:
+      return "ENDPOINT_EXISTS";
+    case CONNECTION_FAILED:
+      return "CONNECTION_FAILED";
+    case COULD_NOT_BE_PERSISTED:
+      return "COULD_NOT_BE_PERSISTED";
+    case ERROR_ACCEPTING_MAIN:
+      return "ERROR_ACCEPTING_MAIN";
+  }
+}
+
+// Per storage
+// NOTE Storage will connect to all replicas. Future work might change this
+void RestoreReplication(replication::RoleMainData &mainData, DatabaseAccess db_acc) {
+  spdlog::info("Restoring replication role.");
+
+  // Each individual client has already been restored and started. Here we just go through each database and start its
+  // client
+  for (auto &instance_client : mainData.registered_replicas_) {
+    spdlog::info("Replica {} restoration started for {}.", instance_client.name_, db_acc->name());
+    const auto &ret = db_acc->storage()->repl_storage_state_.replication_clients_.WithLock(
+        [&, db_acc](auto &storage_clients) mutable -> utils::BasicResult<query::RegisterReplicaError> {
+          auto client = std::make_unique<storage::ReplicationStorageClient>(instance_client, mainData.uuid_);
+          auto *storage = db_acc->storage();
+          client->Start(storage, std::move(db_acc));
+          // After start the storage <-> replica state should be READY or RECOVERING (if correctly started)
+          // MAYBE_BEHIND isn't a statement of the current state, this is the default value
+          // Failed to start due to branching of MAIN and REPLICA
+          if (client->State() == storage::replication::ReplicaState::MAYBE_BEHIND) {
+            spdlog::warn("Connection failed when registering replica {}. Replica will still be registered.",
+                         instance_client.name_);
+          }
+          storage_clients.push_back(std::move(client));
+          return {};
+        });
+
+    if (ret.HasError()) {
+      MG_ASSERT(query::RegisterReplicaError::CONNECTION_FAILED != ret.GetError());
+      LOG_FATAL("Failure when restoring replica {}: {}.", instance_client.name_,
+                RegisterReplicaErrorToString(ret.GetError()));
+    }
+    spdlog::info("Replica {} restored for {}.", instance_client.name_, db_acc->name());
+  }
+  spdlog::info("Replication role restored to MAIN.");
+}
 }  // namespace
 
+#ifdef MG_ENTERPRISE
 struct Durability {
   enum class DurabilityVersion : uint8_t {
     V0 = 0,
@@ -112,11 +159,9 @@ struct Durability {
   }
 };
 
-DbmsHandler::DbmsHandler(
-    storage::Config config,
-    memgraph::utils::Synchronized<memgraph::auth::Auth, memgraph::utils::WritePrioritizedRWLock> *auth,
-    bool recovery_on_startup)
-    : default_config_{std::move(config)}, repl_state_{ReplicationStateRootPath(default_config_)} {
+DbmsHandler::DbmsHandler(storage::Config config, replication::ReplicationState &repl_state, auth::SynchedAuth &auth,
+                         bool recovery_on_startup)
+    : default_config_{std::move(config)}, auth_{auth}, repl_state_{repl_state} {
   // TODO: Decouple storage config from dbms config
   // TODO: Save individual db configs inside the kvstore and restore from there
 
@@ -150,19 +195,13 @@ DbmsHandler::DbmsHandler(
       const auto uuid = json.at("uuid").get<utils::UUID>();
       const auto rel_dir = json.at("rel_dir").get<std::filesystem::path>();
       spdlog::info("Restoring database {} at {}.", name, rel_dir);
-      auto new_db = New_(name, uuid, rel_dir);
+      auto new_db = New_(name, uuid, nullptr, rel_dir);
       MG_ASSERT(!new_db.HasError(), "Failed while creating database {}.", name);
       directories.emplace(rel_dir.filename());
       spdlog::info("Database {} restored.", name);
     }
-    // Read the last timestamp
-    auto lcst = durability_->Get(kLastCommitedSystemTsKey);
-    if (lcst) {
-      last_commited_system_timestamp_ = std::stoul(*lcst);
-      system_timestamp_ = last_commited_system_timestamp_;
-    }
   } else {  // Clear databases from the durability list and auth
-    auto locked_auth = auth->Lock();
+    auto locked_auth = auth_.Lock();
     auto it = durability_->begin(std::string{kDBPrefix});
     auto end = durability_->end(std::string{kDBPrefix});
     for (; it != end; ++it) {
@@ -172,8 +211,6 @@ DbmsHandler::DbmsHandler(
       locked_auth->DeleteDatabase(name);
       durability_->Delete(key);
     }
-    // Delete the last timestamp
-    durability_->Delete(kLastCommitedSystemTsKey);
   }
 
   /*
@@ -198,45 +235,31 @@ DbmsHandler::DbmsHandler(
    */
   // Setup the default DB
   SetupDefault_();
-
-  /*
-   * REPLICATION RECOVERY AND STARTUP
-   */
-  // Startup replication state (if recovered at startup)
-  auto replica = [this](replication::RoleReplicaData const &data) { return StartRpcServer(*this, data); };
-  // Replication recovery and frequent check start
-  auto main = [this](replication::RoleMainData &data) {
-    for (auto &client : data.registered_replicas_) {
-      SystemRestore(client);
-    }
-    ForEach([this](DatabaseAccess db) { RecoverReplication(db); });
-    for (auto &client : data.registered_replicas_) {
-      StartReplicaClient(*this, client);
-    }
-    return true;
-  };
-  // Startup proccess for main/replica
-  MG_ASSERT(std::visit(memgraph::utils::Overloaded{replica, main}, repl_state_.ReplicationData()),
-            "Replica recovery failure!");
-
-  // Warning
-  if (default_config_.durability.snapshot_wal_mode == storage::Config::Durability::SnapshotWalMode::DISABLED &&
-      repl_state_.IsMain()) {
-    spdlog::warn(
-        "The instance has the MAIN replication role, but durability logs and snapshots are disabled. Please "
-        "consider "
-        "enabling durability by using --storage-snapshot-interval-sec and --storage-wal-enabled flags because "
-        "without write-ahead logs this instance is not replicating any data.");
-  }
-
-  // MAIN or REPLICA instance
-  if (FLAGS_coordinator_server_port) {
-    CoordinatorHandlers::Register(*this);
-    MG_ASSERT(coordinator_state_.GetCoordinatorServer().Start(), "Failed to start coordinator server!");
-  }
 }
 
-DbmsHandler::DeleteResult DbmsHandler::TryDelete(std::string_view db_name) {
+struct DropDatabase : memgraph::system::ISystemAction {
+  explicit DropDatabase(utils::UUID uuid) : uuid_{uuid} {}
+  void DoDurability() override { /* Done during DBMS execution */
+  }
+
+  bool DoReplication(replication::ReplicationClient &client, const utils::UUID &main_uuid,
+                     replication::ReplicationEpoch const &epoch,
+                     memgraph::system::Transaction const &txn) const override {
+    auto check_response = [](const storage::replication::DropDatabaseRes &response) {
+      return response.result != storage::replication::DropDatabaseRes::Result::FAILURE;
+    };
+
+    return client.SteamAndFinalizeDelta<storage::replication::DropDatabaseRpc>(
+        check_response, main_uuid, std::string(epoch.id()), txn.last_committed_system_timestamp(), txn.timestamp(),
+        uuid_);
+  }
+  void PostReplication(replication::RoleMainData &mainData) const override {}
+
+ private:
+  utils::UUID uuid_;
+};
+
+DbmsHandler::DeleteResult DbmsHandler::TryDelete(std::string_view db_name, system::Transaction *transaction) {
   std::lock_guard<LockT> wr(lock_);
   if (db_name == kDefaultDB) {
     // MSG cannot delete the default db
@@ -273,9 +296,10 @@ DbmsHandler::DeleteResult DbmsHandler::TryDelete(std::string_view db_name) {
 
   // Success
   // Save delta
-  if (system_transaction_) {
-    system_transaction_->delta.emplace(SystemTransaction::Delta::drop_database, uuid);
+  if (transaction) {
+    transaction->AddAction<DropDatabase>(uuid);
   }
+
   return {};
 }
 
@@ -296,18 +320,50 @@ DbmsHandler::DeleteResult DbmsHandler::Delete(utils::UUID uuid) {
   return Delete_(db_name);
 }
 
-DbmsHandler::NewResultT DbmsHandler::New_(storage::Config storage_config) {
+struct CreateDatabase : memgraph::system::ISystemAction {
+  explicit CreateDatabase(storage::SalientConfig config, DatabaseAccess db_acc)
+      : config_{std::move(config)}, db_acc(db_acc) {}
+
+  void DoDurability() override {
+    // Done during dbms execution
+  }
+
+  bool DoReplication(replication::ReplicationClient &client, const utils::UUID &main_uuid,
+                     replication::ReplicationEpoch const &epoch,
+                     memgraph::system::Transaction const &txn) const override {
+    auto check_response = [](const storage::replication::CreateDatabaseRes &response) {
+      return response.result != storage::replication::CreateDatabaseRes::Result::FAILURE;
+    };
+
+    return client.SteamAndFinalizeDelta<storage::replication::CreateDatabaseRpc>(
+        check_response, main_uuid, std::string(epoch.id()), txn.last_committed_system_timestamp(), txn.timestamp(),
+        config_);
+  }
+
+  void PostReplication(replication::RoleMainData &mainData) const override {
+    // Sync database with REPLICAs
+    // NOTE: The function bellow is used to create ReplicationStorageClient, so it must be called on a new storage
+    // We don't need to have it here, since the function won't fail even if the replication client fails to
+    // connect We will just have everything ready, for recovery at some point.
+    dbms::DbmsHandler::RecoverStorageReplication(db_acc, mainData);
+  }
+
+ private:
+  storage::SalientConfig config_;
+  DatabaseAccess db_acc;
+};
+
+DbmsHandler::NewResultT DbmsHandler::New_(storage::Config storage_config, system::Transaction *txn) {
   auto new_db = db_handler_.New(storage_config, repl_state_);
 
   if (new_db.HasValue()) {  // Success
                             // Save delta
-    if (system_transaction_) {
-      system_transaction_->delta.emplace(SystemTransaction::Delta::create_database, storage_config.salient);
-    }
     UpdateDurability(storage_config);
-    return new_db.GetValue();
+    if (txn) {
+      txn->AddAction<CreateDatabase>(storage_config.salient, new_db.GetValue());
+    }
   }
-  return new_db.GetError();
+  return new_db;
 }
 
 DbmsHandler::DeleteResult DbmsHandler::Delete_(std::string_view db_name) {
@@ -361,89 +417,19 @@ void DbmsHandler::UpdateDurability(const storage::Config &config, std::optional<
   durability_->Put(key, val);
 }
 
-AllSyncReplicaStatus DbmsHandler::Commit() {
-  if (system_transaction_ == std::nullopt || system_transaction_->delta == std::nullopt)
-    return AllSyncReplicaStatus::AllCommitsConfirmed;  // Nothing to commit
-  const auto &delta = *system_transaction_->delta;
-
-  auto sync_status = AllSyncReplicaStatus::AllCommitsConfirmed;
-  // TODO Create a system client that can handle all of this automatically
-  switch (delta.action) {
-    using enum SystemTransaction::Delta::Action;
-    case CREATE_DATABASE: {
-      // Replication
-      auto main_handler = [&](memgraph::replication::RoleMainData &main_data) {
-        // TODO: data race issue? registered_replicas_ access not protected
-        // This is sync in any case, as this is the startup
-        for (auto &client : main_data.registered_replicas_) {
-          bool completed = SteamAndFinalizeDelta<storage::replication::CreateDatabaseRpc>(
-              client,
-              [](const storage::replication::CreateDatabaseRes &response) {
-                return response.result != storage::replication::CreateDatabaseRes::Result::FAILURE;
-              },
-              std::string(main_data.epoch_.id()), last_commited_system_timestamp_,
-              system_transaction_->system_timestamp, delta.config);
-          // TODO: reduce duplicate code
-          if (!completed && client.mode_ == replication_coordination_glue::ReplicationMode::SYNC) {
-            sync_status = AllSyncReplicaStatus::SomeCommitsUnconfirmed;
-          }
-        }
-        // Sync database with REPLICAs
-        RecoverReplication(Get_(delta.config.name));
-      };
-      auto replica_handler = [](memgraph::replication::RoleReplicaData &) { /* Nothing to do */ };
-      std::visit(utils::Overloaded{main_handler, replica_handler}, repl_state_.ReplicationData());
-    } break;
-    case DROP_DATABASE: {
-      // Replication
-      auto main_handler = [&](memgraph::replication::RoleMainData &main_data) {
-        // TODO: data race issue? registered_replicas_ access not protected
-        // This is sync in any case, as this is the startup
-        for (auto &client : main_data.registered_replicas_) {
-          bool completed = SteamAndFinalizeDelta<storage::replication::DropDatabaseRpc>(
-              client,
-              [](const storage::replication::DropDatabaseRes &response) {
-                return response.result != storage::replication::DropDatabaseRes::Result::FAILURE;
-              },
-              std::string(main_data.epoch_.id()), last_commited_system_timestamp_,
-              system_transaction_->system_timestamp, delta.uuid);
-          // TODO: reduce duplicate code
-          if (!completed && client.mode_ == replication_coordination_glue::ReplicationMode::SYNC) {
-            sync_status = AllSyncReplicaStatus::SomeCommitsUnconfirmed;
-          }
-        }
-      };
-      auto replica_handler = [](memgraph::replication::RoleReplicaData &) { /* Nothing to do */ };
-      std::visit(utils::Overloaded{main_handler, replica_handler}, repl_state_.ReplicationData());
-    } break;
-  }
-
-  durability_->Put(kLastCommitedSystemTsKey, std::to_string(system_transaction_->system_timestamp));
-  last_commited_system_timestamp_ = system_transaction_->system_timestamp;
-  ResetSystemTransaction();
-  return sync_status;
-}
-
-#else  // not MG_ENTERPRISE
-
-AllSyncReplicaStatus DbmsHandler::Commit() {
-  if (system_transaction_ == std::nullopt || system_transaction_->delta == std::nullopt) {
-    return AllSyncReplicaStatus::AllCommitsConfirmed;  // Nothing to commit
-  }
-  const auto &delta = *system_transaction_->delta;
-
-  switch (delta.action) {
-    using enum SystemTransaction::Delta::Action;
-    case CREATE_DATABASE:
-    case DROP_DATABASE:
-      /* Community edition doesn't support multi-tenant replication */
-      break;
-  }
-
-  last_commited_system_timestamp_ = system_transaction_->system_timestamp;
-  ResetSystemTransaction();
-  return AllSyncReplicaStatus::AllCommitsConfirmed;
-}
-
 #endif
+
+void DbmsHandler::RecoverStorageReplication(DatabaseAccess db_acc, replication::RoleMainData &role_main_data) {
+  using enum memgraph::flags::Experiments;
+  auto const is_enterprise = license::global_license_checker.IsEnterpriseValidFast();
+  auto experimental_system_replication = flags::AreExperimentsEnabled(SYSTEM_REPLICATION);
+  if ((is_enterprise && experimental_system_replication) || db_acc->name() == dbms::kDefaultDB) {
+    // Handle global replication state
+    spdlog::info("Replication configuration will be stored and will be automatically restored in case of a crash.");
+    // RECOVER REPLICA CONNECTIONS
+    memgraph::dbms::RestoreReplication(role_main_data, db_acc);
+  } else if (!role_main_data.registered_replicas_.empty()) {
+    spdlog::warn("Multi-tenant replication is currently not supported!");
+  }
+}
 }  // namespace memgraph::dbms