add tests for two mains, 1 failover

Implement edge type indices (#1542 )

.github/ISSUE_TEMPLATE/bug_report.md

@@ -3,7 +3,6 @@ name: Bug report
 about: Create a report to help us improve
 title: ""
 labels: bug
-assignees: gitbuda
 ---
 
 **Memgraph version**

.github/workflows/release_build_test.yaml

@@ -56,6 +56,15 @@ jobs:
       - name: "Build package"
         run: |
           ./release/package/run.sh package debian-10 $BUILD_TYPE
+      - name: Upload to S3
+        uses: jakejarvis/s3-sync-action@v0.5.1
+        env:
+          AWS_S3_BUCKET: "deps.memgraph.io"
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: "eu-west-1"
+          SOURCE_DIR: "build/output"
+          DEST_DIR: "memgraph-unofficial/${{ github.ref_name }}/"
       - name: "Upload package"
         uses: actions/upload-artifact@v4
         with:
@@ -75,6 +84,15 @@ jobs:
       - name: "Build package"
         run: |
           ./release/package/run.sh package ubuntu-22.04 $BUILD_TYPE
+      - name: Upload to S3
+        uses: jakejarvis/s3-sync-action@v0.5.1
+        env:
+          AWS_S3_BUCKET: "deps.memgraph.io"
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: "eu-west-1"
+          SOURCE_DIR: "build/output"
+          DEST_DIR: "memgraph-unofficial/${{ github.ref_name }}/"
       - name: "Upload package"
         uses: actions/upload-artifact@v4
         with:
@@ -86,7 +104,7 @@ jobs:
     needs: [Ubuntu20_04]
     runs-on: [self-hosted, DockerMgBuild, ARM64]
     # M1 Mac mini is sometimes slower
-    timeout-minutes: 90
+    timeout-minutes: 150
     steps:
       - name: "Set up repository"
         uses: actions/checkout@v4
@@ -101,6 +119,26 @@ jobs:
           name: ubuntu-22.04-aarch64
           path: build/output/ubuntu-22.04-arm/memgraph*.deb
 
+  PushToS3Ubuntu20_04_ARM:
+    if: github.ref_type == 'tag'
+    needs: [PackageUbuntu20_04_ARM]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download package
+        uses: actions/download-artifact@v4
+        with:
+          name: ubuntu-22.04-aarch64
+          path: build/output/release
+      - name: Upload to S3
+        uses: jakejarvis/s3-sync-action@v0.5.1
+        env:
+          AWS_S3_BUCKET: "deps.memgraph.io"
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: "eu-west-1"
+          SOURCE_DIR: "build/output/release"
+          DEST_DIR: "memgraph-unofficial/${{ github.ref_name }}/"
+
   PackageDebian11:
     if: github.ref_type == 'tag'
     needs: [Debian10, Ubuntu20_04]
@@ -114,6 +152,15 @@ jobs:
       - name: "Build package"
         run: |
           ./release/package/run.sh package debian-11 $BUILD_TYPE
+      - name: Upload to S3
+        uses: jakejarvis/s3-sync-action@v0.5.1
+        env:
+          AWS_S3_BUCKET: "deps.memgraph.io"
+          AWS_ACCESS_KEY_ID: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: "eu-west-1"
+          SOURCE_DIR: "build/output"
+          DEST_DIR: "memgraph-unofficial/${{ github.ref_name }}/"
       - name: "Upload package"
         uses: actions/upload-artifact@v4
         with:
@@ -125,7 +172,7 @@ jobs:
     needs: [Debian10, Ubuntu20_04]
     runs-on: [self-hosted, DockerMgBuild, ARM64]
     # M1 Mac mini is sometimes slower
-    timeout-minutes: 90
+    timeout-minutes: 150
     steps:
       - name: "Set up repository"
         uses: actions/checkout@v4
@@ -140,16 +187,15 @@ jobs:
           name: debian-11-aarch64
           path: build/output/debian-11-arm/memgraph*.deb
 
-  PushToS3:
+  PushToS3Debian11_ARM:
     if: github.ref_type == 'tag'
-    needs: [PackageDebian10, PackageDebian11, PackageDebian11_ARM, PackageUbuntu20_04, PackageUbuntu20_04_ARM]
+    needs: [PackageDebian11_ARM]
     runs-on: ubuntu-latest
     steps:
-      - name: Download artifacts
+      - name: Download package
         uses: actions/download-artifact@v4
         with:
-          # name: # if name input parameter is not provided, all artifacts are downloaded
-                  # and put in directories named after each one.
+          name: debian-11-aarch64
           path: build/output/release
       - name: Upload to S3
         uses: jakejarvis/s3-sync-action@v0.5.1

CMakeLists.txt

@@ -64,11 +64,11 @@ option(MG_ENTERPRISE "Build Memgraph Enterprise Edition" ON)
 # Set the current version here to override the automatic version detection. The
 # version must be specified as `X.Y.Z`. Primarily used when building new patch
 # versions.
-set(MEMGRAPH_OVERRIDE_VERSION "2.15.0")
+set(MEMGRAPH_OVERRIDE_VERSION "")
 
 # Custom suffix that this version should have. The suffix can be any arbitrary
 # string. Primarily used when building a version for a specific customer.
-set(MEMGRAPH_OVERRIDE_VERSION_SUFFIX "rc3")
+set(MEMGRAPH_OVERRIDE_VERSION_SUFFIX "")
 
 # Variables used to generate the versions.
 if (MG_ENTERPRISE)

environment/os/amzn-2.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -9,7 +7,7 @@ check_operating_system "amzn-2"
 check_architecture "x86_64"
 
 TOOLCHAIN_BUILD_DEPS=(
-    gcc gcc-c++ make # generic build tools
+    git gcc gcc-c++ make # generic build tools
     wget # used for archive download
     gnupg2 # used for archive signature verification
     tar gzip bzip2 xz unzip # used for archive unpacking
@@ -47,6 +45,7 @@ MEMGRAPH_BUILD_DEPS=(
     readline-devel # for memgraph console
     python3-devel # for query modules
     openssl-devel
+    openssl
     libseccomp-devel
     python3 python3-pip nmap-ncat # for tests
     #
@@ -63,6 +62,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/centos-7.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -45,6 +43,7 @@ MEMGRAPH_BUILD_DEPS=(
     readline-devel # for memgraph console
     python3-devel # for query modules
     openssl-devel
+    openssl
     libseccomp-devel
     python3 python-virtualenv python3-pip nmap-ncat # for qa, macro_benchmark and stress tests
     #
@@ -63,6 +62,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/centos-9.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -9,8 +7,10 @@ check_operating_system "centos-9"
 check_architecture "x86_64"
 
 TOOLCHAIN_BUILD_DEPS=(
-    coreutils-common gcc gcc-c++ make # generic build tools
     wget # used for archive download
+    coreutils-common gcc gcc-c++ make # generic build tools
+    # NOTE: Pure libcurl conflicts with libcurl-minimal
+    libcurl-devel # cmake build requires it
     gnupg2 # used for archive signature verification
     tar gzip bzip2 xz unzip # used for archive unpacking
     zlib-devel # zlib library used for all builds
@@ -64,6 +64,8 @@ MEMGRAPH_BUILD_DEPS=(
     cyrus-sasl-devel
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )
@@ -123,7 +125,9 @@ install() {
     else
         echo "NOTE: export LANG=en_US.utf8"
     fi
-    yum update -y
+    # --nobest is used because of libipt because we install custom versions
+    # because libipt-devel is not available on CentOS 9 Stream
+    yum update -y --nobest
     yum install -y wget git python3 python3-pip
 
     for pkg in $1; do

environment/os/debian-10.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "debian-10"
 check_architecture "x86_64"
 

environment/os/debian-11-arm.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "debian-11"
 check_architecture "arm64" "aarch64"
 

environment/os/debian-11.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -61,6 +59,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp
 )

environment/os/debian-12-arm.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "debian-12"
+check_architecture "arm64" "aarch64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils gcc g++ build-essential make # generic build tools
+    wget # used for archive download
+    gnupg # used for archive signature verification
+    tar gzip bzip2 xz-utils unzip # used for archive unpacking
+    zlib1g-dev # zlib library used for all builds
+    libexpat1-dev liblzma-dev python3-dev texinfo # for gdb
+    libcurl4-openssl-dev # for cmake
+    libreadline-dev # for cmake and llvm
+    libffi-dev libxml2-dev # for llvm
+    libedit-dev libpcre2-dev libpcre3-dev automake bison # for swig
+    curl # snappy
+    file # for libunwind
+    libssl-dev # for libevent
+    libgmp-dev
+    gperf # for proxygen
+    git # for fbthrift
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz-utils # used for archive unpacking
+    zlib1g # zlib library used for all builds
+    libexpat1 liblzma5 python3 # for gdb
+    libcurl4 # for cmake
+    file # for CPack
+    libreadline8 # for cmake and llvm
+    libffi8 libxml2 # for llvm
+    libssl-dev # for libevent
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make pkg-config # build system
+    curl wget # for downloading libs
+    uuid-dev default-jre-headless # required by antlr
+    libreadline-dev # for memgraph console
+    libpython3-dev python3-dev # for query modules
+    libssl-dev
+    libseccomp-dev
+    netcat # tests are using nc to wait for memgraph
+    python3 virtualenv python3-virtualenv python3-pip # for qa, macro_benchmark and stress tests
+    python3-yaml # for the configuration generator
+    libcurl4-openssl-dev # mg-requests
+    sbcl # for custom Lisp C++ preprocessing
+    doxygen graphviz # source documentation generators
+    mono-runtime mono-mcs zip unzip default-jdk-headless custom-maven3.9.3 # for driver tests
+    dotnet-sdk-7.0 golang custom-golang1.18.9 nodejs npm
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    libsasl2-dev
+)
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if ! dpkg -s "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    apt update
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    apt install -y wget
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == dotnet-sdk-7.0  ]; then
+            if ! dpkg -s "$pkg" 2>/dev/null >/dev/null; then
+                wget -nv https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
+                dpkg -i packages-microsoft-prod.deb
+                apt-get update
+                apt-get install -y apt-transport-https dotnet-sdk-7.0
+            fi
+            continue
+        fi
+        apt install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/debian-12.sh

@@ -0,0 +1,136 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "debian-12"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils gcc g++ build-essential make # generic build tools
+    wget # used for archive download
+    gnupg # used for archive signature verification
+    tar gzip bzip2 xz-utils unzip # used for archive unpacking
+    zlib1g-dev # zlib library used for all builds
+    libexpat1-dev libipt-dev libbabeltrace-dev liblzma-dev python3-dev texinfo # for gdb
+    libcurl4-openssl-dev # for cmake
+    libreadline-dev # for cmake and llvm
+    libffi-dev libxml2-dev # for llvm
+    libedit-dev libpcre2-dev libpcre3-dev automake bison # for swig
+    curl # snappy
+    file # for libunwind
+    libssl-dev # for libevent
+    libgmp-dev
+    gperf # for proxygen
+    git # for fbthrift
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz-utils # used for archive unpacking
+    zlib1g # zlib library used for all builds
+    libexpat1 libipt2 libbabeltrace1 liblzma5 python3 # for gdb
+    libcurl4 # for cmake
+    file # for CPack
+    libreadline8 # for cmake and llvm
+    libffi8 libxml2 # for llvm
+    libssl-dev # for libevent
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make cmake pkg-config # build system
+    curl wget # for downloading libs
+    uuid-dev default-jre-headless # required by antlr
+    libreadline-dev # for memgraph console
+    libpython3-dev python3-dev # for query modules
+    libssl-dev
+    libseccomp-dev
+    netcat-traditional # tests are using nc to wait for memgraph
+    python3 virtualenv python3-virtualenv python3-pip # for qa, macro_benchmark and stress tests
+    python3-yaml # for the configuration generator
+    libcurl4-openssl-dev # mg-requests
+    sbcl # for custom Lisp C++ preprocessing
+    doxygen graphviz # source documentation generators
+    mono-runtime mono-mcs zip unzip default-jdk-headless custom-maven3.9.3 # for driver tests
+    dotnet-sdk-7.0 golang custom-golang1.18.9 nodejs npm
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    libsasl2-dev
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if ! dpkg -s "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    apt update
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    apt install -y wget
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == dotnet-sdk-7.0  ]; then
+            if ! dpkg -s "$pkg" 2>/dev/null >/dev/null; then
+                wget -nv https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
+                dpkg -i packages-microsoft-prod.deb
+                apt-get update
+                apt-get install -y apt-transport-https dotnet-sdk-7.0
+            fi
+            continue
+        fi
+        apt install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/fedora-36.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "fedora-36"
 check_architecture "x86_64"
 
@@ -27,6 +27,7 @@ TOOLCHAIN_BUILD_DEPS=(
     libipt libipt-devel # intel
     patch
     perl # for openssl
+    git
 )
 
 TOOLCHAIN_RUN_DEPS=(

environment/os/fedora-38.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -27,6 +25,7 @@ TOOLCHAIN_BUILD_DEPS=(
     libipt libipt-devel # intel
     patch
     perl # for openssl
+    git
 )
 
 TOOLCHAIN_RUN_DEPS=(
@@ -58,6 +57,16 @@ MEMGRAPH_BUILD_DEPS=(
     libtool  # for protobuf code generation
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
 list() {
     echo "$1"
 }

environment/os/fedora-39.sh

@@ -0,0 +1,117 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+check_operating_system "fedora-39"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    coreutils-common gcc gcc-c++ make # generic build tools
+    wget # used for archive download
+    gnupg2 # used for archive signature verification
+    tar gzip bzip2 xz unzip # used for archive unpacking
+    zlib-devel # zlib library used for all builds
+    expat-devel xz-devel python3-devel texinfo libbabeltrace-devel # for gdb
+    curl libcurl-devel # for cmake
+    readline-devel # for cmake and llvm
+    libffi-devel libxml2-devel # for llvm
+    libedit-devel pcre-devel pcre2-devel automake bison # for swig
+    file
+    openssl-devel
+    gmp-devel
+    gperf
+    diffutils
+    libipt libipt-devel # intel
+    patch
+    perl # for openssl
+    git
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz # used for archive unpacking
+    zlib # zlib library used for all builds
+    expat xz-libs python3 # for gdb
+    readline # for cmake and llvm
+    libffi libxml2 # for llvm
+    openssl-devel
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make pkgconf-pkg-config # build system
+    wget # for downloading libs
+    libuuid-devel java-11-openjdk # required by antlr
+    readline-devel # for memgraph console
+    python3-devel # for query modules
+    openssl-devel
+    libseccomp-devel
+    python3 python3-pip python3-virtualenv python3-virtualenvwrapper python3-pyyaml nmap-ncat # for tests
+    libcurl-devel # mg-requests
+    rpm-build rpmlint # for RPM package building
+    doxygen graphviz # source documentation generators
+    which nodejs golang zip unzip java-11-openjdk-devel # for driver tests
+    sbcl # for custom Lisp C++ preprocessing
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    if [ -v LD_LIBRARY_PATH ]; then
+      # On Fedora 38 yum/dnf and python11 use newer glibc which is not compatible
+      # with ours, so we need to momentarely disable env
+      local OLD_LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
+      LD_LIBRARY_PATH=""
+    fi
+    local missing=""
+    for pkg in $1; do
+        if ! dnf list installed "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+    if [ -v OLD_LD_LIBRARY_PATH ]; then
+      echo "Restoring LD_LIBRARY_PATH..."
+      LD_LIBRARY_PATH=${OLD_LD_LIBRARY_PATH}
+    fi
+}
+
+install() {
+    cd "$DIR"
+    if [ "$EUID" -ne 0 ]; then
+        echo "Please run as root."
+        exit 1
+    fi
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests don't work without the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    dnf update -y
+    for pkg in $1; do
+        dnf install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/rocky-9.3.sh

@@ -0,0 +1,188 @@
+#!/bin/bash
+set -Eeuo pipefail
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+source "$DIR/../util.sh"
+
+# TODO(gitbuda): Rocky gets automatically updates -> figure out how to handle it.
+check_operating_system "rocky-9.3"
+check_architecture "x86_64"
+
+TOOLCHAIN_BUILD_DEPS=(
+    wget # used for archive download
+    coreutils-common gcc gcc-c++ make # generic build tools
+    # NOTE: Pure libcurl conflicts with libcurl-minimal
+    libcurl-devel # cmake build requires it
+    gnupg2 # used for archive signature verification
+    tar gzip bzip2 xz unzip # used for archive unpacking
+    zlib-devel # zlib library used for all builds
+    expat-devel xz-devel python3-devel perl-Unicode-EastAsianWidth texinfo libbabeltrace-devel # for gdb
+    readline-devel # for cmake and llvm
+    libffi-devel libxml2-devel # for llvm
+    libedit-devel pcre-devel pcre2-devel automake bison # for swig
+    file
+    openssl-devel
+    gmp-devel
+    gperf
+    diffutils
+    libipt libipt-devel # intel
+    patch
+)
+
+TOOLCHAIN_RUN_DEPS=(
+    make # generic build tools
+    tar gzip bzip2 xz # used for archive unpacking
+    zlib # zlib library used for all builds
+    expat xz-libs python3 # for gdb
+    readline # for cmake and llvm
+    libffi libxml2 # for llvm
+    openssl-devel
+    perl # for openssl
+)
+
+MEMGRAPH_BUILD_DEPS=(
+    git # source code control
+    make cmake pkgconf-pkg-config # build system
+    wget # for downloading libs
+    libuuid-devel java-11-openjdk # required by antlr
+    readline-devel # for memgraph console
+    python3-devel # for query modules
+    openssl-devel
+    libseccomp-devel
+    python3 python3-pip python3-virtualenv nmap-ncat # for qa, macro_benchmark and stress tests
+    #
+    # IMPORTANT: python3-yaml does NOT exist on CentOS
+    # Install it manually using `pip3 install PyYAML`
+    #
+    PyYAML # Package name here does not correspond to the yum package!
+    libcurl-devel # mg-requests
+    rpm-build rpmlint # for RPM package building
+    doxygen graphviz # source documentation generators
+    which nodejs golang custom-golang1.18.9 # for driver tests
+    zip unzip java-11-openjdk-devel java-17-openjdk java-17-openjdk-devel custom-maven3.9.3 # for driver tests
+    sbcl # for custom Lisp C++ preprocessing
+    autoconf # for jemalloc code generation
+    libtool  # for protobuf code generation
+    cyrus-sasl-devel
+)
+
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
+MEMGRAPH_RUN_DEPS=(
+    logrotate openssl python3 libseccomp
+)
+
+NEW_DEPS=(
+    wget curl tar gzip
+)
+
+list() {
+    echo "$1"
+}
+
+check() {
+    local missing=""
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            if [ ! -f "/opt/apache-maven-3.9.3/bin/mvn" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            if [ ! -f "/opt/go1.18.9/go/bin/go" ]; then
+              missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == "PyYAML" ]; then
+            if ! python3 -c "import yaml" >/dev/null 2>/dev/null; then
+                missing="$pkg $missing"
+            fi
+            continue
+        fi
+        if [ "$pkg" == "python3-virtualenv" ]; then
+            continue
+        fi
+        if ! yum list installed "$pkg" >/dev/null 2>/dev/null; then
+            missing="$pkg $missing"
+        fi
+    done
+    if [ "$missing" != "" ]; then
+        echo "MISSING PACKAGES: $missing"
+        exit 1
+    fi
+}
+
+install() {
+    cd "$DIR"
+    if [ "$EUID" -ne 0 ]; then
+        echo "Please run as root."
+        exit 1
+    fi
+    # If GitHub Actions runner is installed, append LANG to the environment.
+    # Python related tests doesn't work the LANG export.
+    if [ -d "/home/gh/actions-runner" ]; then
+        echo "LANG=en_US.utf8" >> /home/gh/actions-runner/.env
+    else
+        echo "NOTE: export LANG=en_US.utf8"
+    fi
+    yum update -y
+    yum install -y wget git python3 python3-pip
+
+    for pkg in $1; do
+        if [ "$pkg" == custom-maven3.9.3 ]; then
+            install_custom_maven "3.9.3"
+            continue
+        fi
+        if [ "$pkg" == custom-golang1.18.9 ]; then
+            install_custom_golang "1.18.9"
+            continue
+        fi
+        if [ "$pkg" == perl-Unicode-EastAsianWidth ]; then
+            if ! dnf list installed perl-Unicode-EastAsianWidth >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/CRB/x86_64/os/Packages/p/perl-Unicode-EastAsianWidth-12.0-7.el9.noarch.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == texinfo ]; then
+            if ! dnf list installed texinfo >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/CRB/x86_64/os/Packages/t/texinfo-6.7-15.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == libbabeltrace-devel ]; then
+            if ! dnf list installed libbabeltrace-devel >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/devel/x86_64/os/Packages/l/libbabeltrace-devel-1.5.8-10.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == libipt-devel ]; then
+            if ! dnf list installed libipt-devel >/dev/null 2>/dev/null; then
+                dnf install -y https://dl.rockylinux.org/pub/rocky/9/devel/x86_64/os/Packages/l/libipt-devel-2.0.4-5.el9.x86_64.rpm
+            fi
+            continue
+        fi
+        if [ "$pkg" == PyYAML ]; then
+            if [ -z ${SUDO_USER+x} ]; then # Running as root (e.g. Docker).
+                pip3 install --user PyYAML
+            else # Running using sudo.
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install --user PyYAML"
+            fi
+            continue
+        fi
+        if [ "$pkg" == python3-virtualenv ]; then
+            if [ -z ${SUDO_USER+x} ]; then # Running as root (e.g. Docker).
+                pip3 install virtualenv
+                pip3 install virtualenvwrapper
+            else # Running using sudo.
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install virtualenv"
+                sudo -H -u "$SUDO_USER" bash -c "pip3 install virtualenvwrapper"
+            fi
+            continue
+        fi
+        yum install -y "$pkg"
+    done
+}
+
+deps=$2"[*]"
+"$1" "${!deps}"

environment/os/template.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -20,6 +18,10 @@ MEMGRAPH_BUILD_DEPS=(
     pkg
 )
 
+MEMGRAPH_TEST_DEPS=(
+  pkg
+)
+
 MEMGRAPH_RUN_DEPS=(
     pkg
 )

environment/os/ubuntu-18.04.sh

@@ -1,10 +1,10 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
+# IMPORTANT: Deprecated since memgraph v2.12.0.
+
 check_operating_system "ubuntu-18.04"
 check_architecture "x86_64"
 

environment/os/ubuntu-20.04.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/os/ubuntu-22.04-arm.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/os/ubuntu-22.04.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-
 set -Eeuo pipefail
-
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 source "$DIR/../util.sh"
 
@@ -60,6 +58,8 @@ MEMGRAPH_BUILD_DEPS=(
     libsasl2-dev
 )
 
+MEMGRAPH_TEST_DEPS="${MEMGRAPH_BUILD_DEPS[*]}"
+
 MEMGRAPH_RUN_DEPS=(
     logrotate openssl python3 libseccomp2
 )

environment/toolchain/.gitignore

@@ -2,3 +2,4 @@ archives
 build
 output
 *.tar.gz
+tmp_build.sh

environment/toolchain/template_build.sh

@@ -0,0 +1,48 @@
+#!/bin/bash -e
+
+# NOTE: Copy this under memgraph/environment/toolchain/vN/tmp_build.sh, edit and test.
+
+pushd () { command pushd "$@" > /dev/null; }
+popd () { command popd "$@" > /dev/null; }
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
+CPUS=$( grep -c processor < /proc/cpuinfo )
+cd "$DIR"
+source "$DIR/../../util.sh"
+DISTRO="$(operating_system)"
+TOOLCHAIN_VERSION=5
+NAME=toolchain-v$TOOLCHAIN_VERSION
+PREFIX=/opt/$NAME
+function log_tool_name () {
+    echo ""
+    echo ""
+    echo "#### $1 ####"
+    echo ""
+    echo ""
+}
+
+# HERE: Remove/clear dependencies from a given toolchain.
+
+mkdir -p archives && pushd archives
+# HERE: Download dependencies here.
+popd
+
+mkdir -p build
+pushd build
+source $PREFIX/activate
+export CC=$PREFIX/bin/clang
+export CXX=$PREFIX/bin/clang++
+export CFLAGS="$CFLAGS -fPIC"
+export PATH=$PREFIX/bin:$PATH
+export LD_LIBRARY_PATH=$PREFIX/lib64
+COMMON_CMAKE_FLAGS="-DCMAKE_INSTALL_PREFIX=$PREFIX
+                    -DCMAKE_PREFIX_PATH=$PREFIX
+                    -DCMAKE_BUILD_TYPE=Release
+                    -DCMAKE_C_COMPILER=$CC
+                    -DCMAKE_CXX_COMPILER=$CXX
+                    -DBUILD_SHARED_LIBS=OFF
+                    -DCMAKE_CXX_STANDARD=20
+                    -DBUILD_TESTING=OFF
+                    -DCMAKE_REQUIRED_INCLUDES=$PREFIX/include
+                    -DCMAKE_POSITION_INDEPENDENT_CODE=ON"
+
+# HERE: Add dependencies to test below.

environment/toolchain/v5/build.sh

@@ -307,7 +307,7 @@ if [ ! -f $PREFIX/bin/ld.gold ]; then
 fi
 
 log_tool_name "GDB $GDB_VERSION"
-if [ ! -f $PREFIX/bin/gdb ]; then
+if [[ ! -f "$PREFIX/bin/gdb" && "$DISTRO" -ne "amzn-2" ]]; then
     if [ -d gdb-$GDB_VERSION ]; then
         rm -rf gdb-$GDB_VERSION
     fi
@@ -671,7 +671,6 @@ PROXYGEN_SHA256=5360a8ccdfb2f5a6c7b3eed331ec7ab0e2c792d579c6fff499c85c516c11fe14
 WANGLE_SHA256=1002e9c32b6f4837f6a760016e3b3e22f3509880ef3eaad191c80dc92655f23f
 # WANGLE_SHA256=0e493c03572bb27fe9ca03a9da5023e52fde99c95abdcaa919bb6190e7e69532
 
-FLEX_VERSION=2.6.4
 FMT_SHA256=78b8c0a72b1c35e4443a7e308df52498252d1cefc2b08c9a97bc9ee6cfe61f8b
 FMT_VERSION=10.1.1
 # NOTE: spdlog depends on exact fmt versions -> UPGRADE fmt and spdlog TOGETHER.
@@ -690,8 +689,8 @@ LZ4_VERSION=1.9.4
 SNAPPY_SHA256=75c1fbb3d618dd3a0483bff0e26d0a92b495bbe5059c8b4f1c962b478b6e06e7
 SNAPPY_VERSION=1.1.9
 XZ_VERSION=5.2.5 # for LZMA
-ZLIB_VERSION=1.3
-ZSTD_VERSION=1.5.0
+ZLIB_VERSION=1.3.1
+ZSTD_VERSION=1.5.5
 
 pushd archives
 if [ ! -f boost_$BOOST_VERSION_UNDERSCORES.tar.gz ]; then
@@ -700,7 +699,7 @@ if [ ! -f boost_$BOOST_VERSION_UNDERSCORES.tar.gz ]; then
     wget https://boostorg.jfrog.io/artifactory/main/release/$BOOST_VERSION/source/boost_$BOOST_VERSION_UNDERSCORES.tar.gz -O boost_$BOOST_VERSION_UNDERSCORES.tar.gz
 fi
 if [ ! -f bzip2-$BZIP2_VERSION.tar.gz ]; then
-    wget https://sourceforge.net/projects/bzip2/files/bzip2-$BZIP2_VERSION.tar.gz -O bzip2-$BZIP2_VERSION.tar.gz
+    wget https://sourceware.org/pub/bzip2/bzip2-$BZIP2_VERSION.tar.gz -O bzip2-$BZIP2_VERSION.tar.gz
 fi
 if [ ! -f double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz ]; then
     wget https://github.com/google/double-conversion/archive/refs/tags/v$DOUBLE_CONVERSION_VERSION.tar.gz -O double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz
@@ -708,9 +707,7 @@ fi
 if [ ! -f fizz-$FBLIBS_VERSION.tar.gz ]; then
     wget https://github.com/facebookincubator/fizz/releases/download/v$FBLIBS_VERSION/fizz-v$FBLIBS_VERSION.tar.gz -O fizz-$FBLIBS_VERSION.tar.gz
 fi
-if [ ! -f flex-$FLEX_VERSION.tar.gz ]; then
-    wget https://github.com/westes/flex/releases/download/v$FLEX_VERSION/flex-$FLEX_VERSION.tar.gz -O flex-$FLEX_VERSION.tar.gz
-fi
+
 if [ ! -f fmt-$FMT_VERSION.tar.gz ]; then
     wget https://github.com/fmtlib/fmt/archive/refs/tags/$FMT_VERSION.tar.gz -O fmt-$FMT_VERSION.tar.gz
 fi
@@ -765,14 +762,6 @@ echo "$BZIP2_SHA256 bzip2-$BZIP2_VERSION.tar.gz" | sha256sum -c
 echo "$DOUBLE_CONVERSION_SHA256 double-conversion-$DOUBLE_CONVERSION_VERSION.tar.gz" | sha256sum -c
 # verify fizz
 echo "$FIZZ_SHA256 fizz-$FBLIBS_VERSION.tar.gz" | sha256sum -c
-# verify flex
-if [ ! -f flex-$FLEX_VERSION.tar.gz.sig ]; then
-    wget https://github.com/westes/flex/releases/download/v$FLEX_VERSION/flex-$FLEX_VERSION.tar.gz.sig
-fi
-if false; then
-    $GPG --keyserver $KEYSERVER --recv-keys 0xE4B29C8D64885307
-    $GPG --verify flex-$FLEX_VERSION.tar.gz.sig flex-$FLEX_VERSION.tar.gz
-fi
 # verify fmt
 echo "$FMT_SHA256 fmt-$FMT_VERSION.tar.gz" | sha256sum -c
 # verify spdlog
@@ -1025,7 +1014,6 @@ if [ ! -d $PREFIX/include/gflags ]; then
     if [ -d gflags ]; then
         rm -rf gflags
     fi
-
     git clone https://github.com/memgraph/gflags.git gflags
     pushd gflags
     git checkout $GFLAGS_COMMIT_HASH
@@ -1034,7 +1022,7 @@ if [ ! -d $PREFIX/include/gflags ]; then
     cmake .. $COMMON_CMAKE_FLAGS \
         -DREGISTER_INSTALL_PREFIX=OFF \
         -DBUILD_gflags_nothreads_LIB=OFF \
-        -DGFLAGS_NO_FILENAMES=0
+        -DGFLAGS_NO_FILENAMES=1
     make -j$CPUS install
     popd && popd
 fi
@@ -1232,18 +1220,6 @@ if false; then
   fi
 fi
 
-log_tool_name "flex $FLEX_VERSION"
-if [ ! -f $PREFIX/include/FlexLexer.h ]; then
-    if [ -d flex-$FLEX_VERSION ]; then
-        rm -rf flex-$FLEX_VERSION
-    fi
-    tar -xzf ../archives/flex-$FLEX_VERSION.tar.gz
-    pushd flex-$FLEX_VERSION
-    ./configure $COMMON_CONFIGURE_FLAGS
-    make -j$CPUS install
-    popd
-fi
-
 popd
 # NOTE: It's important/clean (e.g., easier upload to S3) to have a separated
 # folder to the output archive.

import/n2mg_cypherl.sh

@@ -20,14 +20,18 @@ if [ ! -f "$INPUT" ]; then
 fi
 
 echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} BEGIN and COMMIT are required because variables share the same name (e.g. row)"
-echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} CONSTRAINTS are just skipped -> ${COLOR_RED}please create consraints manually if needed${COLOR_NULL}"
+echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} CONSTRAINTS are just skipped -> ${COLOR_RED}please create constraints manually if needed${COLOR_NULL}"
+
+echo 'CREATE INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' > "$OUTPUT"
 
 sed -e 's/^:begin/BEGIN/g; s/^BEGIN$/BEGIN;/g;' \
     -e 's/^:commit/COMMIT/g; s/^COMMIT$/COMMIT;/g;' \
     -e '/^CALL/d; /^SCHEMA AWAIT/d;' \
     -e 's/CREATE RANGE INDEX FOR (n:/CREATE INDEX ON :/g;' \
     -e 's/) ON (n./(/g;' \
-    -e '/^CREATE CONSTRAINT/d; /^DROP CONSTRAINT/d;' "$INPUT" > "$OUTPUT"
+    -e '/^CREATE CONSTRAINT/d; /^DROP CONSTRAINT/d;' "$INPUT" >> "$OUTPUT"
+
+echo 'DROP INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' >> "$OUTPUT"
 
 echo ""
 echo -e "${COLOR_GREEN}DONE!${COLOR_NULL} Please find Memgraph compatible cypherl|.cypher file under $OUTPUT"

import/n2mg_separate_files_cypherl.sh

@@ -0,0 +1,61 @@
+#!/bin/bash -e
+COLOR_ORANGE="\e[38;5;208m"
+COLOR_GREEN="\e[38;5;35m"
+COLOR_RED="\e[0;31m"
+COLOR_NULL="\e[0m"
+
+print_help() {
+    echo -e "${COLOR_ORANGE}HOW TO RUN:${COLOR_NULL} $0 input_file_schema_path input_file_nodes_path input_file_relationships_path input_file_cleanup_path output_file_path"
+    exit 1
+}
+
+if [ "$#" -ne 5 ]; then
+    print_help
+fi
+INPUT_SCHEMA="$1"
+INPUT_NODES="$2"
+INPUT_RELATIONSHIPS="$3"
+INPUT_CLEANUP="$4"
+OUTPUT="$5"
+
+if [ ! -f "$INPUT_SCHEMA" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_NODES" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_RELATIONSHIPS" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_CLEANUP" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} BEGIN and COMMIT are required because variables share the same name (e.g. row)"
+echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} CONSTRAINTS are just skipped -> ${COLOR_RED}please create constraints manually if needed${COLOR_NULL}"
+
+
+echo 'CREATE INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' > "$OUTPUT"
+
+sed -e 's/CREATE RANGE INDEX FOR (n:/CREATE INDEX ON :/g;' \
+    -e 's/) ON (n./(/g;' \
+    -e '/^CREATE CONSTRAINT/d' $INPUT_SCHEMA >> "$OUTPUT"
+
+cat "$INPUT_NODES" >> "$OUTPUT"
+cat "$INPUT_RELATIONSHIPS" >> "$OUTPUT"
+
+sed -e '/^DROP CONSTRAINT/d' "$INPUT_CLEANUP" >> "$OUTPUT"
+
+echo 'DROP INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' >> "$OUTPUT"
+
+echo ""
+echo -e "${COLOR_GREEN}DONE!${COLOR_NULL} Please find Memgraph compatible cypherl|.cypher file under $OUTPUT"
+echo ""
+echo "Please import data by executing => \`cat $OUTPUT | mgconsole\`"

import/n2mg_separate_files_cypherls.sh

@@ -0,0 +1,64 @@
+#!/bin/bash -e
+COLOR_ORANGE="\e[38;5;208m"
+COLOR_GREEN="\e[38;5;35m"
+COLOR_RED="\e[0;31m"
+COLOR_NULL="\e[0m"
+
+print_help() {
+    echo -e "${COLOR_ORANGE}HOW TO RUN:${COLOR_NULL} $0 input_file_schema_path input_file_nodes_path input_file_relationships_path input_file_cleanup_path output_file_schema_path output_file_nodes_path output_file_relationships_path output_file_cleanup_path"
+    exit 1
+}
+
+if [ "$#" -ne 8 ]; then
+    print_help
+fi
+INPUT_SCHEMA="$1"
+INPUT_NODES="$2"
+INPUT_RELATIONSHIPS="$3"
+INPUT_CLEANUP="$4"
+OUTPUT_SCHEMA="$5"
+OUTPUT_NODES="$6"
+OUTPUT_RELATIONSHIPS="$7"
+OUTPUT_CLEANUP="$8"
+
+if [ ! -f "$INPUT_SCHEMA" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_NODES" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_RELATIONSHIPS" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+if [ ! -f "$INPUT_CLEANUP" ]; then
+    echo -e "${COLOR_RED}ERROR:${COLOR_NULL} input_file_path is not a file!"
+    print_help
+fi
+
+echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} BEGIN and COMMIT are required because variables share the same name (e.g. row)"
+echo -e "${COLOR_ORANGE}NOTE:${COLOR_NULL} CONSTRAINTS are just skipped -> ${COLOR_RED}please create constraints manually if needed${COLOR_NULL}"
+
+
+echo 'CREATE INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' > "$OUTPUT_SCHEMA"
+
+sed -e 's/CREATE RANGE INDEX FOR (n:/CREATE INDEX ON :/g;' \
+    -e 's/) ON (n./(/g;' \
+    -e '/^CREATE CONSTRAINT/d' $INPUT_SCHEMA >> "$OUTPUT_SCHEMA"
+
+cat "$INPUT_NODES" > "$OUTPUT_NODES"
+cat "$INPUT_RELATIONSHIPS" > "$OUTPUT_RELATIONSHIPS"
+
+sed -e '/^DROP CONSTRAINT/d' "$INPUT_CLEANUP" >> "$OUTPUT_CLEANUP"
+
+echo 'DROP INDEX ON :`UNIQUE IMPORT LABEL`(`UNIQUE IMPORT ID`);' >> "$OUTPUT_CLEANUP"
+
+echo ""
+echo -e "${COLOR_GREEN}DONE!${COLOR_NULL} Please find Memgraph compatible cypherl|.cypher files under $OUTPUT_SCHEMA, $OUTPUT_NODES, $OUTPUT_RELATIONSHIPS and $OUTPUT_CLEANUP"
+echo ""
+echo "Please import data by executing => \`cat $OUTPUT_SCHEMA | mgconsole\`, \`cat $OUTPUT_NODES | mgconsole\`, \`cat $OUTPUT_RELATIONSHIPS | mgconsole\` and \`cat $OUTPUT_CLEANUP | mgconsole\`"

licenses/BSL.txt

@@ -36,7 +36,7 @@ ADDITIONAL USE GRANT:   You may use the Licensed Work in accordance with the
                         3. using the Licensed Work to create a work or solution
                         which competes (or might reasonably be expected to
                         compete) with the Licensed Work.
-CHANGE DATE:            2028-28-02
+CHANGE DATE:            2028-21-01
 CHANGE LICENSE:         Apache License, Version 2.0
 
 For information about alternative licensing arrangements, please visit: https://memgraph.com/legal.

query_modules/schema.cpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -9,10 +9,11 @@
 // by the Apache License, Version 2.0, included in the file
 // licenses/APL.txt.
 
+#include <boost/functional/hash.hpp>
 #include <mgp.hpp>
 #include "utils/string.hpp"
 
-#include <optional>
+#include <unordered_set>
 
 namespace Schema {
 
@@ -37,6 +38,7 @@ constexpr std::string_view kParameterIndices = "indices";
 constexpr std::string_view kParameterUniqueConstraints = "unique_constraints";
 constexpr std::string_view kParameterExistenceConstraints = "existence_constraints";
 constexpr std::string_view kParameterDropExisting = "drop_existing";
+constexpr int kInitialNumberOfPropertyOccurances = 1;
 
 std::string TypeOf(const mgp::Type &type);
 
@@ -108,83 +110,79 @@ void Schema::ProcessPropertiesRel(mgp::Record &record, const std::string_view &t
   record.Insert(std::string(kReturnMandatory).c_str(), mandatory);
 }
 
-struct Property {
-  std::string name;
-  mgp::Value value;
+struct PropertyInfo {
+  std::unordered_set<std::string> property_types;  // property types
+  int64_t number_of_property_occurrences = 0;
 
-  Property(const std::string &name, mgp::Value &&value) : name(name), value(std::move(value)) {}
+  PropertyInfo() = default;
+  explicit PropertyInfo(std::string &&property_type)
+      : property_types({std::move(property_type)}),
+        number_of_property_occurrences(Schema::kInitialNumberOfPropertyOccurances) {}
+};
+
+struct LabelsInfo {
+  std::unordered_map<std::string, PropertyInfo> properties;  // key is a property name
+  int64_t number_of_label_occurrences = 0;
 };
 
 struct LabelsHash {
-  std::size_t operator()(const std::set<std::string> &set) const {
-    std::size_t seed = set.size();
-    for (const auto &i : set) {
-      seed ^= std::hash<std::string>{}(i) + 0x9e3779b9 + (seed << 6) + (seed >> 2);
-    }
-    return seed;
-  }
+  std::size_t operator()(const std::set<std::string> &s) const { return boost::hash_range(s.begin(), s.end()); }
 };
 
 struct LabelsComparator {
   bool operator()(const std::set<std::string> &lhs, const std::set<std::string> &rhs) const { return lhs == rhs; }
 };
 
-struct PropertyComparator {
-  bool operator()(const Property &lhs, const Property &rhs) const { return lhs.name < rhs.name; }
-};
-
-struct PropertyInfo {
-  std::set<Property, PropertyComparator> properties;
-  bool mandatory;
-};
-
 void Schema::NodeTypeProperties(mgp_list * /*args*/, mgp_graph *memgraph_graph, mgp_result *result,
                                 mgp_memory *memory) {
   mgp::MemoryDispatcherGuard guard{memory};
   const auto record_factory = mgp::RecordFactory(result);
   try {
-    std::unordered_map<std::set<std::string>, PropertyInfo, LabelsHash, LabelsComparator> node_types_properties;
+    std::unordered_map<std::set<std::string>, LabelsInfo, LabelsHash, LabelsComparator> node_types_properties;
 
-    for (auto node : mgp::Graph(memgraph_graph).Nodes()) {
+    for (const auto node : mgp::Graph(memgraph_graph).Nodes()) {
       std::set<std::string> labels_set = {};
-      for (auto label : node.Labels()) {
+      for (const auto label : node.Labels()) {
         labels_set.emplace(label);
       }
 
-      if (node_types_properties.find(labels_set) == node_types_properties.end()) {
-        node_types_properties[labels_set] = PropertyInfo{std::set<Property, PropertyComparator>(), true};
-      }
+      node_types_properties[labels_set].number_of_label_occurrences++;
 
       if (node.Properties().empty()) {
-        node_types_properties[labels_set].mandatory = false;  // if there is node with no property, it is not mandatory
         continue;
       }
 
-      auto &property_info = node_types_properties.at(labels_set);
-      for (auto &[key, prop] : node.Properties()) {
-        property_info.properties.emplace(key, std::move(prop));
-        if (property_info.mandatory) {
-          property_info.mandatory =
-              property_info.properties.size() == 1;  // if there is only one property, it is mandatory
+      auto &labels_info = node_types_properties.at(labels_set);
+      for (const auto &[key, prop] : node.Properties()) {
+        auto prop_type = TypeOf(prop.Type());
+        if (labels_info.properties.find(key) == labels_info.properties.end()) {
+          labels_info.properties[key] = PropertyInfo{std::move(prop_type)};
+        } else {
+          labels_info.properties[key].property_types.emplace(prop_type);
+          labels_info.properties[key].number_of_property_occurrences++;
         }
       }
     }
 
-    for (auto &[labels, property_info] : node_types_properties) {
+    for (auto &[node_type, labels_info] : node_types_properties) {  // node type is a set of labels
       std::string label_type;
-      mgp::List labels_list = mgp::List();
-      for (auto const &label : labels) {
+      auto labels_list = mgp::List();
+      for (const auto &label : node_type) {
         label_type += ":`" + std::string(label) + "`";
         labels_list.AppendExtend(mgp::Value(label));
       }
-      for (auto const &prop : property_info.properties) {
+      for (const auto &prop : labels_info.properties) {
+        auto prop_types = mgp::List();
+        for (const auto &prop_type : prop.second.property_types) {
+          prop_types.AppendExtend(mgp::Value(prop_type));
+        }
+        bool mandatory = prop.second.number_of_property_occurrences == labels_info.number_of_label_occurrences;
         auto record = record_factory.NewRecord();
-        ProcessPropertiesNode(record, label_type, labels_list, prop.name, TypeOf(prop.value.Type()),
-                              property_info.mandatory);
+        ProcessPropertiesNode(record, label_type, labels_list, prop.first, prop_types, mandatory);
       }
-      if (property_info.properties.empty()) {
+      if (labels_info.properties.empty()) {
         auto record = record_factory.NewRecord();
-        ProcessPropertiesNode<std::string>(record, label_type, labels_list, "", "", false);
+        ProcessPropertiesNode<mgp::List>(record, label_type, labels_list, "", mgp::List(), false);
       }
     }
 
@@ -197,40 +195,45 @@ void Schema::NodeTypeProperties(mgp_list * /*args*/, mgp_graph *memgraph_graph,
 void Schema::RelTypeProperties(mgp_list * /*args*/, mgp_graph *memgraph_graph, mgp_result *result, mgp_memory *memory) {
   mgp::MemoryDispatcherGuard guard{memory};
 
-  std::unordered_map<std::string, PropertyInfo> rel_types_properties;
+  std::unordered_map<std::string, LabelsInfo> rel_types_properties;
   const auto record_factory = mgp::RecordFactory(result);
   try {
-    const mgp::Graph graph = mgp::Graph(memgraph_graph);
-    for (auto rel : graph.Relationships()) {
+    const auto graph = mgp::Graph(memgraph_graph);
+    for (const auto rel : graph.Relationships()) {
       std::string rel_type = std::string(rel.Type());
-      if (rel_types_properties.find(rel_type) == rel_types_properties.end()) {
-        rel_types_properties[rel_type] = PropertyInfo{std::set<Property, PropertyComparator>(), true};
-      }
+
+      rel_types_properties[rel_type].number_of_label_occurrences++;
 
       if (rel.Properties().empty()) {
-        rel_types_properties[rel_type].mandatory = false;  // if there is rel with no property, it is not mandatory
         continue;
       }
 
-      auto &property_info = rel_types_properties.at(rel_type);
+      auto &labels_info = rel_types_properties.at(rel_type);
       for (auto &[key, prop] : rel.Properties()) {
-        property_info.properties.emplace(key, std::move(prop));
-        if (property_info.mandatory) {
-          property_info.mandatory =
-              property_info.properties.size() == 1;  // if there is only one property, it is mandatory
+        auto prop_type = TypeOf(prop.Type());
+        if (labels_info.properties.find(key) == labels_info.properties.end()) {
+          labels_info.properties[key] = PropertyInfo{std::move(prop_type)};
+        } else {
+          labels_info.properties[key].property_types.emplace(prop_type);
+          labels_info.properties[key].number_of_property_occurrences++;
         }
       }
     }
 
-    for (auto &[type, property_info] : rel_types_properties) {
-      std::string type_str = ":`" + std::string(type) + "`";
-      for (auto const &prop : property_info.properties) {
+    for (auto &[rel_type, labels_info] : rel_types_properties) {
+      std::string type_str = ":`" + std::string(rel_type) + "`";
+      for (const auto &prop : labels_info.properties) {
+        auto prop_types = mgp::List();
+        for (const auto &prop_type : prop.second.property_types) {
+          prop_types.AppendExtend(mgp::Value(prop_type));
+        }
+        bool mandatory = prop.second.number_of_property_occurrences == labels_info.number_of_label_occurrences;
         auto record = record_factory.NewRecord();
-        ProcessPropertiesRel(record, type_str, prop.name, TypeOf(prop.value.Type()), property_info.mandatory);
+        ProcessPropertiesRel(record, type_str, prop.first, prop_types, mandatory);
       }
-      if (property_info.properties.empty()) {
+      if (labels_info.properties.empty()) {
         auto record = record_factory.NewRecord();
-        ProcessPropertiesRel<std::string>(record, type_str, "", "", false);
+        ProcessPropertiesRel<mgp::List>(record, type_str, "", mgp::List(), false);
       }
     }
 

src/auth/auth.cpp

@@ -35,16 +35,42 @@ DEFINE_VALIDATED_string(auth_module_executable, "", "Absolute path to the auth m
                           }
                           return true;
                         });
-DEFINE_bool(auth_module_create_missing_user, true, "Set to false to disable creation of missing users.");
-DEFINE_bool(auth_module_create_missing_role, true, "Set to false to disable creation of missing roles.");
-DEFINE_bool(auth_module_manage_roles, true, "Set to false to disable management of roles through the auth module.");
 DEFINE_VALIDATED_int32(auth_module_timeout_ms, 10000,
                        "Timeout (in milliseconds) used when waiting for a "
                        "response from the auth module.",
                        FLAG_IN_RANGE(100, 1800000));
 
+// DEPRECATED FLAGS
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(auth_module_create_missing_user, true,
+                             "Set to false to disable creation of missing users.", {
+                               spdlog::warn(
+                                   "auth_module_create_missing_user flag is deprecated. It not possible to create "
+                                   "users through the module anymore.");
+                               return true;
+                             });
+
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(auth_module_create_missing_role, true,
+                             "Set to false to disable creation of missing roles.", {
+                               spdlog::warn(
+                                   "auth_module_create_missing_role flag is deprecated. It not possible to create "
+                                   "roles through the module anymore.");
+                               return true;
+                             });
+
+// NOLINTNEXTLINE(cppcoreguidelines-avoid-non-const-global-variables, misc-unused-parameters)
+DEFINE_VALIDATED_HIDDEN_bool(
+    auth_module_manage_roles, true, "Set to false to disable management of roles through the auth module.", {
+      spdlog::warn(
+          "auth_module_manage_roles flag is deprecated. It not possible to create roles through the module anymore.");
+      return true;
+    });
+
 namespace memgraph::auth {
 
+const Auth::Epoch Auth::kStartEpoch = 1;
+
 namespace {
 #ifdef MG_ENTERPRISE
 /**
@@ -192,6 +218,17 @@ void MigrateVersions(kvstore::KVStore &store) {
     version_str = kVersionV1;
   }
 }
+
+auto ParseJson(std::string_view str) {
+  nlohmann::json data;
+  try {
+    data = nlohmann::json::parse(str);
+  } catch (const nlohmann::json::parse_error &e) {
+    throw AuthException("Couldn't load auth data!");
+  }
+  return data;
+}
+
 };  // namespace
 
 Auth::Auth(std::string storage_directory, Config config)
@@ -199,8 +236,11 @@ Auth::Auth(std::string storage_directory, Config config)
   MigrateVersions(storage_);
 }
 
-std::optional<User> Auth::Authenticate(const std::string &username, const std::string &password) {
+std::optional<UserOrRole> Auth::Authenticate(const std::string &username, const std::string &password) {
   if (module_.IsUsed()) {
+    /*
+     * MODULE AUTH STORAGE
+     */
     const auto license_check_result = license::global_license_checker.IsEnterpriseValid(utils::global_settings);
     if (license_check_result.HasError()) {
       spdlog::warn(license::LicenseCheckErrorToString(license_check_result.GetError(), "authentication modules"));
@@ -225,108 +265,64 @@ std::optional<User> Auth::Authenticate(const std::string &username, const std::s
     auto is_authenticated = ret_authenticated.get<bool>();
     const auto &rolename = ret_role.get<std::string>();
 
+    // Check if role is present
+    auto role = GetRole(rolename);
+    if (!role) {
+      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the role '{}' doesn't exist.",
+                                          username, rolename, "https://memgr.ph/auth"));
+      return std::nullopt;
+    }
+
     // Authenticate the user.
     if (!is_authenticated) return std::nullopt;
 
-    /**
-     * TODO
-     * The auth module should not update auth data.
-     * There is now way to replicate it and we should not be storing sensitive data if we don't have to.
-     */
-
-    // Find or create the user and return it.
-    auto user = GetUser(username);
-    if (!user) {
-      if (FLAGS_auth_module_create_missing_user) {
-        user = AddUser(username, password);
-        if (!user) {
-          spdlog::warn(utils::MessageWithLink(
-              "Couldn't create the missing user '{}' using the auth module because the user already exists as a role.",
-              username, "https://memgr.ph/auth"));
-          return std::nullopt;
-        }
-      } else {
-        spdlog::warn(utils::MessageWithLink(
-            "Couldn't authenticate user '{}' using the auth module because the user doesn't exist.", username,
-            "https://memgr.ph/auth"));
-        return std::nullopt;
-      }
-    } else {
-      UpdatePassword(*user, password);
-    }
-    if (FLAGS_auth_module_manage_roles) {
-      if (!rolename.empty()) {
-        auto role = GetRole(rolename);
-        if (!role) {
-          if (FLAGS_auth_module_create_missing_role) {
-            role = AddRole(rolename);
-            if (!role) {
-              spdlog::warn(
-                  utils::MessageWithLink("Couldn't authenticate user '{}' using the auth module because the user's "
-                                         "role '{}' already exists as a user.",
-                                         username, rolename, "https://memgr.ph/auth"));
-              return std::nullopt;
-            }
-            SaveRole(*role);
-          } else {
-            spdlog::warn(utils::MessageWithLink(
-                "Couldn't authenticate user '{}' using the auth module because the user's role '{}' doesn't exist.",
-                username, rolename, "https://memgr.ph/auth"));
-            return std::nullopt;
-          }
-        }
-        user->SetRole(*role);
-      } else {
-        user->ClearRole();
-      }
-    }
-    SaveUser(*user);
-    return user;
-  } else {
-    auto user = GetUser(username);
-    if (!user) {
-      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the user doesn't exist.", username,
-                                          "https://memgr.ph/auth"));
-      return std::nullopt;
-    }
-    if (!user->CheckPassword(password)) {
-      spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the password is not correct.",
-                                          username, "https://memgr.ph/auth"));
-      return std::nullopt;
-    }
-    if (user->UpgradeHash(password)) {
-      SaveUser(*user);
-    }
-
-    return user;
+    return RoleWUsername{username, std::move(*role)};
   }
+
+  /*
+   * LOCAL AUTH STORAGE
+   */
+  auto user = GetUser(username);
+  if (!user) {
+    spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the user doesn't exist.", username,
+                                        "https://memgr.ph/auth"));
+    return std::nullopt;
+  }
+  if (!user->CheckPassword(password)) {
+    spdlog::warn(utils::MessageWithLink("Couldn't authenticate user '{}' because the password is not correct.",
+                                        username, "https://memgr.ph/auth"));
+    return std::nullopt;
+  }
+  if (user->UpgradeHash(password)) {
+    SaveUser(*user);
+  }
+
+  return user;
 }
 
-std::optional<User> Auth::GetUser(const std::string &username_orig) const {
-  auto username = utils::ToLowerCase(username_orig);
-  auto existing_user = storage_.Get(kUserPrefix + username);
-  if (!existing_user) return std::nullopt;
-
-  nlohmann::json data;
-  try {
-    data = nlohmann::json::parse(*existing_user);
-  } catch (const nlohmann::json::parse_error &e) {
-    throw AuthException("Couldn't load user data!");
-  }
-
-  auto user = User::Deserialize(data);
-  auto link = storage_.Get(kLinkPrefix + username);
-
+void Auth::LinkUser(User &user) const {
+  auto link = storage_.Get(kLinkPrefix + user.username());
   if (link) {
     auto role = GetRole(*link);
     if (role) {
       user.SetRole(*role);
     }
   }
+}
+
+std::optional<User> Auth::GetUser(const std::string &username_orig) const {
+  if (module_.IsUsed()) return std::nullopt;  // User's are not supported when using module
+  auto username = utils::ToLowerCase(username_orig);
+  auto existing_user = storage_.Get(kUserPrefix + username);
+  if (!existing_user) return std::nullopt;
+
+  auto user = User::Deserialize(ParseJson(*existing_user));
+  LinkUser(user);
   return user;
 }
 
 void Auth::SaveUser(const User &user, system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   bool success = false;
   if (const auto *role = user.role(); role != nullptr) {
     success = storage_.PutMultiple(
@@ -338,6 +334,10 @@ void Auth::SaveUser(const User &user, system::Transaction *system_tx) {
   if (!success) {
     throw AuthException("Couldn't save user '{}'!", user.username());
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
   // All changes to the user end up calling this function, so no need to add a delta anywhere else
   if (system_tx) {
 #ifdef MG_ENTERPRISE
@@ -347,6 +347,7 @@ void Auth::SaveUser(const User &user, system::Transaction *system_tx) {
 }
 
 void Auth::UpdatePassword(auth::User &user, const std::optional<std::string> &password) {
+  DisableIfModuleUsed();
   // Check if null
   if (!password) {
     if (!config_.password_permit_null) {
@@ -378,6 +379,7 @@ void Auth::UpdatePassword(auth::User &user, const std::optional<std::string> &pa
 
 std::optional<User> Auth::AddUser(const std::string &username, const std::optional<std::string> &password,
                                   system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   if (!NameRegexMatch(username)) {
     throw AuthException("Invalid user name.");
   }
@@ -392,12 +394,17 @@ std::optional<User> Auth::AddUser(const std::string &username, const std::option
 }
 
 bool Auth::RemoveUser(const std::string &username_orig, system::Transaction *system_tx) {
+  DisableIfModuleUsed();
   auto username = utils::ToLowerCase(username_orig);
   if (!storage_.Get(kUserPrefix + username)) return false;
   std::vector<std::string> keys({kLinkPrefix + username, kUserPrefix + username});
   if (!storage_.DeleteMultiple(keys)) {
     throw AuthException("Couldn't remove user '{}'!", username);
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
   // Handling drop user delta
   if (system_tx) {
 #ifdef MG_ENTERPRISE
@@ -412,9 +419,12 @@ std::vector<auth::User> Auth::AllUsers() const {
   for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
     auto username = it->first.substr(kUserPrefix.size());
     if (username != utils::ToLowerCase(username)) continue;
-    auto user = GetUser(username);
-    if (user) {
-      ret.push_back(std::move(*user));
+    try {
+      User user = auth::User::Deserialize(ParseJson(it->second));  // Will throw on failure
+      LinkUser(user);
+      ret.emplace_back(std::move(user));
+    } catch (AuthException &) {
+      continue;
     }
   }
   return ret;
@@ -425,9 +435,12 @@ std::vector<std::string> Auth::AllUsernames() const {
   for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
     auto username = it->first.substr(kUserPrefix.size());
     if (username != utils::ToLowerCase(username)) continue;
-    auto user = GetUser(username);
-    if (user) {
-      ret.push_back(username);
+    try {
+      // Check if serialized correctly
+      memgraph::auth::User::Deserialize(ParseJson(it->second));  // Will throw on failure
+      ret.emplace_back(std::move(username));
+    } catch (AuthException &) {
+      continue;
     }
   }
   return ret;
@@ -435,25 +448,24 @@ std::vector<std::string> Auth::AllUsernames() const {
 
 bool Auth::HasUsers() const { return storage_.begin(kUserPrefix) != storage_.end(kUserPrefix); }
 
+bool Auth::AccessControlled() const { return HasUsers() || module_.IsUsed(); }
+
 std::optional<Role> Auth::GetRole(const std::string &rolename_orig) const {
   auto rolename = utils::ToLowerCase(rolename_orig);
   auto existing_role = storage_.Get(kRolePrefix + rolename);
   if (!existing_role) return std::nullopt;
 
-  nlohmann::json data;
-  try {
-    data = nlohmann::json::parse(*existing_role);
-  } catch (const nlohmann::json::parse_error &e) {
-    throw AuthException("Couldn't load role data!");
-  }
-
-  return Role::Deserialize(data);
+  return Role::Deserialize(ParseJson(*existing_role));
 }
 
 void Auth::SaveRole(const Role &role, system::Transaction *system_tx) {
   if (!storage_.Put(kRolePrefix + role.rolename(), role.Serialize().dump())) {
     throw AuthException("Couldn't save role '{}'!", role.rolename());
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
   // All changes to the role end up calling this function, so no need to add a delta anywhere else
   if (system_tx) {
 #ifdef MG_ENTERPRISE
@@ -486,6 +498,10 @@ bool Auth::RemoveRole(const std::string &rolename_orig, system::Transaction *sys
   if (!storage_.DeleteMultiple(keys)) {
     throw AuthException("Couldn't remove role '{}'!", rolename);
   }
+
+  // Durability updated -> new epoch
+  UpdateEpoch();
+
   // Handling drop role delta
   if (system_tx) {
 #ifdef MG_ENTERPRISE
@@ -500,11 +516,8 @@ std::vector<auth::Role> Auth::AllRoles() const {
   for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
     auto rolename = it->first.substr(kRolePrefix.size());
     if (rolename != utils::ToLowerCase(rolename)) continue;
-    if (auto role = GetRole(rolename)) {
-      ret.push_back(*role);
-    } else {
-      throw AuthException("Couldn't load role '{}'!", rolename);
-    }
+    Role role = memgraph::auth::Role::Deserialize(ParseJson(it->second));  // Will throw on failure
+    ret.emplace_back(std::move(role));
   }
   return ret;
 }
@@ -514,14 +527,19 @@ std::vector<std::string> Auth::AllRolenames() const {
   for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
     auto rolename = it->first.substr(kRolePrefix.size());
     if (rolename != utils::ToLowerCase(rolename)) continue;
-    if (auto role = GetRole(rolename)) {
-      ret.push_back(rolename);
+    try {
+      // Check that the data is serialized correctly
+      memgraph::auth::Role::Deserialize(ParseJson(it->second));
+      ret.emplace_back(std::move(rolename));
+    } catch (AuthException &) {
+      continue;
     }
   }
   return ret;
 }
 
 std::vector<auth::User> Auth::AllUsersForRole(const std::string &rolename_orig) const {
+  DisableIfModuleUsed();
   const auto rolename = utils::ToLowerCase(rolename_orig);
   std::vector<auth::User> ret;
   for (auto it = storage_.begin(kLinkPrefix); it != storage_.end(kLinkPrefix); ++it) {
@@ -540,51 +558,176 @@ std::vector<auth::User> Auth::AllUsersForRole(const std::string &rolename_orig)
 }
 
 #ifdef MG_ENTERPRISE
-bool Auth::GrantDatabaseToUser(const std::string &db, const std::string &name, system::Transaction *system_tx) {
-  if (auto user = GetUser(name)) {
-    if (db == kAllDatabases) {
-      user->db_access().GrantAll();
-    } else {
-      user->db_access().Add(db);
+Auth::Result Auth::GrantDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      GrantDatabase(db, *role, system_tx);
+      return SUCCESS;
     }
-    SaveUser(*user, system_tx);
-    return true;
+    return NO_ROLE;
   }
-  return false;
+  if (auto user = GetUser(name)) {
+    GrantDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    GrantDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
 }
 
-bool Auth::RevokeDatabaseFromUser(const std::string &db, const std::string &name, system::Transaction *system_tx) {
-  if (auto user = GetUser(name)) {
-    if (db == kAllDatabases) {
-      user->db_access().DenyAll();
-    } else {
-      user->db_access().Remove(db);
-    }
-    SaveUser(*user, system_tx);
-    return true;
+void Auth::GrantDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().GrantAll();
+  } else {
+    user.db_access().Grant(db);
   }
-  return false;
+  SaveUser(user, system_tx);
+}
+
+void Auth::GrantDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().GrantAll();
+  } else {
+    role.db_access().Grant(db);
+  }
+  SaveRole(role, system_tx);
+}
+
+Auth::Result Auth::DenyDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      DenyDatabase(db, *role, system_tx);
+      return SUCCESS;
+    }
+    return NO_ROLE;
+  }
+  if (auto user = GetUser(name)) {
+    DenyDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    DenyDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::DenyDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().DenyAll();
+  } else {
+    user.db_access().Deny(db);
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::DenyDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().DenyAll();
+  } else {
+    role.db_access().Deny(db);
+  }
+  SaveRole(role, system_tx);
+}
+
+Auth::Result Auth::RevokeDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      RevokeDatabase(db, *role, system_tx);
+      return SUCCESS;
+    }
+    return NO_ROLE;
+  }
+  if (auto user = GetUser(name)) {
+    RevokeDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    RevokeDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::RevokeDatabase(const std::string &db, User &user, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    user.db_access().RevokeAll();
+  } else {
+    user.db_access().Revoke(db);
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::RevokeDatabase(const std::string &db, Role &role, system::Transaction *system_tx) {
+  if (db == kAllDatabases) {
+    role.db_access().RevokeAll();
+  } else {
+    role.db_access().Revoke(db);
+  }
+  SaveRole(role, system_tx);
 }
 
 void Auth::DeleteDatabase(const std::string &db, system::Transaction *system_tx) {
   for (auto it = storage_.begin(kUserPrefix); it != storage_.end(kUserPrefix); ++it) {
     auto username = it->first.substr(kUserPrefix.size());
-    if (auto user = GetUser(username)) {
-      user->db_access().Delete(db);
-      SaveUser(*user, system_tx);
+    try {
+      User user = auth::User::Deserialize(ParseJson(it->second));
+      LinkUser(user);
+      user.db_access().Revoke(db);
+      SaveUser(user, system_tx);
+    } catch (AuthException &) {
+      continue;
+    }
+  }
+  for (auto it = storage_.begin(kRolePrefix); it != storage_.end(kRolePrefix); ++it) {
+    auto rolename = it->first.substr(kRolePrefix.size());
+    try {
+      auto role = memgraph::auth::Role::Deserialize(ParseJson(it->second));
+      role.db_access().Revoke(db);
+      SaveRole(role, system_tx);
+    } catch (AuthException &) {
+      continue;
     }
   }
 }
 
-bool Auth::SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx) {
-  if (auto user = GetUser(name)) {
-    if (!user->db_access().SetDefault(db)) {
-      throw AuthException("Couldn't set default database '{}' for user '{}'!", db, name);
+Auth::Result Auth::SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx) {
+  using enum Auth::Result;
+  if (module_.IsUsed()) {
+    if (auto role = GetRole(name)) {
+      SetMainDatabase(db, *role, system_tx);
+      return SUCCESS;
     }
-    SaveUser(*user, system_tx);
-    return true;
+    return NO_ROLE;
   }
-  return false;
+  if (auto user = GetUser(name)) {
+    SetMainDatabase(db, *user, system_tx);
+    return SUCCESS;
+  }
+  if (auto role = GetRole(name)) {
+    SetMainDatabase(db, *role, system_tx);
+    return SUCCESS;
+  }
+  return NO_USER_ROLE;
+}
+
+void Auth::SetMainDatabase(std::string_view db, User &user, system::Transaction *system_tx) {
+  if (!user.db_access().SetMain(db)) {
+    throw AuthException("Couldn't set default database '{}' for '{}'!", db, user.username());
+  }
+  SaveUser(user, system_tx);
+}
+
+void Auth::SetMainDatabase(std::string_view db, Role &role, system::Transaction *system_tx) {
+  if (!role.db_access().SetMain(db)) {
+    throw AuthException("Couldn't set default database '{}' for '{}'!", db, role.rolename());
+  }
+  SaveRole(role, system_tx);
 }
 #endif
 

src/auth/auth.hpp

@@ -29,6 +29,18 @@ using SynchedAuth = memgraph::utils::Synchronized<memgraph::auth::Auth, memgraph
 
 static const constexpr char *const kAllDatabases = "*";
 
+struct RoleWUsername : Role {
+  template <typename... Args>
+  RoleWUsername(std::string_view username, Args &&...args) : Role{std::forward<Args>(args)...}, username_{username} {}
+
+  std::string username() { return username_; }
+  const std::string &username() const { return username_; }
+
+ private:
+  std::string username_;
+};
+using UserOrRole = std::variant<User, RoleWUsername>;
+
 /**
  * This class serves as the main Authentication/Authorization storage.
  * It provides functions for managing Users, Roles, Permissions and FineGrainedAccessPermissions.
@@ -61,6 +73,25 @@ class Auth final {
     std::regex password_regex{password_regex_str};
   };
 
+  struct Epoch {
+    Epoch() : epoch_{0} {}
+    Epoch(unsigned e) : epoch_{e} {}
+
+    Epoch operator++() { return ++epoch_; }
+    bool operator==(const Epoch &rhs) const = default;
+
+   private:
+    unsigned epoch_;
+  };
+
+  static const Epoch kStartEpoch;
+
+  enum class Result {
+    SUCCESS,
+    NO_USER_ROLE,
+    NO_ROLE,
+  };
+
   explicit Auth(std::string storage_directory, Config config);
 
   /**
@@ -89,7 +120,7 @@ class Auth final {
    * @return a user when the username and password match, nullopt otherwise
    * @throw AuthException if unable to authenticate for whatever reason.
    */
-  std::optional<User> Authenticate(const std::string &username, const std::string &password);
+  std::optional<UserOrRole> Authenticate(const std::string &username, const std::string &password);
 
   /**
    * Gets a user from the storage.
@@ -101,6 +132,8 @@ class Auth final {
    */
   std::optional<User> GetUser(const std::string &username) const;
 
+  void LinkUser(User &user) const;
+
   /**
    * Saves a user object to the storage.
    *
@@ -163,6 +196,13 @@ class Auth final {
    */
   bool HasUsers() const;
 
+  /**
+   * Returns whether the access is controlled by authentication/authorization.
+   *
+   * @return `true` if auth needs to run
+   */
+  bool AccessControlled() const;
+
   /**
    * Gets a role from the storage.
    *
@@ -173,6 +213,37 @@ class Auth final {
    */
   std::optional<Role> GetRole(const std::string &rolename) const;
 
+  std::optional<UserOrRole> GetUserOrRole(const std::optional<std::string> &username,
+                                          const std::optional<std::string> &rolename) const {
+    auto expect = [](bool condition, std::string &&msg) {
+      if (!condition) throw AuthException(std::move(msg));
+    };
+    // Special case if we are using a module; we must find the specified role
+    if (module_.IsUsed()) {
+      expect(username && rolename, "When using a module, a role needs to be connected to a username.");
+      const auto role = GetRole(*rolename);
+      expect(role != std::nullopt, "No role named " + *rolename);
+      return UserOrRole(auth::RoleWUsername{*username, *role});
+    }
+
+    // First check if we need to find a role
+    if (username && rolename) {
+      const auto role = GetRole(*rolename);
+      expect(role != std::nullopt, "No role named " + *rolename);
+      return UserOrRole(auth::RoleWUsername{*username, *role});
+    }
+
+    // We are only looking for a user
+    if (username) {
+      const auto user = GetUser(*username);
+      expect(user != std::nullopt, "No user named " + *username);
+      return *user;
+    }
+
+    // No user or role
+    return std::nullopt;
+  }
+
   /**
    * Saves a role object to the storage.
    *
@@ -229,16 +300,6 @@ class Auth final {
   std::vector<User> AllUsersForRole(const std::string &rolename) const;
 
 #ifdef MG_ENTERPRISE
-  /**
-   * @brief Revoke access to individual database for a user.
-   *
-   * @param db name of the database to revoke
-   * @param name user's username
-   * @return true on success
-   * @throw AuthException if unable to find or update the user
-   */
-  bool RevokeDatabaseFromUser(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
-
   /**
    * @brief Grant access to individual database for a user.
    *
@@ -247,7 +308,33 @@ class Auth final {
    * @return true on success
    * @throw AuthException if unable to find or update the user
    */
-  bool GrantDatabaseToUser(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  Result GrantDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void GrantDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void GrantDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
+
+  /**
+   * @brief Revoke access to individual database for a user.
+   *
+   * @param db name of the database to revoke
+   * @param name user's username
+   * @return true on success
+   * @throw AuthException if unable to find or update the user
+   */
+  Result DenyDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void DenyDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void DenyDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
+
+  /**
+   * @brief Revoke access to individual database for a user.
+   *
+   * @param db name of the database to revoke
+   * @param name user's username
+   * @return true on success
+   * @throw AuthException if unable to find or update the user
+   */
+  Result RevokeDatabase(const std::string &db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void RevokeDatabase(const std::string &db, User &user, system::Transaction *system_tx = nullptr);
+  void RevokeDatabase(const std::string &db, Role &role, system::Transaction *system_tx = nullptr);
 
   /**
    * @brief Delete a database from all users.
@@ -265,9 +352,17 @@ class Auth final {
    * @return true on success
    * @throw AuthException if unable to find or update the user
    */
-  bool SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx = nullptr);
+  Result SetMainDatabase(std::string_view db, const std::string &name, system::Transaction *system_tx = nullptr);
+  void SetMainDatabase(std::string_view db, User &user, system::Transaction *system_tx = nullptr);
+  void SetMainDatabase(std::string_view db, Role &role, system::Transaction *system_tx = nullptr);
 #endif
 
+  bool UpToDate(Epoch &e) const {
+    bool res = e == epoch_;
+    e = epoch_;
+    return res;
+  }
+
  private:
   /**
    * @brief
@@ -278,11 +373,18 @@ class Auth final {
    */
   bool NameRegexMatch(const std::string &user_or_role) const;
 
+  void UpdateEpoch() { ++epoch_; }
+
+  void DisableIfModuleUsed() const {
+    if (module_.IsUsed()) throw AuthException("Operation not permited when using an authentication module.");
+  }
+
   // Even though the `kvstore::KVStore` class is guaranteed to be thread-safe,
   // Auth is not thread-safe because modifying users and roles might require
   // more than one operation on the storage.
   kvstore::KVStore storage_;
   auth::Module module_;
   Config config_;
+  Epoch epoch_{kStartEpoch};
 };
 }  // namespace memgraph::auth

src/auth/models.cpp

@@ -425,10 +425,11 @@ Role::Role(const std::string &rolename, const Permissions &permissions)
     : rolename_(utils::ToLowerCase(rolename)), permissions_(permissions) {}
 #ifdef MG_ENTERPRISE
 Role::Role(const std::string &rolename, const Permissions &permissions,
-           FineGrainedAccessHandler fine_grained_access_handler)
+           FineGrainedAccessHandler fine_grained_access_handler, Databases db_access)
     : rolename_(utils::ToLowerCase(rolename)),
       permissions_(permissions),
-      fine_grained_access_handler_(std::move(fine_grained_access_handler)) {}
+      fine_grained_access_handler_(std::move(fine_grained_access_handler)),
+      db_access_(std::move(db_access)) {}
 #endif
 
 const std::string &Role::rolename() const { return rolename_; }
@@ -454,8 +455,10 @@ nlohmann::json Role::Serialize() const {
 #ifdef MG_ENTERPRISE
   if (memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     data[kFineGrainedAccessHandler] = fine_grained_access_handler_.Serialize();
+    data[kDatabases] = db_access_.Serialize();
   } else {
     data[kFineGrainedAccessHandler] = {};
+    data[kDatabases] = {};
   }
 #endif
   return data;
@@ -471,12 +474,21 @@ Role Role::Deserialize(const nlohmann::json &data) {
   auto permissions = Permissions::Deserialize(data[kPermissions]);
 #ifdef MG_ENTERPRISE
   if (memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
+    Databases db_access;
+    if (data[kDatabases].is_structured()) {
+      db_access = Databases::Deserialize(data[kDatabases]);
+    } else {
+      // Back-compatibility
+      spdlog::warn("Role without specified database access. Given access to the default database.");
+      db_access.Grant(dbms::kDefaultDB);
+      db_access.SetMain(dbms::kDefaultDB);
+    }
     FineGrainedAccessHandler fine_grained_access_handler;
     // We can have an empty fine_grained if the user was created without a valid license
     if (data[kFineGrainedAccessHandler].is_object()) {
       fine_grained_access_handler = FineGrainedAccessHandler::Deserialize(data[kFineGrainedAccessHandler]);
     }
-    return {data[kRoleName], permissions, std::move(fine_grained_access_handler)};
+    return {data[kRoleName], permissions, std::move(fine_grained_access_handler), std::move(db_access)};
   }
 #endif
   return {data[kRoleName], permissions};
@@ -493,7 +505,7 @@ bool operator==(const Role &first, const Role &second) {
 }
 
 #ifdef MG_ENTERPRISE
-void Databases::Add(std::string_view db) {
+void Databases::Grant(std::string_view db) {
   if (allow_all_) {
     grants_dbs_.clear();
     allow_all_ = false;
@@ -502,19 +514,19 @@ void Databases::Add(std::string_view db) {
   denies_dbs_.erase(std::string{db});  // TODO: C++23 use transparent key compare
 }
 
-void Databases::Remove(const std::string &db) {
+void Databases::Deny(const std::string &db) {
   denies_dbs_.emplace(db);
   grants_dbs_.erase(db);
 }
 
-void Databases::Delete(const std::string &db) {
+void Databases::Revoke(const std::string &db) {
   denies_dbs_.erase(db);
   if (!allow_all_) {
     grants_dbs_.erase(db);
   }
   // Reset if default deleted
-  if (default_db_ == db) {
-    default_db_ = "";
+  if (main_db_ == db) {
+    main_db_ = "";
   }
 }
 
@@ -530,9 +542,16 @@ void Databases::DenyAll() {
   denies_dbs_.clear();
 }
 
-bool Databases::SetDefault(std::string_view db) {
+void Databases::RevokeAll() {
+  allow_all_ = false;
+  grants_dbs_.clear();
+  denies_dbs_.clear();
+  main_db_ = "";
+}
+
+bool Databases::SetMain(std::string_view db) {
   if (!Contains(db)) return false;
-  default_db_ = db;
+  main_db_ = db;
   return true;
 }
 
@@ -540,11 +559,11 @@ bool Databases::SetDefault(std::string_view db) {
   return !denies_dbs_.contains(db) && (allow_all_ || grants_dbs_.contains(db));
 }
 
-const std::string &Databases::GetDefault() const {
-  if (!Contains(default_db_)) {
-    throw AuthException("No access to the set default database \"{}\".", default_db_);
+const std::string &Databases::GetMain() const {
+  if (!Contains(main_db_)) {
+    throw AuthException("No access to the set default database \"{}\".", main_db_);
   }
-  return default_db_;
+  return main_db_;
 }
 
 nlohmann::json Databases::Serialize() const {
@@ -552,7 +571,7 @@ nlohmann::json Databases::Serialize() const {
   data[kGrants] = grants_dbs_;
   data[kDenies] = denies_dbs_;
   data[kAllowAll] = allow_all_;
-  data[kDefault] = default_db_;
+  data[kDefault] = main_db_;
   return data;
 }
 
@@ -719,15 +738,16 @@ User User::Deserialize(const nlohmann::json &data) {
     } else {
       // Back-compatibility
       spdlog::warn("User without specified database access. Given access to the default database.");
-      db_access.Add(dbms::kDefaultDB);
-      db_access.SetDefault(dbms::kDefaultDB);
+      db_access.Grant(dbms::kDefaultDB);
+      db_access.SetMain(dbms::kDefaultDB);
     }
     FineGrainedAccessHandler fine_grained_access_handler;
     // We can have an empty fine_grained if the user was created without a valid license
     if (data[kFineGrainedAccessHandler].is_object()) {
       fine_grained_access_handler = FineGrainedAccessHandler::Deserialize(data[kFineGrainedAccessHandler]);
     }
-    return {data[kUsername], std::move(password_hash), permissions, std::move(fine_grained_access_handler), db_access};
+    return {data[kUsername], std::move(password_hash), permissions, std::move(fine_grained_access_handler),
+            std::move(db_access)};
   }
 #endif
   return {data[kUsername], std::move(password_hash), permissions};

src/auth/models.hpp

@@ -205,52 +205,10 @@ class FineGrainedAccessHandler final {
 bool operator==(const FineGrainedAccessHandler &first, const FineGrainedAccessHandler &second);
 #endif
 
-class Role final {
- public:
-  Role() = default;
-
-  explicit Role(const std::string &rolename);
-  Role(const std::string &rolename, const Permissions &permissions);
-#ifdef MG_ENTERPRISE
-  Role(const std::string &rolename, const Permissions &permissions,
-       FineGrainedAccessHandler fine_grained_access_handler);
-#endif
-  Role(const Role &) = default;
-  Role &operator=(const Role &) = default;
-  Role(Role &&) noexcept = default;
-  Role &operator=(Role &&) noexcept = default;
-  ~Role() = default;
-
-  const std::string &rolename() const;
-  const Permissions &permissions() const;
-  Permissions &permissions();
-#ifdef MG_ENTERPRISE
-  const FineGrainedAccessHandler &fine_grained_access_handler() const;
-  FineGrainedAccessHandler &fine_grained_access_handler();
-  const FineGrainedAccessPermissions &GetFineGrainedAccessLabelPermissions() const;
-  const FineGrainedAccessPermissions &GetFineGrainedAccessEdgeTypePermissions() const;
-#endif
-  nlohmann::json Serialize() const;
-
-  /// @throw AuthException if unable to deserialize.
-  static Role Deserialize(const nlohmann::json &data);
-
-  friend bool operator==(const Role &first, const Role &second);
-
- private:
-  std::string rolename_;
-  Permissions permissions_;
-#ifdef MG_ENTERPRISE
-  FineGrainedAccessHandler fine_grained_access_handler_;
-#endif
-};
-
-bool operator==(const Role &first, const Role &second);
-
 #ifdef MG_ENTERPRISE
 class Databases final {
  public:
-  Databases() : grants_dbs_{std::string{dbms::kDefaultDB}}, allow_all_(false), default_db_(dbms::kDefaultDB) {}
+  Databases() : grants_dbs_{std::string{dbms::kDefaultDB}}, allow_all_(false), main_db_(dbms::kDefaultDB) {}
 
   Databases(const Databases &) = default;
   Databases &operator=(const Databases &) = default;
@@ -263,7 +221,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Add(std::string_view db);
+  void Grant(std::string_view db);
 
   /**
    * @brief Remove database to the list of granted access.
@@ -272,7 +230,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Remove(const std::string &db);
+  void Deny(const std::string &db);
 
   /**
    * @brief Called when database is dropped. Removes it from granted (if allow_all is false) and denied set.
@@ -280,7 +238,7 @@ class Databases final {
    *
    * @param db name of the database to grant access to
    */
-  void Delete(const std::string &db);
+  void Revoke(const std::string &db);
 
   /**
    * @brief Set allow_all_ to true and clears grants and denied sets.
@@ -292,10 +250,15 @@ class Databases final {
    */
   void DenyAll();
 
+  /**
+   * @brief Set allow_all_ to false and clears grants and denied sets.
+   */
+  void RevokeAll();
+
   /**
    * @brief Set the default database.
    */
-  bool SetDefault(std::string_view db);
+  bool SetMain(std::string_view db);
 
   /**
    * @brief Checks if access is grated to the database.
@@ -304,11 +267,13 @@ class Databases final {
    * @return true if allow_all and not denied or granted
    */
   bool Contains(std::string_view db) const;
+  bool Denies(std::string_view db_name) const { return denies_dbs_.contains(db_name); }
+  bool Grants(std::string_view db_name) const { return allow_all_ || grants_dbs_.contains(db_name); }
 
   bool GetAllowAll() const { return allow_all_; }
   const std::set<std::string, std::less<>> &GetGrants() const { return grants_dbs_; }
   const std::set<std::string, std::less<>> &GetDenies() const { return denies_dbs_; }
-  const std::string &GetDefault() const;
+  const std::string &GetMain() const;
 
   nlohmann::json Serialize() const;
   /// @throw AuthException if unable to deserialize.
@@ -320,15 +285,69 @@ class Databases final {
       : grants_dbs_(std::move(grant)),
         denies_dbs_(std::move(deny)),
         allow_all_(allow_all),
-        default_db_(std::move(default_db)) {}
+        main_db_(std::move(default_db)) {}
 
   std::set<std::string, std::less<>> grants_dbs_;  //!< set of databases with granted access
   std::set<std::string, std::less<>> denies_dbs_;  //!< set of databases with denied access
   bool allow_all_;                                 //!< flag to allow access to everything (denied overrides this)
-  std::string default_db_;                         //!< user's default database
+  std::string main_db_;                            //!< user's default database
 };
 #endif
 
+class Role {
+ public:
+  Role() = default;
+
+  explicit Role(const std::string &rolename);
+  Role(const std::string &rolename, const Permissions &permissions);
+#ifdef MG_ENTERPRISE
+  Role(const std::string &rolename, const Permissions &permissions,
+       FineGrainedAccessHandler fine_grained_access_handler, Databases db_access = {});
+#endif
+  Role(const Role &) = default;
+  Role &operator=(const Role &) = default;
+  Role(Role &&) noexcept = default;
+  Role &operator=(Role &&) noexcept = default;
+  ~Role() = default;
+
+  const std::string &rolename() const;
+  const Permissions &permissions() const;
+  Permissions &permissions();
+  Permissions GetPermissions() const { return permissions_; }
+#ifdef MG_ENTERPRISE
+  const FineGrainedAccessHandler &fine_grained_access_handler() const;
+  FineGrainedAccessHandler &fine_grained_access_handler();
+  const FineGrainedAccessPermissions &GetFineGrainedAccessLabelPermissions() const;
+  const FineGrainedAccessPermissions &GetFineGrainedAccessEdgeTypePermissions() const;
+#endif
+
+#ifdef MG_ENTERPRISE
+  Databases &db_access() { return db_access_; }
+  const Databases &db_access() const { return db_access_; }
+
+  bool DeniesDB(std::string_view db_name) const { return db_access_.Denies(db_name); }
+  bool GrantsDB(std::string_view db_name) const { return db_access_.Grants(db_name); }
+  bool HasAccess(std::string_view db_name) const { return !DeniesDB(db_name) && GrantsDB(db_name); }
+#endif
+
+  nlohmann::json Serialize() const;
+
+  /// @throw AuthException if unable to deserialize.
+  static Role Deserialize(const nlohmann::json &data);
+
+  friend bool operator==(const Role &first, const Role &second);
+
+ private:
+  std::string rolename_;
+  Permissions permissions_;
+#ifdef MG_ENTERPRISE
+  FineGrainedAccessHandler fine_grained_access_handler_;
+  Databases db_access_;
+#endif
+};
+
+bool operator==(const Role &first, const Role &second);
+
 // TODO (mferencevic): Implement password expiry.
 class User final {
  public:
@@ -388,6 +407,18 @@ class User final {
 #ifdef MG_ENTERPRISE
   Databases &db_access() { return database_access_; }
   const Databases &db_access() const { return database_access_; }
+
+  bool DeniesDB(std::string_view db_name) const {
+    bool denies = database_access_.Denies(db_name);
+    if (role_) denies |= role_->DeniesDB(db_name);
+    return denies;
+  }
+  bool GrantsDB(std::string_view db_name) const {
+    bool grants = database_access_.Grants(db_name);
+    if (role_) grants |= role_->GrantsDB(db_name);
+    return grants;
+  }
+  bool HasAccess(std::string_view db_name) const { return !DeniesDB(db_name) && GrantsDB(db_name); }
 #endif
 
   nlohmann::json Serialize() const;
@@ -403,7 +434,7 @@ class User final {
   Permissions permissions_;
 #ifdef MG_ENTERPRISE
   FineGrainedAccessHandler fine_grained_access_handler_;
-  Databases database_access_;
+  Databases database_access_{};
 #endif
   std::optional<Role> role_;
 };

src/auth/module.cpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Licensed as a Memgraph Enterprise file under the Memgraph Enterprise
 // License (the "License"); by using this file, you agree to be bound by the terms of the License, and you may not use
@@ -403,7 +403,7 @@ nlohmann::json Module::Call(const nlohmann::json &params, int timeout_millisec)
   return ret;
 }
 
-bool Module::IsUsed() { return !module_executable_path_.empty(); }
+bool Module::IsUsed() const { return !module_executable_path_.empty(); }
 
 void Module::Shutdown() {
   if (pid_ == -1) return;

src/auth/module.hpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Licensed as a Memgraph Enterprise file under the Memgraph Enterprise
 // License (the "License"); by using this file, you agree to be bound by the terms of the License, and you may not use
@@ -49,7 +49,7 @@ class Module final {
   /// specified executable path and can thus be used.
   ///
   /// @return boolean indicating whether the module can be used
-  bool IsUsed();
+  bool IsUsed() const;
 
   ~Module();
 

src/auth/rpc.cpp

@@ -18,11 +18,9 @@
 #include "utils/enum.hpp"
 
 namespace memgraph::slk {
-
 // Serialize code for auth::Role
-void Save(const auth::Role &self, memgraph::slk::Builder *builder) {
-  memgraph::slk::Save(self.Serialize().dump(), builder);
-}
+void Save(const auth::Role &self, Builder *builder) { memgraph::slk::Save(self.Serialize().dump(), builder); }
+
 namespace {
 auth::Role LoadAuthRole(memgraph::slk::Reader *reader) {
   std::string tmp;

src/communication/result_stream_faker.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source

src/communication/websocket/auth.cpp

@@ -1,4 +1,4 @@
-// Copyright 2022 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -12,19 +12,44 @@
 #include "communication/websocket/auth.hpp"
 
 #include <string>
+#include "utils/variant_helpers.hpp"
 
 namespace memgraph::communication::websocket {
 
 bool SafeAuth::Authenticate(const std::string &username, const std::string &password) const {
-  return auth_->Lock()->Authenticate(username, password).has_value();
+  user_or_role_ = auth_->Lock()->Authenticate(username, password);
+  return user_or_role_.has_value();
 }
 
-bool SafeAuth::HasUserPermission(const std::string &username, const auth::Permission permission) const {
-  if (const auto user = auth_->ReadLock()->GetUser(username); user) {
-    return user->GetPermissions().Has(permission) == auth::PermissionLevel::GRANT;
+bool SafeAuth::HasPermission(const auth::Permission permission) const {
+  auto locked_auth = auth_->ReadLock();
+  // Update if cache invalidated
+  if (!locked_auth->UpToDate(auth_epoch_) && user_or_role_) {
+    bool success = true;
+    std::visit(utils::Overloaded{[&](auth::User &user) {
+                                   auto tmp = locked_auth->GetUser(user.username());
+                                   if (!tmp) success = false;
+                                   user = std::move(*tmp);
+                                 },
+                                 [&](auth::Role &role) {
+                                   auto tmp = locked_auth->GetRole(role.rolename());
+                                   if (!tmp) success = false;
+                                   role = std::move(*tmp);
+                                 }},
+               *user_or_role_);
+    // Missing user/role; delete from cache
+    if (!success) user_or_role_.reset();
   }
+  // Check permissions
+  if (user_or_role_) {
+    return std::visit(utils::Overloaded{[&](auto &user_or_role) {
+                        return user_or_role.GetPermissions().Has(permission) == auth::PermissionLevel::GRANT;
+                      }},
+                      *user_or_role_);
+  }
+  // NOTE: websocket authenticates only if there is a user, so no need to check if access controlled
   return false;
 }
 
-bool SafeAuth::HasAnyUsers() const { return auth_->ReadLock()->HasUsers(); }
+bool SafeAuth::AccessControlled() const { return auth_->ReadLock()->AccessControlled(); }
 }  // namespace memgraph::communication::websocket

src/communication/websocket/auth.hpp

@@ -21,9 +21,9 @@ class AuthenticationInterface {
  public:
   virtual bool Authenticate(const std::string &username, const std::string &password) const = 0;
 
-  virtual bool HasUserPermission(const std::string &username, auth::Permission permission) const = 0;
+  virtual bool HasPermission(auth::Permission permission) const = 0;
 
-  virtual bool HasAnyUsers() const = 0;
+  virtual bool AccessControlled() const = 0;
 };
 
 class SafeAuth : public AuthenticationInterface {
@@ -32,11 +32,13 @@ class SafeAuth : public AuthenticationInterface {
 
   bool Authenticate(const std::string &username, const std::string &password) const override;
 
-  bool HasUserPermission(const std::string &username, auth::Permission permission) const override;
+  bool HasPermission(auth::Permission permission) const override;
 
-  bool HasAnyUsers() const override;
+  bool AccessControlled() const override;
 
  private:
   auth::SynchedAuth *auth_;
+  mutable std::optional<auth::UserOrRole> user_or_role_;
+  mutable auth::Auth::Epoch auth_epoch_{};
 };
 }  // namespace memgraph::communication::websocket

src/communication/websocket/session.cpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -80,7 +80,7 @@ bool Session::Run() {
     return false;
   }
 
-  authenticated_ = !auth_.HasAnyUsers();
+  authenticated_ = !auth_.AccessControlled();
   connected_.store(true, std::memory_order_relaxed);
 
   // run on the strand
@@ -162,7 +162,7 @@ utils::BasicResult<std::string> Session::Authorize(const nlohmann::json &creds)
     return {"Authentication failed!"};
   }
 #ifdef MG_ENTERPRISE
-  if (!auth_.HasUserPermission(creds.at("username").get<std::string>(), auth::Permission::WEBSOCKET)) {
+  if (!auth_.HasPermission(auth::Permission::WEBSOCKET)) {
     return {"Authorization failed!"};
   }
 #endif

src/coordination/CMakeLists.txt

@@ -16,11 +16,14 @@ target_sources(mg-coordination
         include/coordination/raft_state.hpp
         include/coordination/rpc_errors.hpp
 
+        include/nuraft/raft_log_action.hpp
+        include/nuraft/coordinator_cluster_state.hpp
         include/nuraft/coordinator_log_store.hpp
         include/nuraft/coordinator_state_machine.hpp
         include/nuraft/coordinator_state_manager.hpp
 
         PRIVATE
+        coordinator_config.cpp
         coordinator_client.cpp
         coordinator_state.cpp
         coordinator_rpc.cpp
@@ -33,6 +36,7 @@ target_sources(mg-coordination
         coordinator_log_store.cpp
         coordinator_state_machine.cpp
         coordinator_state_manager.cpp
+        coordinator_cluster_state.cpp
 )
 target_include_directories(mg-coordination PUBLIC include)
 

src/coordination/coordinator_client.cpp

@@ -16,6 +16,7 @@
 
 #include "coordination/coordinator_config.hpp"
 #include "coordination/coordinator_rpc.hpp"
+#include "replication_coordination_glue/common.hpp"
 #include "replication_coordination_glue/messages.hpp"
 #include "utils/result.hpp"
 
@@ -30,7 +31,7 @@ auto CreateClientContext(memgraph::coordination::CoordinatorClientConfig const &
 }  // namespace
 
 CoordinatorClient::CoordinatorClient(CoordinatorInstance *coord_instance, CoordinatorClientConfig config,
-                                     HealthCheckCallback succ_cb, HealthCheckCallback fail_cb)
+                                     HealthCheckClientCallback succ_cb, HealthCheckClientCallback fail_cb)
     : rpc_context_{CreateClientContext(config)},
       rpc_client_{io::network::Endpoint(io::network::Endpoint::needs_resolving, config.ip_address, config.port),
                   &rpc_context_},
@@ -40,7 +41,9 @@ CoordinatorClient::CoordinatorClient(CoordinatorInstance *coord_instance, Coordi
       fail_cb_{std::move(fail_cb)} {}
 
 auto CoordinatorClient::InstanceName() const -> std::string { return config_.instance_name; }
-auto CoordinatorClient::SocketAddress() const -> std::string { return rpc_client_.Endpoint().SocketAddress(); }
+
+auto CoordinatorClient::CoordinatorSocketAddress() const -> std::string { return config_.CoordinatorSocketAddress(); }
+auto CoordinatorClient::ReplicationSocketAddress() const -> std::string { return config_.ReplicationSocketAddress(); }
 
 auto CoordinatorClient::InstanceDownTimeoutSec() const -> std::chrono::seconds {
   return config_.instance_down_timeout_sec;
@@ -63,11 +66,15 @@ void CoordinatorClient::StartFrequentCheck() {
       [this, instance_name = config_.instance_name] {
         try {
           spdlog::trace("Sending frequent heartbeat to machine {} on {}", instance_name,
-                        rpc_client_.Endpoint().SocketAddress());
+                        config_.CoordinatorSocketAddress());
           {  // NOTE: This is intentionally scoped so that stream lock could get released.
             auto stream{rpc_client_.Stream<memgraph::replication_coordination_glue::FrequentHeartbeatRpc>()};
             stream.AwaitResponse();
           }
+          // Subtle race condition:
+          // acquiring of lock needs to happen before function call, as function callback can be changed
+          // for instance after lock is already acquired
+          // (failover case when instance is promoted to MAIN)
           succ_cb_(coord_instance_, instance_name);
         } catch (rpc::RpcFailedException const &) {
           fail_cb_(coord_instance_, instance_name);
@@ -79,11 +86,6 @@ void CoordinatorClient::StopFrequentCheck() { instance_checker_.Stop(); }
 void CoordinatorClient::PauseFrequentCheck() { instance_checker_.Pause(); }
 void CoordinatorClient::ResumeFrequentCheck() { instance_checker_.Resume(); }
 
-auto CoordinatorClient::SetCallbacks(HealthCheckCallback succ_cb, HealthCheckCallback fail_cb) -> void {
-  succ_cb_ = std::move(succ_cb);
-  fail_cb_ = std::move(fail_cb);
-}
-
 auto CoordinatorClient::ReplicationClientInfo() const -> ReplClientInfo { return config_.replication_client_info; }
 
 auto CoordinatorClient::SendPromoteReplicaToMainRpc(const utils::UUID &uuid,
@@ -117,7 +119,7 @@ auto CoordinatorClient::DemoteToReplica() const -> bool {
   return false;
 }
 
-auto CoordinatorClient::SendSwapMainUUIDRpc(const utils::UUID &uuid) const -> bool {
+auto CoordinatorClient::SendSwapMainUUIDRpc(utils::UUID const &uuid) const -> bool {
   try {
     auto stream{rpc_client_.Stream<replication_coordination_glue::SwapMainUUIDRpc>(uuid)};
     if (!stream.AwaitResponse().success) {
@@ -131,7 +133,7 @@ auto CoordinatorClient::SendSwapMainUUIDRpc(const utils::UUID &uuid) const -> bo
   return false;
 }
 
-auto CoordinatorClient::SendUnregisterReplicaRpc(std::string const &instance_name) const -> bool {
+auto CoordinatorClient::SendUnregisterReplicaRpc(std::string_view instance_name) const -> bool {
   try {
     auto stream{rpc_client_.Stream<UnregisterReplicaRpc>(instance_name)};
     if (!stream.AwaitResponse().success) {
@@ -171,5 +173,17 @@ auto CoordinatorClient::SendEnableWritingOnMainRpc() const -> bool {
   return false;
 }
 
+auto CoordinatorClient::SendGetInstanceTimestampsRpc() const
+    -> utils::BasicResult<GetInstanceUUIDError, replication_coordination_glue::DatabaseHistories> {
+  try {
+    auto stream{rpc_client_.Stream<coordination::GetDatabaseHistoriesRpc>()};
+    return stream.AwaitResponse().database_histories;
+
+  } catch (const rpc::RpcFailedException &) {
+    spdlog::error("RPC error occured while sending GetInstance UUID RPC");
+    return GetInstanceUUIDError::RPC_EXCEPTION;
+  }
+}
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/coordinator_cluster_state.cpp

@@ -0,0 +1,147 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "nuraft/coordinator_cluster_state.hpp"
+#include "utils/logging.hpp"
+
+#include <shared_mutex>
+
+namespace memgraph::coordination {
+
+void to_json(nlohmann::json &j, InstanceState const &instance_state) {
+  j = nlohmann::json{{"config", instance_state.config}, {"status", instance_state.status}};
+}
+
+void from_json(nlohmann::json const &j, InstanceState &instance_state) {
+  j.at("config").get_to(instance_state.config);
+  j.at("status").get_to(instance_state.status);
+}
+
+CoordinatorClusterState::CoordinatorClusterState(std::map<std::string, InstanceState, std::less<>> instances)
+    : instances_{std::move(instances)} {}
+
+CoordinatorClusterState::CoordinatorClusterState(CoordinatorClusterState const &other) : instances_{other.instances_} {}
+
+CoordinatorClusterState &CoordinatorClusterState::operator=(CoordinatorClusterState const &other) {
+  if (this == &other) {
+    return *this;
+  }
+  instances_ = other.instances_;
+  return *this;
+}
+
+CoordinatorClusterState::CoordinatorClusterState(CoordinatorClusterState &&other) noexcept
+    : instances_{std::move(other.instances_)} {}
+
+CoordinatorClusterState &CoordinatorClusterState::operator=(CoordinatorClusterState &&other) noexcept {
+  if (this == &other) {
+    return *this;
+  }
+  instances_ = std::move(other.instances_);
+  return *this;
+}
+
+auto CoordinatorClusterState::MainExists() const -> bool {
+  auto lock = std::shared_lock{log_lock_};
+  return std::ranges::any_of(instances_,
+                             [](auto const &entry) { return entry.second.status == ReplicationRole::MAIN; });
+}
+
+auto CoordinatorClusterState::IsMain(std::string_view instance_name) const -> bool {
+  auto lock = std::shared_lock{log_lock_};
+  auto const it = instances_.find(instance_name);
+  return it != instances_.end() && it->second.status == ReplicationRole::MAIN;
+}
+
+auto CoordinatorClusterState::IsReplica(std::string_view instance_name) const -> bool {
+  auto lock = std::shared_lock{log_lock_};
+  auto const it = instances_.find(instance_name);
+  return it != instances_.end() && it->second.status == ReplicationRole::REPLICA;
+}
+
+auto CoordinatorClusterState::InsertInstance(std::string instance_name, InstanceState instance_state) -> void {
+  auto lock = std::lock_guard{log_lock_};
+  instances_.insert_or_assign(std::move(instance_name), std::move(instance_state));
+}
+
+auto CoordinatorClusterState::DoAction(TRaftLog log_entry, RaftLogAction log_action) -> void {
+  auto lock = std::lock_guard{log_lock_};
+  switch (log_action) {
+    case RaftLogAction::REGISTER_REPLICATION_INSTANCE: {
+      auto const &config = std::get<CoordinatorClientConfig>(log_entry);
+      instances_[config.instance_name] = InstanceState{config, ReplicationRole::REPLICA};
+      break;
+    }
+    case RaftLogAction::UNREGISTER_REPLICATION_INSTANCE: {
+      auto const instance_name = std::get<std::string>(log_entry);
+      instances_.erase(instance_name);
+      break;
+    }
+    case RaftLogAction::SET_INSTANCE_AS_MAIN: {
+      auto const instance_name = std::get<std::string>(log_entry);
+      auto it = instances_.find(instance_name);
+      MG_ASSERT(it != instances_.end(), "Instance does not exist as part of raft state!");
+      it->second.status = ReplicationRole::MAIN;
+      break;
+    }
+    case RaftLogAction::SET_INSTANCE_AS_REPLICA: {
+      auto const instance_name = std::get<std::string>(log_entry);
+      auto it = instances_.find(instance_name);
+      MG_ASSERT(it != instances_.end(), "Instance does not exist as part of raft state!");
+      it->second.status = ReplicationRole::REPLICA;
+      break;
+    }
+    case RaftLogAction::UPDATE_UUID: {
+      uuid_ = std::get<utils::UUID>(log_entry);
+      break;
+    }
+  }
+}
+
+auto CoordinatorClusterState::Serialize(ptr<buffer> &data) -> void {
+  auto lock = std::shared_lock{log_lock_};
+
+  auto const log = nlohmann::json(instances_).dump();
+
+  data = buffer::alloc(sizeof(uint32_t) + log.size());
+  buffer_serializer bs(data);
+  bs.put_str(log);
+}
+
+auto CoordinatorClusterState::Deserialize(buffer &data) -> CoordinatorClusterState {
+  buffer_serializer bs(data);
+  auto const j = nlohmann::json::parse(bs.get_str());
+  auto instances = j.get<std::map<std::string, InstanceState, std::less<>>>();
+
+  return CoordinatorClusterState{std::move(instances)};
+}
+
+auto CoordinatorClusterState::GetInstances() const -> std::vector<InstanceState> {
+  auto lock = std::shared_lock{log_lock_};
+  return instances_ | ranges::views::values | ranges::to<std::vector<InstanceState>>;
+}
+
+auto CoordinatorClusterState::GetUUID() const -> utils::UUID { return uuid_; }
+
+auto CoordinatorClusterState::FindCurrentMainInstanceName() const -> std::optional<std::string> {
+  auto lock = std::shared_lock{log_lock_};
+  auto const it =
+      std::ranges::find_if(instances_, [](auto const &entry) { return entry.second.status == ReplicationRole::MAIN; });
+  if (it == instances_.end()) {
+    return {};
+  }
+  return it->first;
+}
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/coordinator_config.cpp

@@ -0,0 +1,54 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_config.hpp"
+
+namespace memgraph::coordination {
+
+void to_json(nlohmann::json &j, ReplClientInfo const &config) {
+  j = nlohmann::json{{"instance_name", config.instance_name},
+                     {"replication_mode", config.replication_mode},
+                     {"replication_ip_address", config.replication_ip_address},
+                     {"replication_port", config.replication_port}};
+}
+
+void from_json(nlohmann::json const &j, ReplClientInfo &config) {
+  config.instance_name = j.at("instance_name").get<std::string>();
+  config.replication_mode = j.at("replication_mode").get<replication_coordination_glue::ReplicationMode>();
+  config.replication_ip_address = j.at("replication_ip_address").get<std::string>();
+  config.replication_port = j.at("replication_port").get<uint16_t>();
+}
+
+void to_json(nlohmann::json &j, CoordinatorClientConfig const &config) {
+  j = nlohmann::json{{"instance_name", config.instance_name},
+                     {"ip_address", config.ip_address},
+                     {"port", config.port},
+                     {"instance_health_check_frequency_sec", config.instance_health_check_frequency_sec.count()},
+                     {"instance_down_timeout_sec", config.instance_down_timeout_sec.count()},
+                     {"instance_get_uuid_frequency_sec", config.instance_get_uuid_frequency_sec.count()},
+                     {"replication_client_info", config.replication_client_info}};
+}
+
+void from_json(nlohmann::json const &j, CoordinatorClientConfig &config) {
+  config.instance_name = j.at("instance_name").get<std::string>();
+  config.ip_address = j.at("ip_address").get<std::string>();
+  config.port = j.at("port").get<uint16_t>();
+  config.instance_health_check_frequency_sec =
+      std::chrono::seconds{j.at("instance_health_check_frequency_sec").get<int>()};
+  config.instance_down_timeout_sec = std::chrono::seconds{j.at("instance_down_timeout_sec").get<int>()};
+  config.instance_get_uuid_frequency_sec = std::chrono::seconds{j.at("instance_get_uuid_frequency_sec").get<int>()};
+  config.replication_client_info = j.at("replication_client_info").get<ReplClientInfo>();
+}
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/coordinator_handlers.cpp

@@ -57,6 +57,17 @@ void CoordinatorHandlers::Register(memgraph::coordination::CoordinatorServer &se
         spdlog::info("Received GetInstanceUUIDRpc on coordinator server");
         CoordinatorHandlers::GetInstanceUUIDHandler(replication_handler, req_reader, res_builder);
       });
+
+  server.Register<coordination::GetDatabaseHistoriesRpc>(
+      [&replication_handler](slk::Reader *req_reader, slk::Builder *res_builder) -> void {
+        spdlog::info("Received GetDatabasesHistoryRpc on coordinator server");
+        CoordinatorHandlers::GetDatabaseHistoriesHandler(replication_handler, req_reader, res_builder);
+      });
+}
+
+void CoordinatorHandlers::GetDatabaseHistoriesHandler(replication::ReplicationHandler &replication_handler,
+                                                      slk::Reader * /*req_reader*/, slk::Builder *res_builder) {
+  slk::Save(coordination::GetDatabaseHistoriesRes{replication_handler.GetDatabasesHistories()}, res_builder);
 }
 
 void CoordinatorHandlers::SwapMainUUIDHandler(replication::ReplicationHandler &replication_handler,

src/coordination/coordinator_instance.cpp

@@ -15,10 +15,12 @@
 
 #include "coordination/coordinator_exceptions.hpp"
 #include "coordination/fmt.hpp"
+#include "dbms/constants.hpp"
 #include "nuraft/coordinator_state_machine.hpp"
 #include "nuraft/coordinator_state_manager.hpp"
 #include "utils/counter.hpp"
 #include "utils/functional.hpp"
+#include "utils/resource_lock.hpp"
 
 #include <range/v3/view.hpp>
 #include <shared_mutex>
@@ -30,144 +32,162 @@ using nuraft::srv_config;
 
 CoordinatorInstance::CoordinatorInstance()
     : raft_state_(RaftState::MakeRaftState(
-          [this] { std::ranges::for_each(repl_instances_, &ReplicationInstance::StartFrequentCheck); },
-          [this] { std::ranges::for_each(repl_instances_, &ReplicationInstance::StopFrequentCheck); })) {
-  auto find_repl_instance = [](CoordinatorInstance *self,
-                               std::string_view repl_instance_name) -> ReplicationInstance & {
-    auto repl_instance =
-        std::ranges::find_if(self->repl_instances_, [repl_instance_name](ReplicationInstance const &instance) {
-          return instance.InstanceName() == repl_instance_name;
-        });
+          [this]() {
+            spdlog::info("Leader changed, starting all replication instances!");
+            auto const instances = raft_state_.GetInstances();
+            auto replicas = instances | ranges::views::filter([](auto const &instance) {
+                              return instance.status == ReplicationRole::REPLICA;
+                            });
 
-    MG_ASSERT(repl_instance != self->repl_instances_.end(), "Instance {} not found during callback!",
-              repl_instance_name);
-    return *repl_instance;
+            std::ranges::for_each(replicas, [this](auto &replica) {
+              spdlog::info("Started pinging replication instance {}", replica.config.instance_name);
+              repl_instances_.emplace_back(this, replica.config, client_succ_cb_, client_fail_cb_,
+                                           &CoordinatorInstance::ReplicaSuccessCallback,
+                                           &CoordinatorInstance::ReplicaFailCallback);
+            });
+
+            // TODO(antoniofilipovic): is this correct or we have a bug
+            // Multiple main instances, each will do failover
+            auto main = instances | ranges::views::filter(
+                                        [](auto const &instance) { return instance.status == ReplicationRole::MAIN; });
+
+            std::ranges::for_each(main, [this](auto &main_instance) {
+              spdlog::info("Started pinging main instance {}", main_instance.config.instance_name);
+              repl_instances_.emplace_back(this, main_instance.config, client_succ_cb_, client_fail_cb_,
+                                           &CoordinatorInstance::MainSuccessCallback,
+                                           &CoordinatorInstance::MainFailCallback);
+            });
+
+            std::ranges::for_each(repl_instances_, [this](auto &instance) {
+              instance.SetNewMainUUID(raft_state_.GetUUID());
+              instance.StartFrequentCheck();
+            });
+          },
+          [this]() {
+            // TODO (antoniofilipovic) We can enter here without lock and remove all instances
+            spdlog::info("Leader changed, stopping all replication instances!");
+            // we should probably change this to defunct state
+            repl_instances_.clear();
+          })) {
+  client_succ_cb_ = [](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+    auto lock = std::lock_guard{self->coord_instance_lock_};
+    auto &repl_instance = self->FindReplicationInstance(repl_instance_name);
+    std::invoke(repl_instance.GetSuccessCallback(), self, repl_instance_name);
   };
 
-  replica_succ_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
+  client_fail_cb_ = [](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
     auto lock = std::lock_guard{self->coord_instance_lock_};
-    spdlog::trace("Instance {} performing replica successful callback", repl_instance_name);
-    auto &repl_instance = find_repl_instance(self, repl_instance_name);
-
-    // We need to get replicas UUID from time to time to ensure replica is listening to correct main
-    // and that it didn't go down for less time than we could notice
-    // We need to get id of main replica is listening to
-    // and swap if necessary
-    if (!repl_instance.EnsureReplicaHasCorrectMainUUID(self->GetMainUUID())) {
-      spdlog::error("Failed to swap uuid for replica instance {} which is alive", repl_instance.InstanceName());
-      return;
-    }
-
-    repl_instance.OnSuccessPing();
-  };
-
-  replica_fail_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
-    auto lock = std::lock_guard{self->coord_instance_lock_};
-    spdlog::trace("Instance {} performing replica failure callback", repl_instance_name);
-    auto &repl_instance = find_repl_instance(self, repl_instance_name);
-    repl_instance.OnFailPing();
-  };
-
-  main_succ_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
-    auto lock = std::lock_guard{self->coord_instance_lock_};
-    spdlog::trace("Instance {} performing main successful callback", repl_instance_name);
-
-    auto &repl_instance = find_repl_instance(self, repl_instance_name);
-
-    if (repl_instance.IsAlive()) {
-      repl_instance.OnSuccessPing();
-      return;
-    }
-
-    const auto &repl_instance_uuid = repl_instance.GetMainUUID();
-    MG_ASSERT(repl_instance_uuid.has_value(), "Instance must have uuid set.");
-
-    auto const curr_main_uuid = self->GetMainUUID();
-    if (curr_main_uuid == repl_instance_uuid.value()) {
-      if (!repl_instance.EnableWritingOnMain()) {
-        spdlog::error("Failed to enable writing on main instance {}", repl_instance_name);
-        return;
-      }
-
-      repl_instance.OnSuccessPing();
-      return;
-    }
-
-    // TODO(antoniof) make demoteToReplica idempotent since main can be demoted to replica but
-    // swapUUID can fail
-    if (repl_instance.DemoteToReplica(self->replica_succ_cb_, self->replica_fail_cb_)) {
-      repl_instance.OnSuccessPing();
-      spdlog::info("Instance {} demoted to replica", repl_instance_name);
-    } else {
-      spdlog::error("Instance {} failed to become replica", repl_instance_name);
-      return;
-    }
-
-    if (!repl_instance.SendSwapAndUpdateUUID(curr_main_uuid)) {
-      spdlog::error(fmt::format("Failed to swap uuid for demoted main instance {}", repl_instance.InstanceName()));
-      return;
-    }
-  };
-
-  main_fail_cb_ = [find_repl_instance](CoordinatorInstance *self, std::string_view repl_instance_name) -> void {
-    auto lock = std::lock_guard{self->coord_instance_lock_};
-    spdlog::trace("Instance {} performing main failure callback", repl_instance_name);
-    auto &repl_instance = find_repl_instance(self, repl_instance_name);
-    repl_instance.OnFailPing();
-    const auto &repl_instance_uuid = repl_instance.GetMainUUID();
-    MG_ASSERT(repl_instance_uuid.has_value(), "Instance must have uuid set");
-
-    if (!repl_instance.IsAlive() && self->GetMainUUID() == repl_instance_uuid.value()) {
-      spdlog::info("Cluster without main instance, trying automatic failover");
-      self->TryFailover();  // TODO: (andi) Initiate failover
-    }
+    auto &repl_instance = self->FindReplicationInstance(repl_instance_name);
+    std::invoke(repl_instance.GetFailCallback(), self, repl_instance_name);
   };
 }
 
+auto CoordinatorInstance::FindReplicationInstance(std::string_view replication_instance_name) -> ReplicationInstance & {
+  auto repl_instance =
+      std::ranges::find_if(repl_instances_, [replication_instance_name](ReplicationInstance const &instance) {
+        return instance.InstanceName() == replication_instance_name;
+      });
+
+  MG_ASSERT(repl_instance != repl_instances_.end(), "Instance {} not found during callback!",
+            replication_instance_name);
+  return *repl_instance;
+}
+
 auto CoordinatorInstance::ShowInstances() const -> std::vector<InstanceStatus> {
-  auto const coord_instances = raft_state_.GetAllCoordinators();
-
-  auto const stringify_repl_role = [](ReplicationInstance const &instance) -> std::string {
-    if (!instance.IsAlive()) return "unknown";
-    if (instance.IsMain()) return "main";
-    return "replica";
-  };
-
-  auto const repl_instance_to_status = [&stringify_repl_role](ReplicationInstance const &instance) -> InstanceStatus {
-    return {.instance_name = instance.InstanceName(),
-            .coord_socket_address = instance.SocketAddress(),
-            .cluster_role = stringify_repl_role(instance),
-            .is_alive = instance.IsAlive()};
-  };
-
   auto const coord_instance_to_status = [](ptr<srv_config> const &instance) -> InstanceStatus {
     return {.instance_name = "coordinator_" + std::to_string(instance->get_id()),
             .raft_socket_address = instance->get_endpoint(),
             .cluster_role = "coordinator",
-            .is_alive = true};  // TODO: (andi) Get this info from RAFT and test it or when we will move
-                                // CoordinatorState to every instance, we can be smarter about this using our RPC.
+            .health = "unknown"};  // TODO: (andi) Get this info from RAFT and test it or when we will move
   };
+  auto instances_status = utils::fmap(raft_state_.GetAllCoordinators(), coord_instance_to_status);
 
-  auto instances_status = utils::fmap(coord_instance_to_status, coord_instances);
-  {
-    auto lock = std::shared_lock{coord_instance_lock_};
-    std::ranges::transform(repl_instances_, std::back_inserter(instances_status), repl_instance_to_status);
+  if (raft_state_.IsLeader()) {
+    auto const stringify_repl_role = [this](ReplicationInstance const &instance) -> std::string {
+      if (!instance.IsAlive()) return "unknown";
+      if (raft_state_.IsMain(instance.InstanceName())) return "main";
+      return "replica";
+    };
+
+    auto const stringify_repl_health = [](ReplicationInstance const &instance) -> std::string {
+      return instance.IsAlive() ? "up" : "down";
+    };
+
+    auto process_repl_instance_as_leader =
+        [&stringify_repl_role, &stringify_repl_health](ReplicationInstance const &instance) -> InstanceStatus {
+      return {.instance_name = instance.InstanceName(),
+              .coord_socket_address = instance.CoordinatorSocketAddress(),
+              .cluster_role = stringify_repl_role(instance),
+              .health = stringify_repl_health(instance)};
+    };
+
+    {
+      auto lock = std::shared_lock{coord_instance_lock_};
+      std::ranges::transform(repl_instances_, std::back_inserter(instances_status), process_repl_instance_as_leader);
+    }
+  } else {
+    auto const stringify_inst_status = [this](const ReplicationInstance &instance) -> std::string {
+      if (!instance.IsAlive()) return "unknown";
+      if (raft_state_.IsMain(instance.InstanceName())) return "main";
+      return "replica";
+    };
+
+    // TODO: (andi) Add capability that followers can also return socket addresses
+    auto process_repl_instance_as_follower =
+        [&stringify_inst_status](const ReplicationInstance &instance) -> InstanceStatus {
+      return {.instance_name = instance.InstanceName(),
+              .cluster_role = stringify_inst_status(instance),
+              .health = "unknown"};
+    };
+
+    std::ranges::transform(repl_instances_, std::back_inserter(instances_status), process_repl_instance_as_follower);
   }
 
   return instances_status;
 }
 
 auto CoordinatorInstance::TryFailover() -> void {
-  auto alive_replicas = repl_instances_ | ranges::views::filter(&ReplicationInstance::IsReplica) |
-                        ranges::views::filter(&ReplicationInstance::IsAlive);
+  auto const is_replica = [this](ReplicationInstance const &instance) { return IsReplica(instance.InstanceName()); };
+
+  auto alive_replicas =
+      repl_instances_ | ranges::views::filter(is_replica) | ranges::views::filter(&ReplicationInstance::IsAlive);
 
   if (ranges::empty(alive_replicas)) {
     spdlog::warn("Failover failed since all replicas are down!");
     return;
   }
 
-  // TODO: Smarter choice
-  auto new_main = ranges::begin(alive_replicas);
+  if (!raft_state_.RequestLeadership()) {
+    spdlog::error("Failover failed since the instance is not the leader!");
+    return;
+  }
+
+  auto const get_ts = [](ReplicationInstance &replica) { return replica.GetClient().SendGetInstanceTimestampsRpc(); };
+
+  auto maybe_instance_db_histories = alive_replicas | ranges::views::transform(get_ts) | ranges::to<std::vector>();
+
+  auto const ts_has_error = [](auto const &res) -> bool { return res.HasError(); };
+
+  if (std::ranges::any_of(maybe_instance_db_histories, ts_has_error)) {
+    spdlog::error("Aborting failover as at least one instance didn't provide per database history.");
+    return;
+  }
+
+  auto transform_to_pairs = ranges::views::transform([](auto const &zipped) {
+    auto &[replica, res] = zipped;
+    return std::make_pair(replica.InstanceName(), res.GetValue());
+  });
+
+  auto instance_db_histories =
+      ranges::views::zip(alive_replicas, maybe_instance_db_histories) | transform_to_pairs | ranges::to<std::vector>();
+
+  auto [most_up_to_date_instance, latest_epoch, latest_commit_timestamp] =
+      ChooseMostUpToDateInstance(instance_db_histories);
+
+  spdlog::trace("The most up to date instance is {} with epoch {} and {} latest commit timestamp",
+                most_up_to_date_instance, latest_epoch, latest_commit_timestamp);  // NOLINT
+
+  auto *new_main = &FindReplicationInstance(most_up_to_date_instance);
 
   new_main->PauseFrequentCheck();
   utils::OnScopeExit scope_exit{[&new_main] { new_main->ResumeFrequentCheck(); }};
@@ -177,41 +197,56 @@ auto CoordinatorInstance::TryFailover() -> void {
   };
 
   auto const new_main_uuid = utils::UUID{};
+
+  auto const failed_to_swap = [&new_main_uuid](ReplicationInstance &instance) {
+    return !instance.SendSwapAndUpdateUUID(new_main_uuid);
+  };
+
   // If for some replicas swap fails, for others on successful ping we will revert back on next change
   // or we will do failover first again and then it will be consistent again
-  for (auto &other_replica_instance : alive_replicas | ranges::views::filter(is_not_new_main)) {
-    if (!other_replica_instance.SendSwapAndUpdateUUID(new_main_uuid)) {
-      spdlog::error(fmt::format("Failed to swap uuid for instance {} which is alive, aborting failover",
-                                other_replica_instance.InstanceName()));
-      return;
-    }
+  if (std::ranges::any_of(alive_replicas | ranges::views::filter(is_not_new_main), failed_to_swap)) {
+    spdlog::error("Failed to swap uuid for all instances");
+    return;
   }
-
   auto repl_clients_info = repl_instances_ | ranges::views::filter(is_not_new_main) |
                            ranges::views::transform(&ReplicationInstance::ReplicationClientInfo) |
                            ranges::to<ReplicationClientsInfo>();
 
-  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), main_succ_cb_, main_fail_cb_)) {
+  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), &CoordinatorInstance::MainSuccessCallback,
+                               &CoordinatorInstance::MainFailCallback)) {
     spdlog::warn("Failover failed since promoting replica to main failed!");
     return;
   }
-  // TODO: (andi) This should be replicated across all coordinator instances with Raft log
-  SetMainUUID(new_main_uuid);
+
+  if (!raft_state_.AppendUpdateUUIDLog(new_main_uuid)) {
+    return;
+  }
+
+  auto const new_main_instance_name = new_main->InstanceName();
+
+  if (!raft_state_.AppendSetInstanceAsMainLog(new_main_instance_name)) {
+    return;
+  }
+
   spdlog::info("Failover successful! Instance {} promoted to main.", new_main->InstanceName());
 }
 
-// TODO: (andi) Make sure you cannot put coordinator instance to the main
-auto CoordinatorInstance::SetReplicationInstanceToMain(std::string instance_name)
+auto CoordinatorInstance::SetReplicationInstanceToMain(std::string_view instance_name)
     -> SetInstanceToMainCoordinatorStatus {
   auto lock = std::lock_guard{coord_instance_lock_};
 
-  if (std::ranges::any_of(repl_instances_, &ReplicationInstance::IsMain)) {
+  if (raft_state_.MainExists()) {
     return SetInstanceToMainCoordinatorStatus::MAIN_ALREADY_EXISTS;
   }
 
+  if (!raft_state_.RequestLeadership()) {
+    return SetInstanceToMainCoordinatorStatus::NOT_LEADER;
+  }
+
   auto const is_new_main = [&instance_name](ReplicationInstance const &instance) {
     return instance.InstanceName() == instance_name;
   };
+
   auto new_main = std::ranges::find_if(repl_instances_, is_new_main);
 
   if (new_main == repl_instances_.end()) {
@@ -229,85 +264,93 @@ auto CoordinatorInstance::SetReplicationInstanceToMain(std::string instance_name
 
   auto const new_main_uuid = utils::UUID{};
 
-  for (auto &other_instance : repl_instances_ | ranges::views::filter(is_not_new_main)) {
-    if (!other_instance.SendSwapAndUpdateUUID(new_main_uuid)) {
-      spdlog::error(
-          fmt::format("Failed to swap uuid for instance {}, aborting failover", other_instance.InstanceName()));
-      return SetInstanceToMainCoordinatorStatus::SWAP_UUID_FAILED;
-    }
+  auto const failed_to_swap = [&new_main_uuid](ReplicationInstance &instance) {
+    return !instance.SendSwapAndUpdateUUID(new_main_uuid);
+  };
+
+  if (std::ranges::any_of(repl_instances_ | ranges::views::filter(is_not_new_main), failed_to_swap)) {
+    spdlog::error("Failed to swap uuid for all instances");
+    return SetInstanceToMainCoordinatorStatus::SWAP_UUID_FAILED;
   }
 
-  ReplicationClientsInfo repl_clients_info;
-  repl_clients_info.reserve(repl_instances_.size() - 1);
-  std::ranges::transform(repl_instances_ | ranges::views::filter(is_not_new_main),
-                         std::back_inserter(repl_clients_info), &ReplicationInstance::ReplicationClientInfo);
+  auto repl_clients_info = repl_instances_ | ranges::views::filter(is_not_new_main) |
+                           ranges::views::transform(&ReplicationInstance::ReplicationClientInfo) |
+                           ranges::to<ReplicationClientsInfo>();
 
-  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), main_succ_cb_, main_fail_cb_)) {
+  if (!new_main->PromoteToMain(new_main_uuid, std::move(repl_clients_info), &CoordinatorInstance::MainSuccessCallback,
+                               &CoordinatorInstance::MainFailCallback)) {
     return SetInstanceToMainCoordinatorStatus::COULD_NOT_PROMOTE_TO_MAIN;
   }
 
-  // TODO: (andi) This should be replicated across all coordinator instances with Raft log
-  SetMainUUID(new_main_uuid);
-  spdlog::info("Instance {} promoted to main", instance_name);
+  if (!raft_state_.AppendUpdateUUIDLog(new_main_uuid)) {
+    return SetInstanceToMainCoordinatorStatus::RAFT_LOG_ERROR;
+  }
+
+  if (!raft_state_.AppendSetInstanceAsMainLog(instance_name)) {
+    return SetInstanceToMainCoordinatorStatus::RAFT_LOG_ERROR;
+  }
+
+  spdlog::info("Instance {} promoted to main on leader", instance_name);
   return SetInstanceToMainCoordinatorStatus::SUCCESS;
 }
 
-auto CoordinatorInstance::RegisterReplicationInstance(CoordinatorClientConfig config)
+auto CoordinatorInstance::RegisterReplicationInstance(CoordinatorClientConfig const &config)
     -> RegisterInstanceCoordinatorStatus {
   auto lock = std::lock_guard{coord_instance_lock_};
 
-  auto instance_name = config.instance_name;
-
-  auto const name_matches = [&instance_name](ReplicationInstance const &instance) {
-    return instance.InstanceName() == instance_name;
-  };
-
-  if (std::ranges::any_of(repl_instances_, name_matches)) {
+  if (std::ranges::any_of(repl_instances_, [instance_name = config.instance_name](ReplicationInstance const &instance) {
+        return instance.InstanceName() == instance_name;
+      })) {
     return RegisterInstanceCoordinatorStatus::NAME_EXISTS;
   }
 
-  auto const socket_address_matches = [&config](ReplicationInstance const &instance) {
-    return instance.SocketAddress() == config.SocketAddress();
-  };
+  if (std::ranges::any_of(repl_instances_, [&config](ReplicationInstance const &instance) {
+        return instance.CoordinatorSocketAddress() == config.CoordinatorSocketAddress();
+      })) {
+    return RegisterInstanceCoordinatorStatus::COORD_ENDPOINT_EXISTS;
+  }
 
-  if (std::ranges::any_of(repl_instances_, socket_address_matches)) {
-    return RegisterInstanceCoordinatorStatus::ENDPOINT_EXISTS;
+  if (std::ranges::any_of(repl_instances_, [&config](ReplicationInstance const &instance) {
+        return instance.ReplicationSocketAddress() == config.ReplicationSocketAddress();
+      })) {
+    return RegisterInstanceCoordinatorStatus::REPL_ENDPOINT_EXISTS;
   }
 
   if (!raft_state_.RequestLeadership()) {
     return RegisterInstanceCoordinatorStatus::NOT_LEADER;
   }
 
-  auto const res = raft_state_.AppendRegisterReplicationInstance(instance_name);
-  if (!res->get_accepted()) {
-    spdlog::error(
-        "Failed to accept request for registering instance {}. Most likely the reason is that the instance is not "
-        "the "
-        "leader.",
-        config.instance_name);
-    return RegisterInstanceCoordinatorStatus::RAFT_COULD_NOT_ACCEPT;
-  }
+  auto const undo_action_ = [this]() { repl_instances_.pop_back(); };
 
-  spdlog::info("Request for registering instance {} accepted", instance_name);
-  try {
-    repl_instances_.emplace_back(this, std::move(config), replica_succ_cb_, replica_fail_cb_);
-  } catch (CoordinatorRegisterInstanceException const &) {
+  auto *new_instance = &repl_instances_.emplace_back(this, config, client_succ_cb_, client_fail_cb_,
+                                                     &CoordinatorInstance::ReplicaSuccessCallback,
+                                                     &CoordinatorInstance::ReplicaFailCallback);
+
+  if (!new_instance->SendDemoteToReplicaRpc()) {
+    spdlog::error("Failed to send demote to replica rpc for instance {}", config.instance_name);
+    undo_action_();
     return RegisterInstanceCoordinatorStatus::RPC_FAILED;
   }
 
-  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
-    spdlog::error("Failed to register instance {} with error code {}", instance_name, res->get_result_code());
-    return RegisterInstanceCoordinatorStatus::RAFT_COULD_NOT_APPEND;
+  if (!raft_state_.AppendRegisterReplicationInstanceLog(config)) {
+    undo_action_();
+    return RegisterInstanceCoordinatorStatus::RAFT_LOG_ERROR;
   }
 
-  spdlog::info("Instance {} registered", instance_name);
+  new_instance->StartFrequentCheck();
+
+  spdlog::info("Instance {} registered", config.instance_name);
   return RegisterInstanceCoordinatorStatus::SUCCESS;
 }
 
-auto CoordinatorInstance::UnregisterReplicationInstance(std::string instance_name)
+auto CoordinatorInstance::UnregisterReplicationInstance(std::string_view instance_name)
     -> UnregisterInstanceCoordinatorStatus {
   auto lock = std::lock_guard{coord_instance_lock_};
 
+  if (!raft_state_.RequestLeadership()) {
+    return UnregisterInstanceCoordinatorStatus::NOT_LEADER;
+  }
+
   auto const name_matches = [&instance_name](ReplicationInstance const &instance) {
     return instance.InstanceName() == instance_name;
   };
@@ -317,31 +360,208 @@ auto CoordinatorInstance::UnregisterReplicationInstance(std::string instance_nam
     return UnregisterInstanceCoordinatorStatus::NO_INSTANCE_WITH_NAME;
   }
 
-  if (inst_to_remove->IsMain() && inst_to_remove->IsAlive()) {
+  auto const is_main = [this](ReplicationInstance const &instance) {
+    return IsMain(instance.InstanceName()) && instance.GetMainUUID() == raft_state_.GetUUID() && instance.IsAlive();
+  };
+
+  if (is_main(*inst_to_remove)) {
     return UnregisterInstanceCoordinatorStatus::IS_MAIN;
   }
 
   inst_to_remove->StopFrequentCheck();
-  auto curr_main = std::ranges::find_if(repl_instances_, &ReplicationInstance::IsMain);
-  MG_ASSERT(curr_main != repl_instances_.end(), "There must be a main instance when unregistering a replica");
-  if (!curr_main->SendUnregisterReplicaRpc(instance_name)) {
-    inst_to_remove->StartFrequentCheck();
-    return UnregisterInstanceCoordinatorStatus::RPC_FAILED;
+
+  auto curr_main = std::ranges::find_if(repl_instances_, is_main);
+
+  if (curr_main != repl_instances_.end() && curr_main->IsAlive()) {
+    if (!curr_main->SendUnregisterReplicaRpc(instance_name)) {
+      inst_to_remove->StartFrequentCheck();
+      return UnregisterInstanceCoordinatorStatus::RPC_FAILED;
+    }
   }
+
   std::erase_if(repl_instances_, name_matches);
 
+  if (!raft_state_.AppendUnregisterReplicationInstanceLog(instance_name)) {
+    return UnregisterInstanceCoordinatorStatus::RAFT_LOG_ERROR;
+  }
+
   return UnregisterInstanceCoordinatorStatus::SUCCESS;
 }
 
-auto CoordinatorInstance::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
-    -> void {
-  raft_state_.AddCoordinatorInstance(raft_server_id, raft_port, std::move(raft_address));
+auto CoordinatorInstance::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port,
+                                                 std::string_view raft_address) -> void {
+  raft_state_.AddCoordinatorInstance(raft_server_id, raft_port, raft_address);
 }
 
-auto CoordinatorInstance::GetMainUUID() const -> utils::UUID { return main_uuid_; }
+void CoordinatorInstance::MainFailCallback(std::string_view repl_instance_name) {
+  spdlog::trace("Instance {} performing main fail callback", repl_instance_name);
+  auto &repl_instance = FindReplicationInstance(repl_instance_name);
+  repl_instance.OnFailPing();
+  const auto &repl_instance_uuid = repl_instance.GetMainUUID();
+  MG_ASSERT(repl_instance_uuid.has_value(), "Replication instance must have uuid set");
 
-// TODO: (andi) Add to the RAFT log.
-auto CoordinatorInstance::SetMainUUID(utils::UUID new_uuid) -> void { main_uuid_ = new_uuid; }
+  // NOLINTNEXTLINE
+  if (!repl_instance.IsAlive() && raft_state_.GetUUID() == repl_instance_uuid.value()) {
+    spdlog::info("Cluster without main instance, trying automatic failover");
+    TryFailover();
+  }
+}
+
+void CoordinatorInstance::MainSuccessCallback(std::string_view repl_instance_name) {
+  spdlog::trace("Instance {} performing main successful callback", repl_instance_name);
+  auto &repl_instance = FindReplicationInstance(repl_instance_name);
+
+  if (repl_instance.IsAlive()) {
+    repl_instance.OnSuccessPing();
+    return;
+  }
+
+  const auto &repl_instance_uuid = repl_instance.GetMainUUID();
+  MG_ASSERT(repl_instance_uuid.has_value(), "Instance must have uuid set.");
+
+  // NOLINTNEXTLINE
+  if (raft_state_.GetUUID() == repl_instance_uuid.value()) {
+    if (!repl_instance.EnableWritingOnMain()) {
+      spdlog::error("Failed to enable writing on main instance {}", repl_instance_name);
+      return;
+    }
+
+    repl_instance.OnSuccessPing();
+    return;
+  }
+
+  if (!raft_state_.RequestLeadership()) {
+    spdlog::error("Demoting main instance {} to replica failed since the instance is not the leader!",
+                  repl_instance_name);
+    return;
+  }
+
+  if (repl_instance.DemoteToReplica(&CoordinatorInstance::ReplicaSuccessCallback,
+                                    &CoordinatorInstance::ReplicaFailCallback)) {
+    repl_instance.OnSuccessPing();
+    spdlog::info("Instance {} demoted to replica", repl_instance_name);
+  } else {
+    spdlog::error("Instance {} failed to become replica", repl_instance_name);
+    return;
+  }
+
+  if (!repl_instance.SendSwapAndUpdateUUID(raft_state_.GetUUID())) {
+    spdlog::error("Failed to swap uuid for demoted main instance {}", repl_instance_name);
+    return;
+  }
+
+  if (!raft_state_.AppendSetInstanceAsReplicaLog(repl_instance_name)) {
+    return;
+  }
+}
+
+void CoordinatorInstance::ReplicaSuccessCallback(std::string_view repl_instance_name) {
+  spdlog::trace("Instance {} performing replica successful callback", repl_instance_name);
+  auto &repl_instance = FindReplicationInstance(repl_instance_name);
+
+  if (!IsReplica(repl_instance_name)) {
+    spdlog::error("Aborting replica callback since instance {} is not replica anymore", repl_instance_name);
+    return;
+  }
+  // We need to get replicas UUID from time to time to ensure replica is listening to correct main
+  // and that it didn't go down for less time than we could notice
+  // We need to get id of main replica is listening to
+  // and swap if necessary
+  if (!repl_instance.EnsureReplicaHasCorrectMainUUID(raft_state_.GetUUID())) {
+    spdlog::error("Failed to swap uuid for replica instance {} which is alive", repl_instance.InstanceName());
+    return;
+  }
+
+  repl_instance.OnSuccessPing();
+}
+
+void CoordinatorInstance::ReplicaFailCallback(std::string_view repl_instance_name) {
+  spdlog::trace("Instance {} performing replica failure callback", repl_instance_name);
+  auto &repl_instance = FindReplicationInstance(repl_instance_name);
+
+  if (!IsReplica(repl_instance_name)) {
+    spdlog::error("Aborting replica fail callback since instance {} is not replica anymore", repl_instance_name);
+    return;
+  }
+
+  repl_instance.OnFailPing();
+}
+
+auto CoordinatorInstance::ChooseMostUpToDateInstance(std::span<InstanceNameDbHistories> instance_database_histories)
+    -> NewMainRes {
+  std::optional<NewMainRes> new_main_res;
+  std::for_each(
+      instance_database_histories.begin(), instance_database_histories.end(),
+      [&new_main_res](const InstanceNameDbHistories &instance_res_pair) {
+        const auto &[instance_name, instance_db_histories] = instance_res_pair;
+
+        // Find default db for instance and its history
+        auto default_db_history_data = std::ranges::find_if(
+            instance_db_histories, [default_db = memgraph::dbms::kDefaultDB](
+                                       const replication_coordination_glue::DatabaseHistory &db_timestamps) {
+              return db_timestamps.name == default_db;
+            });
+
+        std::ranges::for_each(
+            instance_db_histories,
+            [&instance_name = instance_name](const replication_coordination_glue::DatabaseHistory &db_history) {
+              spdlog::debug("Instance {}: name {}, default db {}", instance_name, db_history.name,
+                            memgraph::dbms::kDefaultDB);
+            });
+
+        MG_ASSERT(default_db_history_data != instance_db_histories.end(), "No history for instance");
+
+        const auto &instance_default_db_history = default_db_history_data->history;
+
+        std::ranges::for_each(instance_default_db_history | ranges::views::reverse,
+                              [&instance_name = instance_name](const auto &epoch_history_it) {
+                                spdlog::debug("Instance {}: epoch {}, last_commit_timestamp: {}", instance_name,
+                                              std::get<0>(epoch_history_it), std::get<1>(epoch_history_it));
+                              });
+
+        // get latest epoch
+        // get latest timestamp
+
+        if (!new_main_res) {
+          const auto &[epoch, timestamp] = *instance_default_db_history.crbegin();
+          new_main_res = std::make_optional<NewMainRes>({instance_name, epoch, timestamp});
+          spdlog::debug("Currently the most up to date instance is {} with epoch {} and {} latest commit timestamp",
+                        instance_name, epoch, timestamp);
+          return;
+        }
+
+        bool found_same_point{false};
+        std::string last_most_up_to_date_epoch{new_main_res->latest_epoch};
+        for (auto [epoch, timestamp] : ranges::reverse_view(instance_default_db_history)) {
+          if (new_main_res->latest_commit_timestamp < timestamp) {
+            new_main_res = std::make_optional<NewMainRes>({instance_name, epoch, timestamp});
+            spdlog::trace("Found the new most up to date instance {} with epoch {} and {} latest commit timestamp",
+                          instance_name, epoch, timestamp);
+          }
+
+          // we found point at which they were same
+          if (epoch == last_most_up_to_date_epoch) {
+            found_same_point = true;
+            break;
+          }
+        }
+
+        if (!found_same_point) {
+          spdlog::error("Didn't find same history epoch {} for instance {} and instance {}", last_most_up_to_date_epoch,
+                        new_main_res->most_up_to_date_instance, instance_name);
+        }
+      });
+
+  return std::move(*new_main_res);
+}
+
+auto CoordinatorInstance::IsMain(std::string_view instance_name) const -> bool {
+  return raft_state_.IsMain(instance_name);
+}
+
+auto CoordinatorInstance::IsReplica(std::string_view instance_name) const -> bool {
+  return raft_state_.IsReplica(instance_name);
+}
 
 }  // namespace memgraph::coordination
 #endif

src/coordination/coordinator_log_store.cpp

@@ -62,34 +62,33 @@ ptr<log_entry> CoordinatorLogStore::last_entry() const {
 
 uint64_t CoordinatorLogStore::append(ptr<log_entry> &entry) {
   ptr<log_entry> clone = MakeClone(entry);
-  uint64_t next_slot{0};
-  {
-    auto lock = std::lock_guard{logs_lock_};
-    next_slot = start_idx_ + logs_.size() - 1;
-    logs_[next_slot] = clone;
-  }
+
+  auto lock = std::lock_guard{logs_lock_};
+  uint64_t next_slot = start_idx_ + logs_.size() - 1;
+  logs_[next_slot] = clone;
+
   return next_slot;
 }
 
+// TODO: (andi) I think this is used for resolving conflicts inside NuRaft, check...
+// different compared to in_memory_log_store.cxx
 void CoordinatorLogStore::write_at(uint64_t index, ptr<log_entry> &entry) {
   ptr<log_entry> clone = MakeClone(entry);
 
   // Discard all logs equal to or greater than `index.
-  {
-    auto lock = std::lock_guard{logs_lock_};
-    auto itr = logs_.lower_bound(index);
-    while (itr != logs_.end()) {
-      itr = logs_.erase(itr);
-    }
-    logs_[index] = clone;
+  auto lock = std::lock_guard{logs_lock_};
+  auto itr = logs_.lower_bound(index);
+  while (itr != logs_.end()) {
+    itr = logs_.erase(itr);
   }
+  logs_[index] = clone;
 }
 
 ptr<std::vector<ptr<log_entry>>> CoordinatorLogStore::log_entries(uint64_t start, uint64_t end) {
   auto ret = cs_new<std::vector<ptr<log_entry>>>();
   ret->resize(end - start);
 
-  for (uint64_t i = start, curr_index = 0; i < end; ++i, ++curr_index) {
+  for (uint64_t i = start, curr_index = 0; i < end; i++, curr_index++) {
     ptr<log_entry> src = nullptr;
     {
       auto lock = std::lock_guard{logs_lock_};
@@ -105,21 +104,14 @@ ptr<std::vector<ptr<log_entry>>> CoordinatorLogStore::log_entries(uint64_t start
 }
 
 ptr<log_entry> CoordinatorLogStore::entry_at(uint64_t index) {
-  ptr<log_entry> src = nullptr;
-  {
-    auto lock = std::lock_guard{logs_lock_};
-    src = FindOrDefault_(index);
-  }
+  auto lock = std::lock_guard{logs_lock_};
+  ptr<log_entry> src = FindOrDefault_(index);
   return MakeClone(src);
 }
 
 uint64_t CoordinatorLogStore::term_at(uint64_t index) {
-  uint64_t term = 0;
-  {
-    auto lock = std::lock_guard{logs_lock_};
-    term = FindOrDefault_(index)->get_term();
-  }
-  return term;
+  auto lock = std::lock_guard{logs_lock_};
+  return FindOrDefault_(index)->get_term();
 }
 
 ptr<buffer> CoordinatorLogStore::pack(uint64_t index, int32 cnt) {

src/coordination/coordinator_rpc.cpp

@@ -76,9 +76,9 @@ void EnableWritingOnMainRes::Load(EnableWritingOnMainRes *self, memgraph::slk::R
   memgraph::slk::Load(self, reader);
 }
 
-void EnableWritingOnMainReq::Save(EnableWritingOnMainReq const &self, memgraph::slk::Builder *builder) {}
+void EnableWritingOnMainReq::Save(EnableWritingOnMainReq const & /*self*/, memgraph::slk::Builder * /*builder*/) {}
 
-void EnableWritingOnMainReq::Load(EnableWritingOnMainReq *self, memgraph::slk::Reader *reader) {}
+void EnableWritingOnMainReq::Load(EnableWritingOnMainReq * /*self*/, memgraph::slk::Reader * /*reader*/) {}
 
 // GetInstanceUUID
 void GetInstanceUUIDReq::Save(const GetInstanceUUIDReq &self, memgraph::slk::Builder *builder) {
@@ -97,6 +97,24 @@ void GetInstanceUUIDRes::Load(GetInstanceUUIDRes *self, memgraph::slk::Reader *r
   memgraph::slk::Load(self, reader);
 }
 
+// GetDatabaseHistoriesRpc
+
+void GetDatabaseHistoriesReq::Save(const GetDatabaseHistoriesReq & /*self*/, memgraph::slk::Builder * /*builder*/) {
+  /* nothing to serialize */
+}
+
+void GetDatabaseHistoriesReq::Load(GetDatabaseHistoriesReq * /*self*/, memgraph::slk::Reader * /*reader*/) {
+  /* nothing to serialize */
+}
+
+void GetDatabaseHistoriesRes::Save(const GetDatabaseHistoriesRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self, builder);
+}
+
+void GetDatabaseHistoriesRes::Load(GetDatabaseHistoriesRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(self, reader);
+}
+
 }  // namespace coordination
 
 constexpr utils::TypeInfo coordination::PromoteReplicaToMainReq::kType{utils::TypeId::COORD_FAILOVER_REQ,
@@ -130,6 +148,12 @@ constexpr utils::TypeInfo coordination::GetInstanceUUIDReq::kType{utils::TypeId:
 constexpr utils::TypeInfo coordination::GetInstanceUUIDRes::kType{utils::TypeId::COORD_GET_UUID_RES, "CoordGetUUIDRes",
                                                                   nullptr};
 
+constexpr utils::TypeInfo coordination::GetDatabaseHistoriesReq::kType{utils::TypeId::COORD_GET_INSTANCE_DATABASES_REQ,
+                                                                       "GetInstanceDatabasesReq", nullptr};
+
+constexpr utils::TypeInfo coordination::GetDatabaseHistoriesRes::kType{utils::TypeId::COORD_GET_INSTANCE_DATABASES_RES,
+                                                                       "GetInstanceDatabasesRes", nullptr};
+
 namespace slk {
 
 // PromoteReplicaToMainRpc
@@ -213,6 +237,16 @@ void Load(memgraph::coordination::GetInstanceUUIDRes *self, memgraph::slk::Reade
   memgraph::slk::Load(&self->uuid, reader);
 }
 
+// GetInstanceTimestampsReq
+
+void Save(const memgraph::coordination::GetDatabaseHistoriesRes &self, memgraph::slk::Builder *builder) {
+  memgraph::slk::Save(self.database_histories, builder);
+}
+
+void Load(memgraph::coordination::GetDatabaseHistoriesRes *self, memgraph::slk::Reader *reader) {
+  memgraph::slk::Load(&self->database_histories, reader);
+}
+
 }  // namespace slk
 
 }  // namespace memgraph

src/coordination/coordinator_state.cpp

@@ -41,7 +41,7 @@ CoordinatorState::CoordinatorState() {
   }
 }
 
-auto CoordinatorState::RegisterReplicationInstance(CoordinatorClientConfig config)
+auto CoordinatorState::RegisterReplicationInstance(CoordinatorClientConfig const &config)
     -> RegisterInstanceCoordinatorStatus {
   MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot register replica since variant holds wrong alternative");
@@ -56,7 +56,8 @@ auto CoordinatorState::RegisterReplicationInstance(CoordinatorClientConfig confi
       data_);
 }
 
-auto CoordinatorState::UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus {
+auto CoordinatorState::UnregisterReplicationInstance(std::string_view instance_name)
+    -> UnregisterInstanceCoordinatorStatus {
   MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot unregister instance since variant holds wrong alternative");
 
@@ -70,7 +71,8 @@ auto CoordinatorState::UnregisterReplicationInstance(std::string instance_name)
       data_);
 }
 
-auto CoordinatorState::SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus {
+auto CoordinatorState::SetReplicationInstanceToMain(std::string_view instance_name)
+    -> SetInstanceToMainCoordinatorStatus {
   MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot register replica since variant holds wrong alternative");
 
@@ -96,8 +98,8 @@ auto CoordinatorState::GetCoordinatorServer() const -> CoordinatorServer & {
   return *std::get<CoordinatorMainReplicaData>(data_).coordinator_server_;
 }
 
-auto CoordinatorState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
-    -> void {
+auto CoordinatorState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port,
+                                              std::string_view raft_address) -> void {
   MG_ASSERT(std::holds_alternative<CoordinatorInstance>(data_),
             "Coordinator cannot register replica since variant holds wrong alternative");
   return std::get<CoordinatorInstance>(data_).AddCoordinatorInstance(raft_server_id, raft_port, raft_address);

src/coordination/coordinator_state_machine.cpp

@@ -12,100 +12,204 @@
 #ifdef MG_ENTERPRISE
 
 #include "nuraft/coordinator_state_machine.hpp"
+#include "utils/logging.hpp"
+
+namespace {
+constexpr int MAX_SNAPSHOTS = 3;
+}  // namespace
 
 namespace memgraph::coordination {
 
-auto CoordinatorStateMachine::EncodeRegisterReplicationInstance(const std::string &name) -> ptr<buffer> {
-  std::string str_log = name + "_replica";
-  ptr<buffer> log = buffer::alloc(sizeof(uint32_t) + str_log.size());
-  buffer_serializer bs(log);
-  bs.put_str(str_log);
-  return log;
+auto CoordinatorStateMachine::FindCurrentMainInstanceName() const -> std::optional<std::string> {
+  return cluster_state_.FindCurrentMainInstanceName();
 }
 
-auto CoordinatorStateMachine::DecodeRegisterReplicationInstance(buffer &data) -> std::string {
+auto CoordinatorStateMachine::MainExists() const -> bool { return cluster_state_.MainExists(); }
+
+auto CoordinatorStateMachine::IsMain(std::string_view instance_name) const -> bool {
+  return cluster_state_.IsMain(instance_name);
+}
+
+auto CoordinatorStateMachine::IsReplica(std::string_view instance_name) const -> bool {
+  return cluster_state_.IsReplica(instance_name);
+}
+
+auto CoordinatorStateMachine::CreateLog(nlohmann::json &&log) -> ptr<buffer> {
+  auto const log_dump = log.dump();
+  ptr<buffer> log_buf = buffer::alloc(sizeof(uint32_t) + log_dump.size());
+  buffer_serializer bs(log_buf);
+  bs.put_str(log_dump);
+  return log_buf;
+}
+
+auto CoordinatorStateMachine::SerializeRegisterInstance(CoordinatorClientConfig const &config) -> ptr<buffer> {
+  return CreateLog({{"action", RaftLogAction::REGISTER_REPLICATION_INSTANCE}, {"info", config}});
+}
+
+auto CoordinatorStateMachine::SerializeUnregisterInstance(std::string_view instance_name) -> ptr<buffer> {
+  return CreateLog({{"action", RaftLogAction::UNREGISTER_REPLICATION_INSTANCE}, {"info", instance_name}});
+}
+
+auto CoordinatorStateMachine::SerializeSetInstanceAsMain(std::string_view instance_name) -> ptr<buffer> {
+  return CreateLog({{"action", RaftLogAction::SET_INSTANCE_AS_MAIN}, {"info", instance_name}});
+}
+
+auto CoordinatorStateMachine::SerializeSetInstanceAsReplica(std::string_view instance_name) -> ptr<buffer> {
+  return CreateLog({{"action", RaftLogAction::SET_INSTANCE_AS_REPLICA}, {"info", instance_name}});
+}
+
+auto CoordinatorStateMachine::SerializeUpdateUUID(utils::UUID const &uuid) -> ptr<buffer> {
+  return CreateLog({{"action", RaftLogAction::UPDATE_UUID}, {"info", uuid}});
+}
+
+auto CoordinatorStateMachine::DecodeLog(buffer &data) -> std::pair<TRaftLog, RaftLogAction> {
   buffer_serializer bs(data);
-  return bs.get_str();
+  auto const json = nlohmann::json::parse(bs.get_str());
+
+  auto const action = json["action"].get<RaftLogAction>();
+  auto const &info = json["info"];
+
+  switch (action) {
+    case RaftLogAction::REGISTER_REPLICATION_INSTANCE:
+      return {info.get<CoordinatorClientConfig>(), action};
+    case RaftLogAction::UPDATE_UUID:
+      return {info.get<utils::UUID>(), action};
+    case RaftLogAction::UNREGISTER_REPLICATION_INSTANCE:
+    case RaftLogAction::SET_INSTANCE_AS_MAIN:
+      [[fallthrough]];
+    case RaftLogAction::SET_INSTANCE_AS_REPLICA:
+      return {info.get<std::string>(), action};
+  }
+  throw std::runtime_error("Unknown action");
 }
 
-auto CoordinatorStateMachine::pre_commit(ulong const log_idx, buffer &data) -> ptr<buffer> {
-  buffer_serializer bs(data);
-  std::string str = bs.get_str();
-
-  spdlog::info("pre_commit {} : {}", log_idx, str);
-  return nullptr;
-}
+auto CoordinatorStateMachine::pre_commit(ulong const /*log_idx*/, buffer & /*data*/) -> ptr<buffer> { return nullptr; }
 
 auto CoordinatorStateMachine::commit(ulong const log_idx, buffer &data) -> ptr<buffer> {
-  buffer_serializer bs(data);
-  std::string str = bs.get_str();
-
-  spdlog::info("commit {} : {}", log_idx, str);
-
+  spdlog::debug("Commit: log_idx={}, data.size()={}", log_idx, data.size());
+  auto const [parsed_data, log_action] = DecodeLog(data);
+  cluster_state_.DoAction(parsed_data, log_action);
   last_committed_idx_ = log_idx;
-  return nullptr;
+
+  // Return raft log number
+  ptr<buffer> ret = buffer::alloc(sizeof(log_idx));
+  buffer_serializer bs_ret(ret);
+  bs_ret.put_u64(log_idx);
+  return ret;
 }
 
 auto CoordinatorStateMachine::commit_config(ulong const log_idx, ptr<cluster_config> & /*new_conf*/) -> void {
   last_committed_idx_ = log_idx;
+  spdlog::debug("Commit config: log_idx={}", log_idx);
 }
 
 auto CoordinatorStateMachine::rollback(ulong const log_idx, buffer &data) -> void {
-  buffer_serializer bs(data);
-  std::string str = bs.get_str();
-
-  spdlog::info("rollback {} : {}", log_idx, str);
+  // NOTE: Nothing since we don't do anything in pre_commit
+  spdlog::debug("Rollback: log_idx={}, data.size()={}", log_idx, data.size());
 }
 
-auto CoordinatorStateMachine::read_logical_snp_obj(snapshot & /*snapshot*/, void *& /*user_snp_ctx*/, ulong /*obj_id*/,
+auto CoordinatorStateMachine::read_logical_snp_obj(snapshot &snapshot, void *& /*user_snp_ctx*/, ulong obj_id,
                                                    ptr<buffer> &data_out, bool &is_last_obj) -> int {
-  // Put dummy data.
-  data_out = buffer::alloc(sizeof(int32));
-  buffer_serializer bs(data_out);
-  bs.put_i32(0);
+  spdlog::debug("read logical snapshot object, obj_id: {}", obj_id);
+
+  ptr<SnapshotCtx> ctx = nullptr;
+  {
+    auto ll = std::lock_guard{snapshots_lock_};
+    auto entry = snapshots_.find(snapshot.get_last_log_idx());
+    if (entry == snapshots_.end()) {
+      data_out = nullptr;
+      is_last_obj = true;
+      return 0;
+    }
+    ctx = entry->second;
+  }
+
+  if (obj_id == 0) {
+    // Object ID == 0: first object, put dummy data.
+    data_out = buffer::alloc(sizeof(int32));
+    buffer_serializer bs(data_out);
+    bs.put_i32(0);
+    is_last_obj = false;
+  } else {
+    // Object ID > 0: second object, put actual value.
+    ctx->cluster_state_.Serialize(data_out);
+  }
 
-  is_last_obj = true;
   return 0;
 }
 
-auto CoordinatorStateMachine::save_logical_snp_obj(snapshot &s, ulong &obj_id, buffer & /*data*/, bool /*is_first_obj*/,
-                                                   bool /*is_last_obj*/) -> void {
-  spdlog::info("save snapshot {} term {} object ID", s.get_last_log_idx(), s.get_last_log_term(), obj_id);
-  // Request next object.
-  obj_id++;
+auto CoordinatorStateMachine::save_logical_snp_obj(snapshot &snapshot, ulong &obj_id, buffer &data, bool is_first_obj,
+                                                   bool is_last_obj) -> void {
+  spdlog::debug("save logical snapshot object, obj_id: {}, is_first_obj: {}, is_last_obj: {}", obj_id, is_first_obj,
+                is_last_obj);
+
+  if (obj_id == 0) {
+    ptr<buffer> snp_buf = snapshot.serialize();
+    auto ss = snapshot::deserialize(*snp_buf);
+    create_snapshot_internal(ss);
+  } else {
+    auto cluster_state = CoordinatorClusterState::Deserialize(data);
+
+    auto ll = std::lock_guard{snapshots_lock_};
+    auto entry = snapshots_.find(snapshot.get_last_log_idx());
+    DMG_ASSERT(entry != snapshots_.end());
+    entry->second->cluster_state_ = cluster_state;
+  }
 }
 
 auto CoordinatorStateMachine::apply_snapshot(snapshot &s) -> bool {
-  spdlog::info("apply snapshot {} term {}", s.get_last_log_idx(), s.get_last_log_term());
-  {
-    auto lock = std::lock_guard{last_snapshot_lock_};
-    ptr<buffer> snp_buf = s.serialize();
-    last_snapshot_ = snapshot::deserialize(*snp_buf);
-  }
+  auto ll = std::lock_guard{snapshots_lock_};
+  spdlog::debug("apply snapshot, last_log_idx: {}", s.get_last_log_idx());
+
+  auto entry = snapshots_.find(s.get_last_log_idx());
+  if (entry == snapshots_.end()) return false;
+
+  cluster_state_ = entry->second->cluster_state_;
   return true;
 }
 
 auto CoordinatorStateMachine::free_user_snp_ctx(void *&user_snp_ctx) -> void {}
 
 auto CoordinatorStateMachine::last_snapshot() -> ptr<snapshot> {
-  auto lock = std::lock_guard{last_snapshot_lock_};
-  return last_snapshot_;
+  auto ll = std::lock_guard{snapshots_lock_};
+  spdlog::debug("last_snapshot");
+  auto entry = snapshots_.rbegin();
+  if (entry == snapshots_.rend()) return nullptr;
+
+  ptr<SnapshotCtx> ctx = entry->second;
+  return ctx->snapshot_;
 }
 
 auto CoordinatorStateMachine::last_commit_index() -> ulong { return last_committed_idx_; }
 
 auto CoordinatorStateMachine::create_snapshot(snapshot &s, async_result<bool>::handler_type &when_done) -> void {
-  spdlog::info("create snapshot {} term {}", s.get_last_log_idx(), s.get_last_log_term());
-  // Clone snapshot from `s`.
-  {
-    auto lock = std::lock_guard{last_snapshot_lock_};
-    ptr<buffer> snp_buf = s.serialize();
-    last_snapshot_ = snapshot::deserialize(*snp_buf);
-  }
+  spdlog::debug("create_snapshot, last_log_idx: {}", s.get_last_log_idx());
+  ptr<buffer> snp_buf = s.serialize();
+  ptr<snapshot> ss = snapshot::deserialize(*snp_buf);
+  create_snapshot_internal(ss);
+
   ptr<std::exception> except(nullptr);
   bool ret = true;
   when_done(ret, except);
 }
 
+auto CoordinatorStateMachine::create_snapshot_internal(ptr<snapshot> snapshot) -> void {
+  auto ll = std::lock_guard{snapshots_lock_};
+  spdlog::debug("create_snapshot_internal, last_log_idx: {}", snapshot->get_last_log_idx());
+
+  auto ctx = cs_new<SnapshotCtx>(snapshot, cluster_state_);
+  snapshots_[snapshot->get_last_log_idx()] = ctx;
+
+  while (snapshots_.size() > MAX_SNAPSHOTS) {
+    snapshots_.erase(snapshots_.begin());
+  }
+}
+
+auto CoordinatorStateMachine::GetInstances() const -> std::vector<InstanceState> {
+  return cluster_state_.GetInstances();
+}
+
+auto CoordinatorStateMachine::GetUUID() const -> utils::UUID { return cluster_state_.GetUUID(); }
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/include/coordination/coordinator_client.hpp

@@ -14,6 +14,7 @@
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_config.hpp"
+#include "replication_coordination_glue/common.hpp"
 #include "rpc/client.hpp"
 #include "rpc_errors.hpp"
 #include "utils/result.hpp"
@@ -23,13 +24,13 @@
 namespace memgraph::coordination {
 
 class CoordinatorInstance;
-using HealthCheckCallback = std::function<void(CoordinatorInstance *, std::string_view)>;
+using HealthCheckClientCallback = std::function<void(CoordinatorInstance *, std::string_view)>;
 using ReplicationClientsInfo = std::vector<ReplClientInfo>;
 
 class CoordinatorClient {
  public:
   explicit CoordinatorClient(CoordinatorInstance *coord_instance, CoordinatorClientConfig config,
-                             HealthCheckCallback succ_cb, HealthCheckCallback fail_cb);
+                             HealthCheckClientCallback succ_cb, HealthCheckClientCallback fail_cb);
 
   ~CoordinatorClient() = default;
 
@@ -45,16 +46,17 @@ class CoordinatorClient {
   void ResumeFrequentCheck();
 
   auto InstanceName() const -> std::string;
-  auto SocketAddress() const -> std::string;
+  auto CoordinatorSocketAddress() const -> std::string;
+  auto ReplicationSocketAddress() const -> std::string;
 
   [[nodiscard]] auto DemoteToReplica() const -> bool;
 
-  auto SendPromoteReplicaToMainRpc(const utils::UUID &uuid, ReplicationClientsInfo replication_clients_info) const
+  auto SendPromoteReplicaToMainRpc(utils::UUID const &uuid, ReplicationClientsInfo replication_clients_info) const
       -> bool;
 
-  auto SendSwapMainUUIDRpc(const utils::UUID &uuid) const -> bool;
+  auto SendSwapMainUUIDRpc(utils::UUID const &uuid) const -> bool;
 
-  auto SendUnregisterReplicaRpc(std::string const &instance_name) const -> bool;
+  auto SendUnregisterReplicaRpc(std::string_view instance_name) const -> bool;
 
   auto SendEnableWritingOnMainRpc() const -> bool;
 
@@ -62,7 +64,8 @@ class CoordinatorClient {
 
   auto ReplicationClientInfo() const -> ReplClientInfo;
 
-  auto SetCallbacks(HealthCheckCallback succ_cb, HealthCheckCallback fail_cb) -> void;
+  auto SendGetInstanceTimestampsRpc() const
+      -> utils::BasicResult<GetInstanceUUIDError, replication_coordination_glue::DatabaseHistories>;
 
   auto RpcClient() -> rpc::Client & { return rpc_client_; }
 
@@ -82,8 +85,8 @@ class CoordinatorClient {
 
   CoordinatorClientConfig config_;
   CoordinatorInstance *coord_instance_;
-  HealthCheckCallback succ_cb_;
-  HealthCheckCallback fail_cb_;
+  HealthCheckClientCallback succ_cb_;
+  HealthCheckClientCallback fail_cb_;
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/coordinator_config.hpp

@@ -14,12 +14,16 @@
 #ifdef MG_ENTERPRISE
 
 #include "replication_coordination_glue/mode.hpp"
+#include "utils/string.hpp"
 
 #include <chrono>
 #include <cstdint>
 #include <optional>
 #include <string>
 
+#include <fmt/format.h>
+#include "json/json.hpp"
+
 namespace memgraph::coordination {
 
 inline constexpr auto *kDefaultReplicationServerIp = "0.0.0.0";
@@ -32,7 +36,11 @@ struct CoordinatorClientConfig {
   std::chrono::seconds instance_down_timeout_sec{5};
   std::chrono::seconds instance_get_uuid_frequency_sec{10};
 
-  auto SocketAddress() const -> std::string { return ip_address + ":" + std::to_string(port); }
+  auto CoordinatorSocketAddress() const -> std::string { return fmt::format("{}:{}", ip_address, port); }
+  auto ReplicationSocketAddress() const -> std::string {
+    return fmt::format("{}:{}", replication_client_info.replication_ip_address,
+                       replication_client_info.replication_port);
+  }
 
   struct ReplicationClientInfo {
     std::string instance_name;
@@ -75,5 +83,11 @@ struct CoordinatorServerConfig {
   friend bool operator==(CoordinatorServerConfig const &, CoordinatorServerConfig const &) = default;
 };
 
+void to_json(nlohmann::json &j, CoordinatorClientConfig const &config);
+void from_json(nlohmann::json const &j, CoordinatorClientConfig &config);
+
+void to_json(nlohmann::json &j, ReplClientInfo const &config);
+void from_json(nlohmann::json const &j, ReplClientInfo &config);
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/include/coordination/coordinator_exceptions.hpp

@@ -83,5 +83,16 @@ class RaftCouldNotParseFlagsException final : public utils::BasicException {
   SPECIALIZE_GET_EXCEPTION_NAME(RaftCouldNotParseFlagsException)
 };
 
+class InvalidRaftLogActionException final : public utils::BasicException {
+ public:
+  explicit InvalidRaftLogActionException(std::string_view what) noexcept : BasicException(what) {}
+
+  template <class... Args>
+  explicit InvalidRaftLogActionException(fmt::format_string<Args...> fmt, Args &&...args) noexcept
+      : InvalidRaftLogActionException(fmt::format(fmt, std::forward<Args>(args)...)) {}
+
+  SPECIALIZE_GET_EXCEPTION_NAME(InvalidRaftLogActionException)
+};
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/include/coordination/coordinator_handlers.hpp

@@ -41,6 +41,9 @@ class CoordinatorHandlers {
 
   static void GetInstanceUUIDHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
                                      slk::Builder *res_builder);
+
+  static void GetDatabaseHistoriesHandler(replication::ReplicationHandler &replication_handler, slk::Reader *req_reader,
+                                          slk::Builder *res_builder);
 };
 
 }  // namespace memgraph::dbms

src/coordination/include/coordination/coordinator_instance.hpp

@@ -18,6 +18,7 @@
 #include "coordination/raft_state.hpp"
 #include "coordination/register_main_replica_coordinator_status.hpp"
 #include "coordination/replication_instance.hpp"
+#include "utils/resource_lock.hpp"
 #include "utils/rw_lock.hpp"
 #include "utils/thread_pool.hpp"
 
@@ -25,33 +26,54 @@
 
 namespace memgraph::coordination {
 
+struct NewMainRes {
+  std::string most_up_to_date_instance;
+  std::string latest_epoch;
+  uint64_t latest_commit_timestamp;
+};
+using InstanceNameDbHistories = std::pair<std::string, replication_coordination_glue::DatabaseHistories>;
+
 class CoordinatorInstance {
  public:
   CoordinatorInstance();
 
-  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
-  [[nodiscard]] auto UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig const &config)
+      -> RegisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto UnregisterReplicationInstance(std::string_view instance_name)
+      -> UnregisterInstanceCoordinatorStatus;
 
-  [[nodiscard]] auto SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
+  [[nodiscard]] auto SetReplicationInstanceToMain(std::string_view instance_name) -> SetInstanceToMainCoordinatorStatus;
 
   auto ShowInstances() const -> std::vector<InstanceStatus>;
 
   auto TryFailover() -> void;
 
-  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string_view raft_address) -> void;
 
-  auto GetMainUUID() const -> utils::UUID;
-
-  auto SetMainUUID(utils::UUID new_uuid) -> void;
+  static auto ChooseMostUpToDateInstance(std::span<InstanceNameDbHistories> histories) -> NewMainRes;
 
  private:
-  HealthCheckCallback main_succ_cb_, main_fail_cb_, replica_succ_cb_, replica_fail_cb_;
+  HealthCheckClientCallback client_succ_cb_, client_fail_cb_;
 
-  // NOTE: Must be std::list because we rely on pointer stability
+  auto OnRaftCommitCallback(TRaftLog const &log_entry, RaftLogAction log_action) -> void;
+
+  auto FindReplicationInstance(std::string_view replication_instance_name) -> ReplicationInstance &;
+
+  void MainFailCallback(std::string_view);
+
+  void MainSuccessCallback(std::string_view);
+
+  void ReplicaSuccessCallback(std::string_view);
+
+  void ReplicaFailCallback(std::string_view);
+
+  auto IsMain(std::string_view instance_name) const -> bool;
+  auto IsReplica(std::string_view instance_name) const -> bool;
+
+  // NOTE: Must be std::list because we rely on pointer stability.
+  // Leader and followers should both have same view on repl_instances_
   std::list<ReplicationInstance> repl_instances_;
-  mutable utils::RWLock coord_instance_lock_{utils::RWLock::Priority::READ};
-
-  utils::UUID main_uuid_;
+  mutable utils::ResourceLock coord_instance_lock_{};
 
   RaftState raft_state_;
 };

src/coordination/include/coordination/coordinator_rpc.hpp

@@ -15,6 +15,7 @@
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_config.hpp"
+#include "replication_coordination_glue/common.hpp"
 #include "rpc/messages.hpp"
 #include "slk/serialization.hpp"
 
@@ -89,7 +90,7 @@ struct UnregisterReplicaReq {
   static void Load(UnregisterReplicaReq *self, memgraph::slk::Reader *reader);
   static void Save(UnregisterReplicaReq const &self, memgraph::slk::Builder *builder);
 
-  explicit UnregisterReplicaReq(std::string instance_name) : instance_name(std::move(instance_name)) {}
+  explicit UnregisterReplicaReq(std::string_view inst_name) : instance_name(inst_name) {}
 
   UnregisterReplicaReq() = default;
 
@@ -161,6 +162,32 @@ struct GetInstanceUUIDRes {
 
 using GetInstanceUUIDRpc = rpc::RequestResponse<GetInstanceUUIDReq, GetInstanceUUIDRes>;
 
+struct GetDatabaseHistoriesReq {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(GetDatabaseHistoriesReq *self, memgraph::slk::Reader *reader);
+  static void Save(const GetDatabaseHistoriesReq &self, memgraph::slk::Builder *builder);
+
+  GetDatabaseHistoriesReq() = default;
+};
+
+struct GetDatabaseHistoriesRes {
+  static const utils::TypeInfo kType;
+  static const utils::TypeInfo &GetTypeInfo() { return kType; }
+
+  static void Load(GetDatabaseHistoriesRes *self, memgraph::slk::Reader *reader);
+  static void Save(const GetDatabaseHistoriesRes &self, memgraph::slk::Builder *builder);
+
+  explicit GetDatabaseHistoriesRes(const replication_coordination_glue::DatabaseHistories &database_histories)
+      : database_histories(database_histories) {}
+  GetDatabaseHistoriesRes() = default;
+
+  replication_coordination_glue::DatabaseHistories database_histories;
+};
+
+using GetDatabaseHistoriesRpc = rpc::RequestResponse<GetDatabaseHistoriesReq, GetDatabaseHistoriesRes>;
+
 }  // namespace memgraph::coordination
 
 // SLK serialization declarations
@@ -183,15 +210,21 @@ void Save(const memgraph::coordination::GetInstanceUUIDReq &self, memgraph::slk:
 void Load(memgraph::coordination::GetInstanceUUIDReq *self, memgraph::slk::Reader *reader);
 void Save(const memgraph::coordination::GetInstanceUUIDRes &self, memgraph::slk::Builder *builder);
 void Load(memgraph::coordination::GetInstanceUUIDRes *self, memgraph::slk::Reader *reader);
+
 // UnregisterReplicaRpc
 void Save(memgraph::coordination::UnregisterReplicaRes const &self, memgraph::slk::Builder *builder);
 void Load(memgraph::coordination::UnregisterReplicaRes *self, memgraph::slk::Reader *reader);
 void Save(memgraph::coordination::UnregisterReplicaReq const &self, memgraph::slk::Builder *builder);
 void Load(memgraph::coordination::UnregisterReplicaReq *self, memgraph::slk::Reader *reader);
 
+// EnableWritingOnMainRpc
 void Save(memgraph::coordination::EnableWritingOnMainRes const &self, memgraph::slk::Builder *builder);
 void Load(memgraph::coordination::EnableWritingOnMainRes *self, memgraph::slk::Reader *reader);
 
+// GetDatabaseHistoriesRpc
+void Save(const memgraph::coordination::GetDatabaseHistoriesRes &self, memgraph::slk::Builder *builder);
+void Load(memgraph::coordination::GetDatabaseHistoriesRes *self, memgraph::slk::Reader *reader);
+
 }  // namespace memgraph::slk
 
 #endif

src/coordination/include/coordination/coordinator_slk.hpp

@@ -14,6 +14,7 @@
 #ifdef MG_ENTERPRISE
 
 #include "coordination/coordinator_config.hpp"
+#include "replication_coordination_glue/common.hpp"
 #include "slk/serialization.hpp"
 #include "slk/streams.hpp"
 
@@ -34,5 +35,18 @@ inline void Load(ReplicationClientInfo *obj, Reader *reader) {
   Load(&obj->replication_ip_address, reader);
   Load(&obj->replication_port, reader);
 }
+
+inline void Save(const replication_coordination_glue::DatabaseHistory &obj, Builder *builder) {
+  Save(obj.db_uuid, builder);
+  Save(obj.history, builder);
+  Save(obj.name, builder);
+}
+
+inline void Load(replication_coordination_glue::DatabaseHistory *obj, Reader *reader) {
+  Load(&obj->db_uuid, reader);
+  Load(&obj->history, reader);
+  Load(&obj->name, reader);
+}
+
 }  // namespace memgraph::slk
 #endif

src/coordination/include/coordination/coordinator_state.hpp

@@ -33,14 +33,16 @@ class CoordinatorState {
   CoordinatorState(CoordinatorState &&) noexcept = delete;
   CoordinatorState &operator=(CoordinatorState &&) noexcept = delete;
 
-  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig config) -> RegisterInstanceCoordinatorStatus;
-  [[nodiscard]] auto UnregisterReplicationInstance(std::string instance_name) -> UnregisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto RegisterReplicationInstance(CoordinatorClientConfig const &config)
+      -> RegisterInstanceCoordinatorStatus;
+  [[nodiscard]] auto UnregisterReplicationInstance(std::string_view instance_name)
+      -> UnregisterInstanceCoordinatorStatus;
 
-  [[nodiscard]] auto SetReplicationInstanceToMain(std::string instance_name) -> SetInstanceToMainCoordinatorStatus;
+  [[nodiscard]] auto SetReplicationInstanceToMain(std::string_view instance_name) -> SetInstanceToMainCoordinatorStatus;
 
   auto ShowInstances() const -> std::vector<InstanceStatus>;
 
-  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string_view raft_address) -> void;
 
   // NOTE: The client code must check that the server exists before calling this method.
   auto GetCoordinatorServer() const -> CoordinatorServer &;

src/coordination/include/coordination/instance_status.hpp

@@ -26,7 +26,7 @@ struct InstanceStatus {
   std::string raft_socket_address;
   std::string coord_socket_address;
   std::string cluster_role;
-  bool is_alive;
+  std::string health;
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/raft_state.hpp

@@ -14,11 +14,17 @@
 #ifdef MG_ENTERPRISE
 
 #include <flags/replication.hpp>
+#include "io/network/endpoint.hpp"
+#include "nuraft/coordinator_state_machine.hpp"
+#include "nuraft/coordinator_state_manager.hpp"
 
 #include <libnuraft/nuraft.hxx>
 
 namespace memgraph::coordination {
 
+class CoordinatorInstance;
+struct CoordinatorClientConfig;
+
 using BecomeLeaderCb = std::function<void()>;
 using BecomeFollowerCb = std::function<void()>;
 
@@ -47,26 +53,38 @@ class RaftState {
   RaftState &operator=(RaftState &&other) noexcept = default;
   ~RaftState();
 
-  static auto MakeRaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb) -> RaftState;
+  static auto MakeRaftState(BecomeLeaderCb &&become_leader_cb, BecomeFollowerCb &&become_follower_cb) -> RaftState;
 
   auto InstanceName() const -> std::string;
   auto RaftSocketAddress() const -> std::string;
 
-  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string_view raft_address) -> void;
   auto GetAllCoordinators() const -> std::vector<ptr<srv_config>>;
 
   auto RequestLeadership() -> bool;
   auto IsLeader() const -> bool;
 
-  auto AppendRegisterReplicationInstance(std::string const &instance) -> ptr<raft_result>;
+  auto FindCurrentMainInstanceName() const -> std::optional<std::string>;
+  auto MainExists() const -> bool;
+  auto IsMain(std::string_view instance_name) const -> bool;
+  auto IsReplica(std::string_view instance_name) const -> bool;
 
-  // TODO: (andi) I think variables below can be abstracted
+  auto AppendRegisterReplicationInstanceLog(CoordinatorClientConfig const &config) -> bool;
+  auto AppendUnregisterReplicationInstanceLog(std::string_view instance_name) -> bool;
+  auto AppendSetInstanceAsMainLog(std::string_view instance_name) -> bool;
+  auto AppendSetInstanceAsReplicaLog(std::string_view instance_name) -> bool;
+  auto AppendUpdateUUIDLog(utils::UUID const &uuid) -> bool;
+
+  auto GetInstances() const -> std::vector<InstanceState>;
+  auto GetUUID() const -> utils::UUID;
+
+ private:
+  // TODO: (andi) I think variables below can be abstracted/clean them.
+  io::network::Endpoint raft_endpoint_;
   uint32_t raft_server_id_;
-  uint32_t raft_port_;
-  std::string raft_address_;
 
-  ptr<state_machine> state_machine_;
-  ptr<state_mgr> state_manager_;
+  ptr<CoordinatorStateMachine> state_machine_;
+  ptr<CoordinatorStateManager> state_manager_;
   ptr<raft_server> raft_server_;
   ptr<logger> logger_;
   raft_launcher launcher_;

src/coordination/include/coordination/register_main_replica_coordinator_status.hpp

@@ -19,12 +19,12 @@ namespace memgraph::coordination {
 
 enum class RegisterInstanceCoordinatorStatus : uint8_t {
   NAME_EXISTS,
-  ENDPOINT_EXISTS,
+  COORD_ENDPOINT_EXISTS,
+  REPL_ENDPOINT_EXISTS,
   NOT_COORDINATOR,
-  RPC_FAILED,
   NOT_LEADER,
-  RAFT_COULD_NOT_ACCEPT,
-  RAFT_COULD_NOT_APPEND,
+  RPC_FAILED,
+  RAFT_LOG_ERROR,
   SUCCESS
 };
 
@@ -32,8 +32,9 @@ enum class UnregisterInstanceCoordinatorStatus : uint8_t {
   NO_INSTANCE_WITH_NAME,
   IS_MAIN,
   NOT_COORDINATOR,
-  NOT_LEADER,
   RPC_FAILED,
+  NOT_LEADER,
+  RAFT_LOG_ERROR,
   SUCCESS,
 };
 
@@ -41,9 +42,11 @@ enum class SetInstanceToMainCoordinatorStatus : uint8_t {
   NO_INSTANCE_WITH_NAME,
   MAIN_ALREADY_EXISTS,
   NOT_COORDINATOR,
-  SUCCESS,
+  NOT_LEADER,
+  RAFT_LOG_ERROR,
   COULD_NOT_PROMOTE_TO_MAIN,
-  SWAP_UUID_FAILED
+  SWAP_UUID_FAILED,
+  SUCCESS,
 };
 
 }  // namespace memgraph::coordination

src/coordination/include/coordination/replication_instance.hpp

@@ -17,18 +17,24 @@
 #include "coordination/coordinator_exceptions.hpp"
 #include "replication_coordination_glue/role.hpp"
 
-#include <libnuraft/nuraft.hxx>
+#include "utils/resource_lock.hpp"
 #include "utils/result.hpp"
 #include "utils/uuid.hpp"
 
+#include <libnuraft/nuraft.hxx>
+
 namespace memgraph::coordination {
 
 class CoordinatorInstance;
+class ReplicationInstance;
+
+using HealthCheckInstanceCallback = void (CoordinatorInstance::*)(std::string_view);
 
 class ReplicationInstance {
  public:
-  ReplicationInstance(CoordinatorInstance *peer, CoordinatorClientConfig config, HealthCheckCallback succ_cb,
-                      HealthCheckCallback fail_cb);
+  ReplicationInstance(CoordinatorInstance *peer, CoordinatorClientConfig config, HealthCheckClientCallback succ_cb,
+                      HealthCheckClientCallback fail_cb, HealthCheckInstanceCallback succ_instance_cb,
+                      HealthCheckInstanceCallback fail_instance_cb);
 
   ReplicationInstance(ReplicationInstance const &other) = delete;
   ReplicationInstance &operator=(ReplicationInstance const &other) = delete;
@@ -45,14 +51,16 @@ class ReplicationInstance {
   auto IsAlive() const -> bool;
 
   auto InstanceName() const -> std::string;
-  auto SocketAddress() const -> std::string;
+  auto CoordinatorSocketAddress() const -> std::string;
+  auto ReplicationSocketAddress() const -> std::string;
 
-  auto IsReplica() const -> bool;
-  auto IsMain() const -> bool;
+  auto PromoteToMain(utils::UUID const &uuid, ReplicationClientsInfo repl_clients_info,
+                     HealthCheckInstanceCallback main_succ_cb, HealthCheckInstanceCallback main_fail_cb) -> bool;
 
-  auto PromoteToMain(utils::UUID uuid, ReplicationClientsInfo repl_clients_info, HealthCheckCallback main_succ_cb,
-                     HealthCheckCallback main_fail_cb) -> bool;
-  auto DemoteToReplica(HealthCheckCallback replica_succ_cb, HealthCheckCallback replica_fail_cb) -> bool;
+  auto SendDemoteToReplicaRpc() -> bool;
+
+  auto DemoteToReplica(HealthCheckInstanceCallback replica_succ_cb, HealthCheckInstanceCallback replica_fail_cb)
+      -> bool;
 
   auto StartFrequentCheck() -> void;
   auto StopFrequentCheck() -> void;
@@ -63,9 +71,8 @@ class ReplicationInstance {
 
   auto EnsureReplicaHasCorrectMainUUID(utils::UUID const &curr_main_uuid) -> bool;
 
-  auto SendSwapAndUpdateUUID(const utils::UUID &new_main_uuid) -> bool;
-  auto SendUnregisterReplicaRpc(std::string const &instance_name) -> bool;
-
+  auto SendSwapAndUpdateUUID(utils::UUID const &new_main_uuid) -> bool;
+  auto SendUnregisterReplicaRpc(std::string_view instance_name) -> bool;
 
   auto SendGetInstanceUUID() -> utils::BasicResult<coordination::GetInstanceUUIDError, std::optional<utils::UUID>>;
   auto GetClient() -> CoordinatorClient &;
@@ -74,11 +81,13 @@ class ReplicationInstance {
 
   auto SetNewMainUUID(utils::UUID const &main_uuid) -> void;
   auto ResetMainUUID() -> void;
-  auto GetMainUUID() const -> const std::optional<utils::UUID> &;
+  auto GetMainUUID() const -> std::optional<utils::UUID> const &;
+
+  auto GetSuccessCallback() -> HealthCheckInstanceCallback &;
+  auto GetFailCallback() -> HealthCheckInstanceCallback &;
 
  private:
   CoordinatorClient client_;
-  replication_coordination_glue::ReplicationRole replication_role_;
   std::chrono::system_clock::time_point last_response_time_{};
   bool is_alive_{false};
   std::chrono::system_clock::time_point last_check_of_uuid_{};
@@ -90,8 +99,12 @@ class ReplicationInstance {
   // so we need to send swap uuid again
   std::optional<utils::UUID> main_uuid_;
 
+  HealthCheckInstanceCallback succ_cb_;
+  HealthCheckInstanceCallback fail_cb_;
+
   friend bool operator==(ReplicationInstance const &first, ReplicationInstance const &second) {
-    return first.client_ == second.client_ && first.replication_role_ == second.replication_role_;
+    return first.client_ == second.client_ && first.last_response_time_ == second.last_response_time_ &&
+           first.is_alive_ == second.is_alive_ && first.main_uuid_ == second.main_uuid_;
   }
 };
 

src/coordination/include/coordination/rpc_errors.hpp

@@ -11,4 +11,5 @@
 
 namespace memgraph::coordination {
 enum class GetInstanceUUIDError { NO_RESPONSE, RPC_EXCEPTION };
+enum class GetInstanceTimestampsError { NO_RESPONSE, RPC_EXCEPTION };
 }  // namespace memgraph::coordination

src/coordination/include/nuraft/coordinator_cluster_state.hpp

@@ -0,0 +1,95 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_config.hpp"
+#include "nuraft/raft_log_action.hpp"
+#include "replication_coordination_glue/role.hpp"
+#include "utils/resource_lock.hpp"
+#include "utils/uuid.hpp"
+
+#include <libnuraft/nuraft.hxx>
+#include <range/v3/view.hpp>
+#include "json/json.hpp"
+
+#include <map>
+#include <numeric>
+#include <string>
+#include <variant>
+
+namespace memgraph::coordination {
+
+using replication_coordination_glue::ReplicationRole;
+
+struct InstanceState {
+  CoordinatorClientConfig config;
+  ReplicationRole status;
+  // TODO(antoniofilipovic) We might need this because we need to track correct instance
+  // utils::UUID main_uuid_;
+
+  friend auto operator==(InstanceState const &lhs, InstanceState const &rhs) -> bool {
+    return lhs.config == rhs.config && lhs.status == rhs.status;
+  }
+};
+
+void to_json(nlohmann::json &j, InstanceState const &instance_state);
+void from_json(nlohmann::json const &j, InstanceState &instance_state);
+
+using TRaftLog = std::variant<CoordinatorClientConfig, std::string, utils::UUID>;
+
+using nuraft::buffer;
+using nuraft::buffer_serializer;
+using nuraft::ptr;
+
+class CoordinatorClusterState {
+ public:
+  CoordinatorClusterState() = default;
+  explicit CoordinatorClusterState(std::map<std::string, InstanceState, std::less<>> instances);
+
+  CoordinatorClusterState(CoordinatorClusterState const &);
+  CoordinatorClusterState &operator=(CoordinatorClusterState const &);
+
+  CoordinatorClusterState(CoordinatorClusterState &&other) noexcept;
+  CoordinatorClusterState &operator=(CoordinatorClusterState &&other) noexcept;
+  ~CoordinatorClusterState() = default;
+
+  auto FindCurrentMainInstanceName() const -> std::optional<std::string>;
+
+  auto MainExists() const -> bool;
+
+  auto IsMain(std::string_view instance_name) const -> bool;
+
+  auto IsReplica(std::string_view instance_name) const -> bool;
+
+  auto InsertInstance(std::string instance_name, InstanceState instance_state) -> void;
+
+  auto DoAction(TRaftLog log_entry, RaftLogAction log_action) -> void;
+
+  auto Serialize(ptr<buffer> &data) -> void;
+
+  static auto Deserialize(buffer &data) -> CoordinatorClusterState;
+
+  auto GetInstances() const -> std::vector<InstanceState>;
+
+  auto GetUUID() const -> utils::UUID;
+
+ private:
+  std::map<std::string, InstanceState, std::less<>> instances_{};
+  // Current uuid of MAIN which other replicas listen too
+  utils::UUID uuid_{};
+  mutable utils::ResourceLock log_lock_{};
+};
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/include/nuraft/coordinator_state_machine.hpp

@@ -13,9 +13,15 @@
 
 #ifdef MG_ENTERPRISE
 
+#include "coordination/coordinator_config.hpp"
+#include "nuraft/coordinator_cluster_state.hpp"
+#include "nuraft/raft_log_action.hpp"
+
 #include <spdlog/spdlog.h>
 #include <libnuraft/nuraft.hxx>
 
+#include <variant>
+
 namespace memgraph::coordination {
 
 using nuraft::async_result;
@@ -36,9 +42,19 @@ class CoordinatorStateMachine : public state_machine {
   CoordinatorStateMachine &operator=(CoordinatorStateMachine &&) = delete;
   ~CoordinatorStateMachine() override {}
 
-  static auto EncodeRegisterReplicationInstance(const std::string &name) -> ptr<buffer>;
+  auto FindCurrentMainInstanceName() const -> std::optional<std::string>;
+  auto MainExists() const -> bool;
+  auto IsMain(std::string_view instance_name) const -> bool;
+  auto IsReplica(std::string_view instance_name) const -> bool;
 
-  static auto DecodeRegisterReplicationInstance(buffer &data) -> std::string;
+  static auto CreateLog(nlohmann::json &&log) -> ptr<buffer>;
+  static auto SerializeRegisterInstance(CoordinatorClientConfig const &config) -> ptr<buffer>;
+  static auto SerializeUnregisterInstance(std::string_view instance_name) -> ptr<buffer>;
+  static auto SerializeSetInstanceAsMain(std::string_view instance_name) -> ptr<buffer>;
+  static auto SerializeSetInstanceAsReplica(std::string_view instance_name) -> ptr<buffer>;
+  static auto SerializeUpdateUUID(utils::UUID const &uuid) -> ptr<buffer>;
+
+  static auto DecodeLog(buffer &data) -> std::pair<TRaftLog, RaftLogAction>;
 
   auto pre_commit(ulong log_idx, buffer &data) -> ptr<buffer> override;
 
@@ -64,11 +80,27 @@ class CoordinatorStateMachine : public state_machine {
 
   auto create_snapshot(snapshot &s, async_result<bool>::handler_type &when_done) -> void override;
 
+  auto GetInstances() const -> std::vector<InstanceState>;
+  auto GetUUID() const -> utils::UUID;
+
  private:
+  struct SnapshotCtx {
+    SnapshotCtx(ptr<snapshot> &snapshot, CoordinatorClusterState const &cluster_state)
+        : snapshot_(snapshot), cluster_state_(cluster_state) {}
+
+    ptr<snapshot> snapshot_;
+    CoordinatorClusterState cluster_state_;
+  };
+
+  auto create_snapshot_internal(ptr<snapshot> snapshot) -> void;
+
+  CoordinatorClusterState cluster_state_;
   std::atomic<uint64_t> last_committed_idx_{0};
 
-  ptr<snapshot> last_snapshot_;
+  std::map<uint64_t, ptr<SnapshotCtx>> snapshots_;
+  std::mutex snapshots_lock_;
 
+  ptr<snapshot> last_snapshot_;
   std::mutex last_snapshot_lock_;
 };
 

src/coordination/include/nuraft/raft_log_action.hpp

@@ -0,0 +1,42 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#ifdef MG_ENTERPRISE
+
+#include "coordination/coordinator_exceptions.hpp"
+
+#include <cstdint>
+#include <string>
+
+#include "json/json.hpp"
+
+namespace memgraph::coordination {
+
+enum class RaftLogAction : uint8_t {
+  REGISTER_REPLICATION_INSTANCE,
+  UNREGISTER_REPLICATION_INSTANCE,
+  SET_INSTANCE_AS_MAIN,
+  SET_INSTANCE_AS_REPLICA,
+  UPDATE_UUID
+};
+
+NLOHMANN_JSON_SERIALIZE_ENUM(RaftLogAction, {
+                                                {RaftLogAction::REGISTER_REPLICATION_INSTANCE, "register"},
+                                                {RaftLogAction::UNREGISTER_REPLICATION_INSTANCE, "unregister"},
+                                                {RaftLogAction::SET_INSTANCE_AS_MAIN, "promote"},
+                                                {RaftLogAction::SET_INSTANCE_AS_REPLICA, "demote"},
+                                                {RaftLogAction::UPDATE_UUID, "update_uuid"},
+                                            })
+
+}  // namespace memgraph::coordination
+#endif

src/coordination/raft_state.cpp

@@ -10,12 +10,11 @@
 // licenses/APL.txt.
 
 #ifdef MG_ENTERPRISE
+#include <chrono>
 
-#include "coordination/raft_state.hpp"
-
+#include "coordination/coordinator_config.hpp"
 #include "coordination/coordinator_exceptions.hpp"
-#include "nuraft/coordinator_state_machine.hpp"
-#include "nuraft/coordinator_state_manager.hpp"
+#include "coordination/raft_state.hpp"
 #include "utils/counter.hpp"
 
 namespace memgraph::coordination {
@@ -33,31 +32,35 @@ using raft_result = cmd_result<ptr<buffer>>;
 
 RaftState::RaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb, uint32_t raft_server_id,
                      uint32_t raft_port, std::string raft_address)
-    : raft_server_id_(raft_server_id),
-      raft_port_(raft_port),
-      raft_address_(std::move(raft_address)),
+    : raft_endpoint_(raft_address, raft_port),
+      raft_server_id_(raft_server_id),
       state_machine_(cs_new<CoordinatorStateMachine>()),
-      state_manager_(
-          cs_new<CoordinatorStateManager>(raft_server_id_, raft_address_ + ":" + std::to_string(raft_port_))),
+      state_manager_(cs_new<CoordinatorStateManager>(raft_server_id_, raft_endpoint_.SocketAddress())),
       logger_(nullptr),
       become_leader_cb_(std::move(become_leader_cb)),
       become_follower_cb_(std::move(become_follower_cb)) {}
 
 auto RaftState::InitRaftServer() -> void {
   asio_service::options asio_opts;
-  asio_opts.thread_pool_size_ = 1;  // TODO: (andi) Improve this
+  asio_opts.thread_pool_size_ = 1;
 
   raft_params params;
   params.heart_beat_interval_ = 100;
   params.election_timeout_lower_bound_ = 200;
   params.election_timeout_upper_bound_ = 400;
-  // 5 logs are preserved before the last snapshot
   params.reserved_log_items_ = 5;
-  // Create snapshot for every 5 log appends
   params.snapshot_distance_ = 5;
   params.client_req_timeout_ = 3000;
   params.return_method_ = raft_params::blocking;
 
+  // If the leader doesn't receive any response from quorum nodes
+  // in 200ms, it will step down.
+  // This allows us to achieve strong consistency even if network partition
+  // happens between the current leader and followers.
+  // The value must be <= election_timeout_lower_bound_ so that cluster can never
+  // have multiple leaders.
+  params.leadership_expiry_ = 200;
+
   raft_server::init_options init_opts;
   init_opts.raft_callback_ = [this](cb_func::Type event_type, cb_func::Param *param) -> nuraft::CbReturnCode {
     if (event_type == cb_func::BecomeLeader) {
@@ -72,11 +75,11 @@ auto RaftState::InitRaftServer() -> void {
 
   raft_launcher launcher;
 
-  raft_server_ = launcher.init(state_machine_, state_manager_, logger_, static_cast<int>(raft_port_), asio_opts, params,
-                               init_opts);
+  raft_server_ =
+      launcher.init(state_machine_, state_manager_, logger_, raft_endpoint_.port, asio_opts, params, init_opts);
 
   if (!raft_server_) {
-    throw RaftServerStartException("Failed to launch raft server on {}:{}", raft_address_, raft_port_);
+    throw RaftServerStartException("Failed to launch raft server on {}", raft_endpoint_.SocketAddress());
   }
 
   auto maybe_stop = utils::ResettableCounter<20>();
@@ -87,38 +90,61 @@ auto RaftState::InitRaftServer() -> void {
     std::this_thread::sleep_for(std::chrono::milliseconds(250));
   } while (!maybe_stop());
 
-  throw RaftServerStartException("Failed to initialize raft server on {}:{}", raft_address_, raft_port_);
+  throw RaftServerStartException("Failed to initialize raft server on {}", raft_endpoint_.SocketAddress());
 }
 
-auto RaftState::MakeRaftState(BecomeLeaderCb become_leader_cb, BecomeFollowerCb become_follower_cb) -> RaftState {
-  uint32_t raft_server_id{0};
-  uint32_t raft_port{0};
-  try {
-    raft_server_id = FLAGS_raft_server_id;
-    raft_port = FLAGS_raft_server_port;
-  } catch (std::exception const &e) {
-    throw RaftCouldNotParseFlagsException("Failed to parse flags: {}", e.what());
-  }
+auto RaftState::MakeRaftState(BecomeLeaderCb &&become_leader_cb, BecomeFollowerCb &&become_follower_cb) -> RaftState {
+  uint32_t raft_server_id = FLAGS_raft_server_id;
+  uint32_t raft_port = FLAGS_raft_server_port;
 
   auto raft_state =
       RaftState(std::move(become_leader_cb), std::move(become_follower_cb), raft_server_id, raft_port, "127.0.0.1");
+
   raft_state.InitRaftServer();
   return raft_state;
 }
 
 RaftState::~RaftState() { launcher_.shutdown(); }
 
-auto RaftState::InstanceName() const -> std::string { return "coordinator_" + std::to_string(raft_server_id_); }
+auto RaftState::InstanceName() const -> std::string {
+  return fmt::format("coordinator_{}", std::to_string(raft_server_id_));
+}
 
-auto RaftState::RaftSocketAddress() const -> std::string { return raft_address_ + ":" + std::to_string(raft_port_); }
+auto RaftState::RaftSocketAddress() const -> std::string { return raft_endpoint_.SocketAddress(); }
 
-auto RaftState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void {
-  auto const endpoint = raft_address + ":" + std::to_string(raft_port);
+auto RaftState::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string_view raft_address)
+    -> void {
+  auto const endpoint = fmt::format("{}:{}", raft_address, raft_port);
   srv_config const srv_config_to_add(static_cast<int>(raft_server_id), endpoint);
-  if (!raft_server_->add_srv(srv_config_to_add)->get_accepted()) {
-    throw RaftAddServerException("Failed to add server {} to the cluster", endpoint);
+
+  auto cmd_result = raft_server_->add_srv(srv_config_to_add);
+
+  if (cmd_result->get_result_code() == nuraft::cmd_result_code::OK) {
+    spdlog::info("Request to add server {} to the cluster accepted", endpoint);
+  } else {
+    throw RaftAddServerException("Failed to accept request to add server {} to the cluster with error code {}",
+                                 endpoint, cmd_result->get_result_code());
+  }
+
+  // Waiting for server to join
+  constexpr int max_tries{10};
+  auto maybe_stop = utils::ResettableCounter<max_tries>();
+  constexpr int waiting_period{200};
+  bool added{false};
+  while (!maybe_stop()) {
+    std::this_thread::sleep_for(std::chrono::milliseconds(waiting_period));
+    const auto server_config = raft_server_->get_srv_config(static_cast<nuraft::int32>(raft_server_id));
+    if (server_config) {
+      spdlog::trace("Server with id {} added to cluster", raft_server_id);
+      added = true;
+      break;
+    }
+  }
+
+  if (!added) {
+    throw RaftAddServerException("Failed to add server {} to the cluster in {}ms", endpoint,
+                                 max_tries * waiting_period);
   }
-  spdlog::info("Request to add server {} to the cluster accepted", endpoint);
 }
 
 auto RaftState::GetAllCoordinators() const -> std::vector<ptr<srv_config>> {
@@ -131,10 +157,123 @@ auto RaftState::IsLeader() const -> bool { return raft_server_->is_leader(); }
 
 auto RaftState::RequestLeadership() -> bool { return raft_server_->is_leader() || raft_server_->request_leadership(); }
 
-auto RaftState::AppendRegisterReplicationInstance(std::string const &instance) -> ptr<raft_result> {
-  auto new_log = CoordinatorStateMachine::EncodeRegisterReplicationInstance(instance);
-  return raft_server_->append_entries({new_log});
+auto RaftState::AppendRegisterReplicationInstanceLog(CoordinatorClientConfig const &config) -> bool {
+  auto new_log = CoordinatorStateMachine::SerializeRegisterInstance(config);
+  auto const res = raft_server_->append_entries({new_log});
+
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for registering instance {}. Most likely the reason is that the instance is not "
+        "the "
+        "leader.",
+        config.instance_name);
+    return false;
+  }
+
+  spdlog::info("Request for registering instance {} accepted", config.instance_name);
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to register instance {} with error code {}", config.instance_name, res->get_result_code());
+    return false;
+  }
+
+  return true;
 }
 
+auto RaftState::AppendUnregisterReplicationInstanceLog(std::string_view instance_name) -> bool {
+  auto new_log = CoordinatorStateMachine::SerializeUnregisterInstance(instance_name);
+  auto const res = raft_server_->append_entries({new_log});
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for unregistering instance {}. Most likely the reason is that the instance is not "
+        "the leader.",
+        instance_name);
+    return false;
+  }
+
+  spdlog::info("Request for unregistering instance {} accepted", instance_name);
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to unregister instance {} with error code {}", instance_name, res->get_result_code());
+    return false;
+  }
+  return true;
+}
+
+auto RaftState::AppendSetInstanceAsMainLog(std::string_view instance_name) -> bool {
+  auto new_log = CoordinatorStateMachine::SerializeSetInstanceAsMain(instance_name);
+  auto const res = raft_server_->append_entries({new_log});
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for promoting instance {}. Most likely the reason is that the instance is not "
+        "the leader.",
+        instance_name);
+    return false;
+  }
+
+  spdlog::info("Request for promoting instance {} accepted", instance_name);
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to promote instance {} with error code {}", instance_name, res->get_result_code());
+    return false;
+  }
+  return true;
+}
+
+auto RaftState::AppendSetInstanceAsReplicaLog(std::string_view instance_name) -> bool {
+  auto new_log = CoordinatorStateMachine::SerializeSetInstanceAsReplica(instance_name);
+  auto const res = raft_server_->append_entries({new_log});
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for demoting instance {}. Most likely the reason is that the instance is not "
+        "the leader.",
+        instance_name);
+    return false;
+  }
+  spdlog::info("Request for demoting instance {} accepted", instance_name);
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to promote instance {} with error code {}", instance_name, res->get_result_code());
+    return false;
+  }
+
+  return true;
+}
+
+auto RaftState::AppendUpdateUUIDLog(utils::UUID const &uuid) -> bool {
+  auto new_log = CoordinatorStateMachine::SerializeUpdateUUID(uuid);
+  auto const res = raft_server_->append_entries({new_log});
+  if (!res->get_accepted()) {
+    spdlog::error(
+        "Failed to accept request for updating UUID. Most likely the reason is that the instance is not "
+        "the leader.");
+    return false;
+  }
+  spdlog::info("Request for updating UUID accepted");
+
+  if (res->get_result_code() != nuraft::cmd_result_code::OK) {
+    spdlog::error("Failed to update UUID with error code {}", res->get_result_code());
+    return false;
+  }
+
+  return true;
+}
+
+auto RaftState::FindCurrentMainInstanceName() const -> std::optional<std::string> {
+  return state_machine_->FindCurrentMainInstanceName();
+}
+
+auto RaftState::MainExists() const -> bool { return state_machine_->MainExists(); }
+
+auto RaftState::IsMain(std::string_view instance_name) const -> bool { return state_machine_->IsMain(instance_name); }
+
+auto RaftState::IsReplica(std::string_view instance_name) const -> bool {
+  return state_machine_->IsReplica(instance_name);
+}
+
+auto RaftState::GetInstances() const -> std::vector<InstanceState> { return state_machine_->GetInstances(); }
+
+auto RaftState::GetUUID() const -> utils::UUID { return state_machine_->GetUUID(); }
+
 }  // namespace memgraph::coordination
 #endif

src/coordination/replication_instance.cpp

@@ -13,21 +13,20 @@
 
 #include "coordination/replication_instance.hpp"
 
+#include <utility>
+
 #include "replication_coordination_glue/handler.hpp"
 #include "utils/result.hpp"
 
 namespace memgraph::coordination {
 
 ReplicationInstance::ReplicationInstance(CoordinatorInstance *peer, CoordinatorClientConfig config,
-                                         HealthCheckCallback succ_cb, HealthCheckCallback fail_cb)
+                                         HealthCheckClientCallback succ_cb, HealthCheckClientCallback fail_cb,
+                                         HealthCheckInstanceCallback succ_instance_cb,
+                                         HealthCheckInstanceCallback fail_instance_cb)
     : client_(peer, std::move(config), std::move(succ_cb), std::move(fail_cb)),
-      replication_role_(replication_coordination_glue::ReplicationRole::REPLICA) {
-  if (!client_.DemoteToReplica()) {
-    throw CoordinatorRegisterInstanceException("Failed to demote instance {} to replica", client_.InstanceName());
-  }
-
-  client_.StartFrequentCheck();
-}
+      succ_cb_(succ_instance_cb),
+      fail_cb_(fail_instance_cb) {}
 
 auto ReplicationInstance::OnSuccessPing() -> void {
   last_response_time_ = std::chrono::system_clock::now();
@@ -46,37 +45,34 @@ auto ReplicationInstance::IsReadyForUUIDPing() -> bool {
 }
 
 auto ReplicationInstance::InstanceName() const -> std::string { return client_.InstanceName(); }
-auto ReplicationInstance::SocketAddress() const -> std::string { return client_.SocketAddress(); }
+auto ReplicationInstance::CoordinatorSocketAddress() const -> std::string { return client_.CoordinatorSocketAddress(); }
+auto ReplicationInstance::ReplicationSocketAddress() const -> std::string { return client_.ReplicationSocketAddress(); }
 auto ReplicationInstance::IsAlive() const -> bool { return is_alive_; }
 
-auto ReplicationInstance::IsReplica() const -> bool {
-  return replication_role_ == replication_coordination_glue::ReplicationRole::REPLICA;
-}
-auto ReplicationInstance::IsMain() const -> bool {
-  return replication_role_ == replication_coordination_glue::ReplicationRole::MAIN;
-}
-
-auto ReplicationInstance::PromoteToMain(utils::UUID new_uuid, ReplicationClientsInfo repl_clients_info,
-                                        HealthCheckCallback main_succ_cb, HealthCheckCallback main_fail_cb) -> bool {
+auto ReplicationInstance::PromoteToMain(utils::UUID const &new_uuid, ReplicationClientsInfo repl_clients_info,
+                                        HealthCheckInstanceCallback main_succ_cb,
+                                        HealthCheckInstanceCallback main_fail_cb) -> bool {
   if (!client_.SendPromoteReplicaToMainRpc(new_uuid, std::move(repl_clients_info))) {
     return false;
   }
 
-  replication_role_ = replication_coordination_glue::ReplicationRole::MAIN;
   main_uuid_ = new_uuid;
-  client_.SetCallbacks(std::move(main_succ_cb), std::move(main_fail_cb));
+  succ_cb_ = main_succ_cb;
+  fail_cb_ = main_fail_cb;
 
   return true;
 }
 
-auto ReplicationInstance::DemoteToReplica(HealthCheckCallback replica_succ_cb, HealthCheckCallback replica_fail_cb)
-    -> bool {
+auto ReplicationInstance::SendDemoteToReplicaRpc() -> bool { return client_.DemoteToReplica(); }
+
+auto ReplicationInstance::DemoteToReplica(HealthCheckInstanceCallback replica_succ_cb,
+                                          HealthCheckInstanceCallback replica_fail_cb) -> bool {
   if (!client_.DemoteToReplica()) {
     return false;
   }
 
-  replication_role_ = replication_coordination_glue::ReplicationRole::REPLICA;
-  client_.SetCallbacks(std::move(replica_succ_cb), std::move(replica_fail_cb));
+  succ_cb_ = replica_succ_cb;
+  fail_cb_ = replica_fail_cb;
 
   return true;
 }
@@ -90,10 +86,12 @@ auto ReplicationInstance::ReplicationClientInfo() const -> CoordinatorClientConf
   return client_.ReplicationClientInfo();
 }
 
+auto ReplicationInstance::GetSuccessCallback() -> HealthCheckInstanceCallback & { return succ_cb_; }
+auto ReplicationInstance::GetFailCallback() -> HealthCheckInstanceCallback & { return fail_cb_; }
+
 auto ReplicationInstance::GetClient() -> CoordinatorClient & { return client_; }
 
 auto ReplicationInstance::SetNewMainUUID(utils::UUID const &main_uuid) -> void { main_uuid_ = main_uuid; }
-auto ReplicationInstance::ResetMainUUID() -> void { main_uuid_ = std::nullopt; }
 auto ReplicationInstance::GetMainUUID() const -> std::optional<utils::UUID> const & { return main_uuid_; }
 
 auto ReplicationInstance::EnsureReplicaHasCorrectMainUUID(utils::UUID const &curr_main_uuid) -> bool {
@@ -106,6 +104,7 @@ auto ReplicationInstance::EnsureReplicaHasCorrectMainUUID(utils::UUID const &cur
   }
   UpdateReplicaLastResponseUUID();
 
+  // NOLINTNEXTLINE
   if (res.GetValue().has_value() && res.GetValue().value() == curr_main_uuid) {
     return true;
   }
@@ -113,7 +112,7 @@ auto ReplicationInstance::EnsureReplicaHasCorrectMainUUID(utils::UUID const &cur
   return SendSwapAndUpdateUUID(curr_main_uuid);
 }
 
-auto ReplicationInstance::SendSwapAndUpdateUUID(const utils::UUID &new_main_uuid) -> bool {
+auto ReplicationInstance::SendSwapAndUpdateUUID(utils::UUID const &new_main_uuid) -> bool {
   if (!replication_coordination_glue::SendSwapMainUUIDRpc(client_.RpcClient(), new_main_uuid)) {
     return false;
   }
@@ -121,7 +120,7 @@ auto ReplicationInstance::SendSwapAndUpdateUUID(const utils::UUID &new_main_uuid
   return true;
 }
 
-auto ReplicationInstance::SendUnregisterReplicaRpc(std::string const &instance_name) -> bool {
+auto ReplicationInstance::SendUnregisterReplicaRpc(std::string_view instance_name) -> bool {
   return client_.SendUnregisterReplicaRpc(instance_name);
 }
 

src/dbms/coordinator_handler.cpp

@@ -20,28 +20,28 @@ namespace memgraph::dbms {
 CoordinatorHandler::CoordinatorHandler(coordination::CoordinatorState &coordinator_state)
     : coordinator_state_(coordinator_state) {}
 
-auto CoordinatorHandler::RegisterReplicationInstance(memgraph::coordination::CoordinatorClientConfig config)
+auto CoordinatorHandler::RegisterReplicationInstance(coordination::CoordinatorClientConfig const &config)
     -> coordination::RegisterInstanceCoordinatorStatus {
   return coordinator_state_.RegisterReplicationInstance(config);
 }
 
-auto CoordinatorHandler::UnregisterReplicationInstance(std::string instance_name)
+auto CoordinatorHandler::UnregisterReplicationInstance(std::string_view instance_name)
     -> coordination::UnregisterInstanceCoordinatorStatus {
-  return coordinator_state_.UnregisterReplicationInstance(std::move(instance_name));
+  return coordinator_state_.UnregisterReplicationInstance(instance_name);
 }
 
-auto CoordinatorHandler::SetReplicationInstanceToMain(std::string instance_name)
+auto CoordinatorHandler::SetReplicationInstanceToMain(std::string_view instance_name)
     -> coordination::SetInstanceToMainCoordinatorStatus {
-  return coordinator_state_.SetReplicationInstanceToMain(std::move(instance_name));
+  return coordinator_state_.SetReplicationInstanceToMain(instance_name);
 }
 
 auto CoordinatorHandler::ShowInstances() const -> std::vector<coordination::InstanceStatus> {
   return coordinator_state_.ShowInstances();
 }
 
-auto CoordinatorHandler::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address)
-    -> void {
-  coordinator_state_.AddCoordinatorInstance(raft_server_id, raft_port, std::move(raft_address));
+auto CoordinatorHandler::AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port,
+                                                std::string_view raft_address) -> void {
+  coordinator_state_.AddCoordinatorInstance(raft_server_id, raft_port, raft_address);
 }
 
 }  // namespace memgraph::dbms

src/dbms/coordinator_handler.hpp

@@ -30,16 +30,17 @@ class CoordinatorHandler {
 
   // TODO: (andi) When moving coordinator state on same instances, rename from RegisterReplicationInstance to
   // RegisterInstance
-  auto RegisterReplicationInstance(coordination::CoordinatorClientConfig config)
+  auto RegisterReplicationInstance(coordination::CoordinatorClientConfig const &config)
       -> coordination::RegisterInstanceCoordinatorStatus;
 
-  auto UnregisterReplicationInstance(std::string instance_name) -> coordination::UnregisterInstanceCoordinatorStatus;
+  auto UnregisterReplicationInstance(std::string_view instance_name)
+      -> coordination::UnregisterInstanceCoordinatorStatus;
 
-  auto SetReplicationInstanceToMain(std::string instance_name) -> coordination::SetInstanceToMainCoordinatorStatus;
+  auto SetReplicationInstanceToMain(std::string_view instance_name) -> coordination::SetInstanceToMainCoordinatorStatus;
 
   auto ShowInstances() const -> std::vector<coordination::InstanceStatus>;
 
-  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string raft_address) -> void;
+  auto AddCoordinatorInstance(uint32_t raft_server_id, uint32_t raft_port, std::string_view raft_address) -> void;
 
  private:
   coordination::CoordinatorState &coordinator_state_;

src/dbms/database.hpp

@@ -110,9 +110,9 @@ class Database {
    * @param force_directory Use the configured directory, do not try to decipher the multi-db version
    * @return DatabaseInfo
    */
-  DatabaseInfo GetInfo(bool force_directory, replication_coordination_glue::ReplicationRole replication_role) const {
+  DatabaseInfo GetInfo(replication_coordination_glue::ReplicationRole replication_role) const {
     DatabaseInfo info;
-    info.storage_info = storage_->GetInfo(force_directory, replication_role);
+    info.storage_info = storage_->GetInfo(replication_role);
     info.triggers = trigger_store_.GetTriggerInfo().size();
     info.streams = streams_.GetStreamInfo().size();
     return info;

src/dbms/database_handler.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source

src/dbms/dbms_handler.cpp

@@ -185,6 +185,16 @@ DbmsHandler::DbmsHandler(storage::Config config, replication::ReplicationState &
   auto directories = std::set{std::string{kDefaultDB}};
 
   // Recover previous databases
+  if (flags::AreExperimentsEnabled(flags::Experiments::SYSTEM_REPLICATION) && !recovery_on_startup) {
+    // This will result in dropping databases on SystemRecoveryHandler
+    // for MT case, and for single DB case we might not even set replication as commit timestamp is checked
+    spdlog::warn(
+        "Data recovery on startup not set, this will result in dropping database in case of multi-tenancy enabled.");
+  }
+
+  // TODO: Problem is if user doesn't set this up "database" name won't be recovered
+  // but if storage-recover-on-startup is true storage will be recovered which is an issue
+  spdlog::info("Data recovery on startup set to {}", recovery_on_startup);
   if (recovery_on_startup) {
     auto it = durability_->begin(std::string(kDBPrefix));
     auto end = durability_->end(std::string(kDBPrefix));
@@ -410,9 +420,10 @@ void DbmsHandler::UpdateDurability(const storage::Config &config, std::optional<
   if (!durability_) return;
   // Save database in a list of active databases
   const auto &key = Durability::GenKey(config.salient.name);
-  if (rel_dir == std::nullopt)
+  if (rel_dir == std::nullopt) {
     rel_dir =
         std::filesystem::relative(config.durability.storage_directory, default_config_.durability.storage_directory);
+  }
   const auto &val = Durability::GenVal(config.salient.uuid, *rel_dir);
   durability_->Put(key, val);
 }

src/dbms/dbms_handler.hpp

@@ -155,6 +155,8 @@ class DbmsHandler {
     spdlog::debug("Trying to create db '{}' on replica which already exists.", config.name);
 
     auto db = Get_(config.name);
+    spdlog::debug("Aligning database with name {} which has UUID {}, where config UUID is {}", config.name,
+                  std::string(db->uuid()), std::string(config.uuid));
     if (db->uuid() == config.uuid) {  // Same db
       return db;
     }
@@ -163,18 +165,22 @@ class DbmsHandler {
 
     // TODO: Fix this hack
     if (config.name == kDefaultDB) {
+      spdlog::debug("Last commit timestamp for DB {} is {}", kDefaultDB,
+                    db->storage()->repl_storage_state_.last_commit_timestamp_);
+      // This seems correct, if database made progress
       if (db->storage()->repl_storage_state_.last_commit_timestamp_ != storage::kTimestampInitialId) {
         spdlog::debug("Default storage is not clean, cannot update UUID...");
         return NewError::GENERIC;  // Update error
       }
-      spdlog::debug("Update default db's UUID");
+      spdlog::debug("Updated default db's UUID");
       // Default db cannot be deleted and remade, have to just update the UUID
       db->storage()->config_.salient.uuid = config.uuid;
       UpdateDurability(db->storage()->config_, ".");
       return db;
     }
 
-    spdlog::debug("Drop database and recreate with the correct UUID");
+    spdlog::debug("Dropping database {} with UUID: {} and recreating with the correct UUID: {}", config.name,
+                  std::string(db->uuid()), std::string(config.uuid));
     // Defer drop
     (void)Delete_(db->name());
     // Second attempt
@@ -266,10 +272,6 @@ class DbmsHandler {
   bool IsMain() const { return repl_state_.IsMain(); }
   bool IsReplica() const { return repl_state_.IsReplica(); }
 
-#ifdef MG_ENTERPRISE
-  // coordination::CoordinatorState &CoordinatorState() { return coordinator_state_; }
-#endif
-
   /**
    * @brief Return all active databases.
    *
@@ -302,7 +304,7 @@ class DbmsHandler {
       auto db_acc_opt = db_gk.access();
       if (db_acc_opt) {
         auto &db_acc = *db_acc_opt;
-        const auto &info = db_acc->GetInfo(false, replication_role);
+        const auto &info = db_acc->GetInfo(replication_role);
         const auto &storage_info = info.storage_info;
         stats.num_vertex += storage_info.vertex_count;
         stats.num_edges += storage_info.edge_count;
@@ -338,7 +340,7 @@ class DbmsHandler {
       auto db_acc_opt = db_gk.access();
       if (db_acc_opt) {
         auto &db_acc = *db_acc_opt;
-        res.push_back(db_acc->GetInfo(false, replication_role));
+        res.push_back(db_acc->GetInfo(replication_role));
       }
     }
     return res;

src/dbms/inmemory/replication_handlers.cpp

@@ -19,7 +19,6 @@
 #include "storage/v2/durability/durability.hpp"
 #include "storage/v2/durability/snapshot.hpp"
 #include "storage/v2/durability/version.hpp"
-#include "storage/v2/fmt.hpp"
 #include "storage/v2/indices/label_index_stats.hpp"
 #include "storage/v2/inmemory/storage.hpp"
 #include "storage/v2/inmemory/unique_constraints.hpp"
@@ -119,9 +118,14 @@ void InMemoryReplicationHandlers::Register(dbms::DbmsHandler *dbms_handler, repl
       });
   server.rpc_server_.Register<replication_coordination_glue::SwapMainUUIDRpc>(
       [&data, dbms_handler](auto *req_reader, auto *res_builder) {
-        spdlog::debug("Received SwapMainUUIDHandler");
+        spdlog::debug("Received SwapMainUUIDRpc");
         InMemoryReplicationHandlers::SwapMainUUIDHandler(dbms_handler, data, req_reader, res_builder);
       });
+  server.rpc_server_.Register<storage::replication::ForceResetStorageRpc>(
+      [&data, dbms_handler](auto *req_reader, auto *res_builder) {
+        spdlog::debug("Received ForceResetStorageRpc");
+        InMemoryReplicationHandlers::ForceResetStorageHandler(dbms_handler, data.uuid_, req_reader, res_builder);
+      });
 }
 
 void InMemoryReplicationHandlers::SwapMainUUIDHandler(dbms::DbmsHandler *dbms_handler,
@@ -135,7 +139,7 @@ void InMemoryReplicationHandlers::SwapMainUUIDHandler(dbms::DbmsHandler *dbms_ha
 
   replication_coordination_glue::SwapMainUUIDReq req;
   slk::Load(&req, req_reader);
-  spdlog::info(fmt::format("Set replica data UUID  to main uuid {}", std::string(req.uuid)));
+  spdlog::info("Set replica data UUID  to main uuid {}", std::string(req.uuid));
   dbms_handler->ReplicationState().TryPersistRoleReplica(role_replica_data.config, req.uuid);
   role_replica_data.uuid_ = req.uuid;
 
@@ -330,6 +334,78 @@ void InMemoryReplicationHandlers::SnapshotHandler(dbms::DbmsHandler *dbms_handle
   spdlog::debug("Replication recovery from snapshot finished!");
 }
 
+void InMemoryReplicationHandlers::ForceResetStorageHandler(dbms::DbmsHandler *dbms_handler,
+                                                           const std::optional<utils::UUID> &current_main_uuid,
+                                                           slk::Reader *req_reader, slk::Builder *res_builder) {
+  storage::replication::ForceResetStorageReq req;
+  slk::Load(&req, req_reader);
+  auto db_acc = GetDatabaseAccessor(dbms_handler, req.db_uuid);
+  if (!db_acc) {
+    storage::replication::ForceResetStorageRes res{false, 0};
+    slk::Save(res, res_builder);
+    return;
+  }
+  if (!current_main_uuid.has_value() || req.main_uuid != current_main_uuid) [[unlikely]] {
+    LogWrongMain(current_main_uuid, req.main_uuid, storage::replication::SnapshotReq::kType.name);
+    storage::replication::ForceResetStorageRes res{false, 0};
+    slk::Save(res, res_builder);
+    return;
+  }
+
+  storage::replication::Decoder decoder(req_reader);
+
+  auto *storage = static_cast<storage::InMemoryStorage *>(db_acc->get()->storage());
+
+  auto storage_guard = std::unique_lock{storage->main_lock_};
+
+  // Clear the database
+  storage->vertices_.clear();
+  storage->edges_.clear();
+  storage->commit_log_.reset();
+  storage->commit_log_.emplace();
+
+  storage->constraints_.existence_constraints_ = std::make_unique<storage::ExistenceConstraints>();
+  storage->constraints_.unique_constraints_ = std::make_unique<storage::InMemoryUniqueConstraints>();
+  storage->indices_.label_index_ = std::make_unique<storage::InMemoryLabelIndex>();
+  storage->indices_.label_property_index_ = std::make_unique<storage::InMemoryLabelPropertyIndex>();
+
+  // Fine since we will force push when reading from WAL just random epoch with 0 timestamp, as it should be if it
+  // acted as MAIN before
+  storage->repl_storage_state_.epoch_.SetEpoch(std::string(utils::UUID{}));
+  storage->repl_storage_state_.last_commit_timestamp_ = 0;
+
+  storage->repl_storage_state_.history.clear();
+  storage->vertex_id_ = 0;
+  storage->edge_id_ = 0;
+  storage->timestamp_ = storage::kTimestampInitialId;
+
+  storage->CollectGarbage<true>(std::move(storage_guard), false);
+  storage->vertices_.run_gc();
+  storage->edges_.run_gc();
+
+  storage::replication::ForceResetStorageRes res{true, storage->repl_storage_state_.last_commit_timestamp_.load()};
+  slk::Save(res, res_builder);
+
+  spdlog::trace("Deleting old snapshot files.");
+  // Delete other durability files
+  auto snapshot_files = storage::durability::GetSnapshotFiles(storage->recovery_.snapshot_directory_, storage->uuid_);
+  for (const auto &[path, uuid, _] : snapshot_files) {
+    spdlog::trace("Deleting snapshot file {}", path);
+    storage->file_retainer_.DeleteFile(path);
+  }
+
+  spdlog::trace("Deleting old WAL files.");
+  auto wal_files = storage::durability::GetWalFiles(storage->recovery_.wal_directory_, storage->uuid_);
+  if (wal_files) {
+    for (const auto &wal_file : *wal_files) {
+      spdlog::trace("Deleting WAL file {}", wal_file.path);
+      storage->file_retainer_.DeleteFile(wal_file.path);
+    }
+
+    storage->wal_file_.reset();
+  }
+}
+
 void InMemoryReplicationHandlers::WalFilesHandler(dbms::DbmsHandler *dbms_handler,
                                                   const std::optional<utils::UUID> &current_main_uuid,
                                                   slk::Reader *req_reader, slk::Builder *res_builder) {
@@ -764,6 +840,20 @@ uint64_t InMemoryReplicationHandlers::ReadAndApplyDelta(storage::InMemoryStorage
         transaction->DeleteLabelPropertyIndexStats(storage->NameToLabel(info.label));
         break;
       }
+      case WalDeltaData::Type::EDGE_INDEX_CREATE: {
+        spdlog::trace("       Create edge index on :{}", delta.operation_edge_type.edge_type);
+        auto *transaction = get_transaction(timestamp, kUniqueAccess);
+        if (transaction->CreateIndex(storage->NameToEdgeType(delta.operation_label.label)).HasError())
+          throw utils::BasicException("Invalid transaction! Please raise an issue, {}:{}", __FILE__, __LINE__);
+        break;
+      }
+      case WalDeltaData::Type::EDGE_INDEX_DROP: {
+        spdlog::trace("       Drop edge index on :{}", delta.operation_edge_type.edge_type);
+        auto *transaction = get_transaction(timestamp, kUniqueAccess);
+        if (transaction->DropIndex(storage->NameToEdgeType(delta.operation_label.label)).HasError())
+          throw utils::BasicException("Invalid transaction! Please raise an issue, {}:{}", __FILE__, __LINE__);
+        break;
+      }
       case WalDeltaData::Type::EXISTENCE_CONSTRAINT_CREATE: {
         spdlog::trace("       Create existence constraint on :{} ({})", delta.operation_label_property.label,
                       delta.operation_label_property.property);

src/dbms/inmemory/replication_handlers.hpp

@@ -48,6 +48,9 @@ class InMemoryReplicationHandlers {
 
   static void SwapMainUUIDHandler(dbms::DbmsHandler *dbms_handler, replication::RoleReplicaData &role_replica_data,
                                   slk::Reader *req_reader, slk::Builder *res_builder);
+  static void ForceResetStorageHandler(dbms::DbmsHandler *dbms_handler,
+                                       const std::optional<utils::UUID> &current_main_uuid, slk::Reader *req_reader,
+                                       slk::Builder *res_builder);
 
   static void LoadWal(storage::InMemoryStorage *storage, storage::replication::Decoder *decoder);
 

src/glue/CMakeLists.txt

@@ -6,5 +6,6 @@ target_sources(mg-glue PRIVATE auth.cpp
                                SessionHL.cpp
                                ServerT.cpp
                                MonitoringServerT.cpp
-                               run_id.cpp)
+                               run_id.cpp
+                               query_user.cpp)
 target_link_libraries(mg-glue mg-query mg-auth mg-audit mg-flags)

src/glue/SessionHL.cpp

@@ -11,6 +11,7 @@
 
 #include <optional>
 #include <utility>
+#include "auth/auth.hpp"
 #include "gflags/gflags.h"
 
 #include "audit/log.hpp"
@@ -19,17 +20,22 @@
 #include "glue/SessionHL.hpp"
 #include "glue/auth_checker.hpp"
 #include "glue/communication.hpp"
+#include "glue/query_user.hpp"
 #include "glue/run_id.hpp"
 #include "license/license.hpp"
+#include "query/auth_checker.hpp"
 #include "query/discard_value_stream.hpp"
 #include "query/interpreter_context.hpp"
+#include "query/query_user.hpp"
 #include "utils/event_map.hpp"
 #include "utils/spin_lock.hpp"
+#include "utils/variant_helpers.hpp"
 
 namespace memgraph::metrics {
 extern const Event ActiveBoltSessions;
 }  // namespace memgraph::metrics
 
+namespace {
 auto ToQueryExtras(const memgraph::communication::bolt::Value &extra) -> memgraph::query::QueryExtras {
   auto const &as_map = extra.ValueMap();
 
@@ -97,20 +103,24 @@ std::vector<memgraph::communication::bolt::Value> TypedValueResultStreamBase::De
   }
   return decoded_values;
 }
+
 TypedValueResultStreamBase::TypedValueResultStreamBase(memgraph::storage::Storage *storage) : storage_(storage) {}
 
-namespace memgraph::glue {
-
 #ifdef MG_ENTERPRISE
-inline static void MultiDatabaseAuth(const std::optional<auth::User> &user, std::string_view db) {
-  if (user && !AuthChecker::IsUserAuthorized(*user, {}, std::string(db))) {
+void MultiDatabaseAuth(memgraph::query::QueryUserOrRole *user, std::string_view db) {
+  if (user && !user->IsAuthorized({}, std::string(db), &memgraph::query::session_long_policy)) {
     throw memgraph::communication::bolt::ClientError(
         "You are not authorized on the database \"{}\"! Please contact your database administrator.", db);
   }
 }
+#endif
+}  // namespace
+namespace memgraph::glue {
+
+#ifdef MG_ENTERPRISE
 std::string SessionHL::GetDefaultDB() {
-  if (user_.has_value()) {
-    return user_->db_access().GetDefault();
+  if (user_or_role_) {
+    return user_or_role_->GetDefaultDB();
   }
   return std::string{memgraph::dbms::kDefaultDB};
 }
@@ -132,13 +142,18 @@ bool SessionHL::Authenticate(const std::string &username, const std::string &pas
   interpreter_.ResetUser();
   {
     auto locked_auth = auth_->Lock();
-    if (locked_auth->HasUsers()) {
-      user_ = locked_auth->Authenticate(username, password);
-      if (user_.has_value()) {
-        interpreter_.SetUser(user_->username());
+    if (locked_auth->AccessControlled()) {
+      const auto user_or_role = locked_auth->Authenticate(username, password);
+      if (user_or_role.has_value()) {
+        user_or_role_ = AuthChecker::GenQueryUser(auth_, *user_or_role);
+        interpreter_.SetUser(AuthChecker::GenQueryUser(auth_, *user_or_role));
       } else {
         res = false;
       }
+    } else {
+      // No access control -> give empty user
+      user_or_role_ = AuthChecker::GenQueryUser(auth_, std::nullopt);
+      interpreter_.SetUser(AuthChecker::GenQueryUser(auth_, std::nullopt));
     }
   }
 #ifdef MG_ENTERPRISE
@@ -195,21 +210,17 @@ std::pair<std::vector<std::string>, std::optional<int>> SessionHL::Interpret(
   }
 
 #ifdef MG_ENTERPRISE
-  const std::string *username{nullptr};
-  if (user_) {
-    username = &user_->username();
-  }
-
   if (memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     auto &db = interpreter_.current_db_.db_acc_;
-    audit_log_->Record(endpoint_.address().to_string(), user_ ? *username : "", query,
-                       memgraph::storage::PropertyValue(params_pv), db ? db->get()->name() : "no known database");
+    const auto username = user_or_role_ ? (user_or_role_->username() ? *user_or_role_->username() : "") : "";
+    audit_log_->Record(endpoint_.address().to_string(), username, query, memgraph::storage::PropertyValue(params_pv),
+                       db ? db->get()->name() : "no known database");
   }
 #endif
   try {
     auto result = interpreter_.Prepare(query, params_pv, ToQueryExtras(extra));
     const std::string db_name = result.db ? *result.db : "";
-    if (user_ && !AuthChecker::IsUserAuthorized(*user_, result.privileges, db_name)) {
+    if (user_or_role_ && !user_or_role_->IsAuthorized(result.privileges, db_name, &query::session_long_policy)) {
       interpreter_.Abort();
       if (db_name.empty()) {
         throw memgraph::communication::bolt::ClientError(
@@ -311,7 +322,7 @@ void SessionHL::Configure(const std::map<std::string, memgraph::communication::b
 
   // Check if the underlying database needs to be updated
   if (update) {
-    MultiDatabaseAuth(user_, db);
+    MultiDatabaseAuth(user_or_role_.get(), db);
     interpreter_.SetCurrentDB(db, in_explicit_db_);
   }
 #endif
@@ -338,7 +349,7 @@ SessionHL::SessionHL(memgraph::query::InterpreterContext *interpreter_context,
   // Metrics update
   memgraph::metrics::IncrementCounter(memgraph::metrics::ActiveBoltSessions);
 #ifdef MG_ENTERPRISE
-  interpreter_.OnChangeCB([&](std::string_view db_name) { MultiDatabaseAuth(user_, db_name); });
+  interpreter_.OnChangeCB([&](std::string_view db_name) { MultiDatabaseAuth(user_or_role_.get(), db_name); });
 #endif
   interpreter_context_->interpreters.WithLock([this](auto &interpreters) { interpreters.insert(&interpreter_); });
 }

src/glue/SessionHL.hpp

@@ -15,6 +15,7 @@
 #include "communication/v2/server.hpp"
 #include "communication/v2/session.hpp"
 #include "dbms/database.hpp"
+#include "glue/query_user.hpp"
 #include "query/interpreter.hpp"
 
 namespace memgraph::glue {
@@ -82,7 +83,7 @@ class SessionHL final : public memgraph::communication::bolt::Session<memgraph::
 
   memgraph::query::InterpreterContext *interpreter_context_;
   memgraph::query::Interpreter interpreter_;
-  std::optional<memgraph::auth::User> user_;
+  std::unique_ptr<query::QueryUserOrRole> user_or_role_;
 #ifdef MG_ENTERPRISE
   memgraph::audit::Log *audit_log_;
   bool in_explicit_db_{false};  //!< If true, the user has defined the database to use via metadata

src/glue/auth_checker.cpp

@@ -14,53 +14,74 @@
 #include "auth/auth.hpp"
 #include "auth/models.hpp"
 #include "glue/auth.hpp"
+#include "glue/query_user.hpp"
 #include "license/license.hpp"
+#include "query/auth_checker.hpp"
 #include "query/constants.hpp"
 #include "query/frontend/ast/ast.hpp"
+#include "query/query_user.hpp"
+#include "utils/logging.hpp"
 #include "utils/synchronized.hpp"
+#include "utils/variant_helpers.hpp"
 
 #ifdef MG_ENTERPRISE
 namespace {
-bool IsUserAuthorizedLabels(const memgraph::auth::User &user, const memgraph::query::DbAccessor *dba,
-                            const std::vector<memgraph::storage::LabelId> &labels,
-                            const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) {
+bool IsAuthorizedLabels(const memgraph::auth::UserOrRole &user_or_role, const memgraph::query::DbAccessor *dba,
+                        const std::vector<memgraph::storage::LabelId> &labels,
+                        const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return std::all_of(labels.begin(), labels.end(), [dba, &user, fine_grained_privilege](const auto &label) {
-    return user.GetFineGrainedAccessLabelPermissions().Has(
-               dba->LabelToName(label), memgraph::glue::FineGrainedPrivilegeToFineGrainedPermission(
-                                            fine_grained_privilege)) == memgraph::auth::PermissionLevel::GRANT;
+  return std::all_of(labels.begin(), labels.end(), [dba, &user_or_role, fine_grained_privilege](const auto &label) {
+    return std::visit(memgraph::utils::Overloaded{[&](auto &user_or_role) {
+                        return user_or_role.GetFineGrainedAccessLabelPermissions().Has(
+                                   dba->LabelToName(label), memgraph::glue::FineGrainedPrivilegeToFineGrainedPermission(
+                                                                fine_grained_privilege)) ==
+                               memgraph::auth::PermissionLevel::GRANT;
+                      }},
+                      user_or_role);
   });
 }
 
-bool IsUserAuthorizedGloballyLabels(const memgraph::auth::User &user,
-                                    const memgraph::auth::FineGrainedPermission fine_grained_permission) {
+bool IsAuthorizedGloballyLabels(const memgraph::auth::UserOrRole &user_or_role,
+                                const memgraph::auth::FineGrainedPermission fine_grained_permission) {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return user.GetFineGrainedAccessLabelPermissions().Has(memgraph::query::kAsterisk, fine_grained_permission) ==
-         memgraph::auth::PermissionLevel::GRANT;
+  return std::visit(memgraph::utils::Overloaded{[&](auto &user_or_role) {
+                      return user_or_role.GetFineGrainedAccessLabelPermissions().Has(memgraph::query::kAsterisk,
+                                                                                     fine_grained_permission) ==
+                             memgraph::auth::PermissionLevel::GRANT;
+                    }},
+                    user_or_role);
 }
 
-bool IsUserAuthorizedGloballyEdges(const memgraph::auth::User &user,
-                                   const memgraph::auth::FineGrainedPermission fine_grained_permission) {
+bool IsAuthorizedGloballyEdges(const memgraph::auth::UserOrRole &user_or_role,
+                               const memgraph::auth::FineGrainedPermission fine_grained_permission) {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return user.GetFineGrainedAccessEdgeTypePermissions().Has(memgraph::query::kAsterisk, fine_grained_permission) ==
-         memgraph::auth::PermissionLevel::GRANT;
+  return std::visit(memgraph::utils::Overloaded{[&](auto &user_or_role) {
+                      return user_or_role.GetFineGrainedAccessEdgeTypePermissions().Has(memgraph::query::kAsterisk,
+                                                                                        fine_grained_permission) ==
+                             memgraph::auth::PermissionLevel::GRANT;
+                    }},
+                    user_or_role);
 }
 
-bool IsUserAuthorizedEdgeType(const memgraph::auth::User &user, const memgraph::query::DbAccessor *dba,
-                              const memgraph::storage::EdgeTypeId &edgeType,
-                              const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) {
+bool IsAuthorizedEdgeType(const memgraph::auth::UserOrRole &user_or_role, const memgraph::query::DbAccessor *dba,
+                          const memgraph::storage::EdgeTypeId &edgeType,
+                          const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return user.GetFineGrainedAccessEdgeTypePermissions().Has(
-             dba->EdgeTypeToName(edgeType), memgraph::glue::FineGrainedPrivilegeToFineGrainedPermission(
-                                                fine_grained_privilege)) == memgraph::auth::PermissionLevel::GRANT;
+  return std::visit(memgraph::utils::Overloaded{[&](auto &user_or_role) {
+                      return user_or_role.GetFineGrainedAccessEdgeTypePermissions().Has(
+                                 dba->EdgeTypeToName(edgeType),
+                                 memgraph::glue::FineGrainedPrivilegeToFineGrainedPermission(fine_grained_privilege)) ==
+                             memgraph::auth::PermissionLevel::GRANT;
+                    }},
+                    user_or_role);
 }
 }  // namespace
 #endif
@@ -68,47 +89,54 @@ namespace memgraph::glue {
 
 AuthChecker::AuthChecker(memgraph::auth::SynchedAuth *auth) : auth_(auth) {}
 
-bool AuthChecker::IsUserAuthorized(const std::optional<std::string> &username,
-                                   const std::vector<memgraph::query::AuthQuery::Privilege> &privileges,
-                                   const std::string &db_name) const {
-  std::optional<memgraph::auth::User> maybe_user;
-  {
-    auto locked_auth = auth_->ReadLock();
-    if (!locked_auth->HasUsers()) {
-      return true;
-    }
-    if (username.has_value()) {
-      maybe_user = locked_auth->GetUser(*username);
-    }
+std::shared_ptr<query::QueryUserOrRole> AuthChecker::GenQueryUser(const std::optional<std::string> &username,
+                                                                  const std::optional<std::string> &rolename) const {
+  const auto user_or_role = auth_->ReadLock()->GetUserOrRole(username, rolename);
+  if (user_or_role) {
+    return std::make_shared<QueryUserOrRole>(auth_, *user_or_role);
   }
+  // No user or role
+  return std::make_shared<QueryUserOrRole>(auth_);
+}
 
-  return maybe_user.has_value() && IsUserAuthorized(*maybe_user, privileges, db_name);
+std::unique_ptr<query::QueryUserOrRole> AuthChecker::GenQueryUser(auth::SynchedAuth *auth,
+                                                                  const std::optional<auth::UserOrRole> &user_or_role) {
+  if (user_or_role) {
+    return std::visit(
+        utils::Overloaded{[&](auto &user_or_role) { return std::make_unique<QueryUserOrRole>(auth, user_or_role); }},
+        *user_or_role);
+  }
+  // No user or role
+  return std::make_unique<QueryUserOrRole>(auth);
 }
 
 #ifdef MG_ENTERPRISE
 std::unique_ptr<memgraph::query::FineGrainedAuthChecker> AuthChecker::GetFineGrainedAuthChecker(
-    const std::string &username, const memgraph::query::DbAccessor *dba) const {
+    std::shared_ptr<query::QueryUserOrRole> user_or_role, const memgraph::query::DbAccessor *dba) const {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return {};
   }
-  try {
-    auto user = user_.Lock();
-    if (username != user->username()) {
-      auto maybe_user = auth_->ReadLock()->GetUser(username);
-      if (!maybe_user) {
-        throw memgraph::query::QueryRuntimeException("User '{}' doesn't exist .", username);
-      }
-      *user = std::move(*maybe_user);
-    }
-    return std::make_unique<memgraph::glue::FineGrainedAuthChecker>(*user, dba);
-
-  } catch (const memgraph::auth::AuthException &e) {
-    throw memgraph::query::QueryRuntimeException(e.what());
+  if (!user_or_role || !*user_or_role) {
+    throw query::QueryRuntimeException("No user specified for fine grained authorization!");
   }
-}
 
-void AuthChecker::ClearCache() const {
-  user_.WithLock([](auto &user) mutable { user = {}; });
+  // Convert from query user to auth user or role
+  try {
+    auto glue_user = dynamic_cast<glue::QueryUserOrRole &>(*user_or_role);
+    if (glue_user.user_) {
+      return std::make_unique<glue::FineGrainedAuthChecker>(std::move(*glue_user.user_), dba);
+    }
+    if (glue_user.role_) {
+      return std::make_unique<glue::FineGrainedAuthChecker>(
+          auth::RoleWUsername{*glue_user.username(), std::move(*glue_user.role_)}, dba);
+    }
+    DMG_ASSERT(false, "Glue user has neither user not role");
+  } catch (std::bad_cast &e) {
+    DMG_ASSERT(false, "Using a non-glue user in glue...");
+  }
+
+  // Should never get here
+  return {};
 }
 #endif
 
@@ -116,7 +144,7 @@ bool AuthChecker::IsUserAuthorized(const memgraph::auth::User &user,
                                    const std::vector<memgraph::query::AuthQuery::Privilege> &privileges,
                                    const std::string &db_name) {  // NOLINT
 #ifdef MG_ENTERPRISE
-  if (!db_name.empty() && !user.db_access().Contains(db_name)) {
+  if (!db_name.empty() && !user.HasAccess(db_name)) {
     return false;
   }
 #endif
@@ -127,9 +155,34 @@ bool AuthChecker::IsUserAuthorized(const memgraph::auth::User &user,
   });
 }
 
+bool AuthChecker::IsRoleAuthorized(const memgraph::auth::Role &role,
+                                   const std::vector<memgraph::query::AuthQuery::Privilege> &privileges,
+                                   const std::string &db_name) {  // NOLINT
 #ifdef MG_ENTERPRISE
-FineGrainedAuthChecker::FineGrainedAuthChecker(auth::User user, const memgraph::query::DbAccessor *dba)
-    : user_{std::move(user)}, dba_(dba){};
+  if (!db_name.empty() && !role.HasAccess(db_name)) {
+    return false;
+  }
+#endif
+  const auto role_permissions = role.permissions();
+  return std::all_of(privileges.begin(), privileges.end(), [&role_permissions](const auto privilege) {
+    return role_permissions.Has(memgraph::glue::PrivilegeToPermission(privilege)) ==
+           memgraph::auth::PermissionLevel::GRANT;
+  });
+}
+
+bool AuthChecker::IsUserOrRoleAuthorized(const memgraph::auth::UserOrRole &user_or_role,
+                                         const std::vector<memgraph::query::AuthQuery::Privilege> &privileges,
+                                         const std::string &db_name) {
+  return std::visit(
+      utils::Overloaded{
+          [&](const auth::User &user) -> bool { return AuthChecker::IsUserAuthorized(user, privileges, db_name); },
+          [&](const auth::Role &role) -> bool { return AuthChecker::IsRoleAuthorized(role, privileges, db_name); }},
+      user_or_role);
+}
+
+#ifdef MG_ENTERPRISE
+FineGrainedAuthChecker::FineGrainedAuthChecker(auth::UserOrRole user_or_role, const memgraph::query::DbAccessor *dba)
+    : user_or_role_{std::move(user_or_role)}, dba_(dba){};
 
 bool FineGrainedAuthChecker::Has(const memgraph::query::VertexAccessor &vertex, const memgraph::storage::View view,
                                  const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const {
@@ -147,22 +200,22 @@ bool FineGrainedAuthChecker::Has(const memgraph::query::VertexAccessor &vertex,
     }
   }
 
-  return IsUserAuthorizedLabels(user_, dba_, *maybe_labels, fine_grained_privilege);
+  return IsAuthorizedLabels(user_or_role_, dba_, *maybe_labels, fine_grained_privilege);
 }
 
 bool FineGrainedAuthChecker::Has(const memgraph::query::EdgeAccessor &edge,
                                  const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const {
-  return IsUserAuthorizedEdgeType(user_, dba_, edge.EdgeType(), fine_grained_privilege);
+  return IsAuthorizedEdgeType(user_or_role_, dba_, edge.EdgeType(), fine_grained_privilege);
 }
 
 bool FineGrainedAuthChecker::Has(const std::vector<memgraph::storage::LabelId> &labels,
                                  const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const {
-  return IsUserAuthorizedLabels(user_, dba_, labels, fine_grained_privilege);
+  return IsAuthorizedLabels(user_or_role_, dba_, labels, fine_grained_privilege);
 }
 
 bool FineGrainedAuthChecker::Has(const memgraph::storage::EdgeTypeId &edge_type,
                                  const memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const {
-  return IsUserAuthorizedEdgeType(user_, dba_, edge_type, fine_grained_privilege);
+  return IsAuthorizedEdgeType(user_or_role_, dba_, edge_type, fine_grained_privilege);
 }
 
 bool FineGrainedAuthChecker::HasGlobalPrivilegeOnVertices(
@@ -170,7 +223,7 @@ bool FineGrainedAuthChecker::HasGlobalPrivilegeOnVertices(
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return IsUserAuthorizedGloballyLabels(user_, FineGrainedPrivilegeToFineGrainedPermission(fine_grained_privilege));
+  return IsAuthorizedGloballyLabels(user_or_role_, FineGrainedPrivilegeToFineGrainedPermission(fine_grained_privilege));
 }
 
 bool FineGrainedAuthChecker::HasGlobalPrivilegeOnEdges(
@@ -178,7 +231,7 @@ bool FineGrainedAuthChecker::HasGlobalPrivilegeOnEdges(
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast()) {
     return true;
   }
-  return IsUserAuthorizedGloballyEdges(user_, FineGrainedPrivilegeToFineGrainedPermission(fine_grained_privilege));
+  return IsAuthorizedGloballyEdges(user_or_role_, FineGrainedPrivilegeToFineGrainedPermission(fine_grained_privilege));
 };
 #endif
 }  // namespace memgraph::glue

src/glue/auth_checker.hpp

@@ -22,53 +22,59 @@ namespace memgraph::glue {
 
 class AuthChecker : public query::AuthChecker {
  public:
-  explicit AuthChecker(memgraph::auth::SynchedAuth *auth);
+  explicit AuthChecker(auth::SynchedAuth *auth);
 
-  bool IsUserAuthorized(const std::optional<std::string> &username,
-                        const std::vector<query::AuthQuery::Privilege> &privileges,
-                        const std::string &db_name) const override;
+  std::shared_ptr<query::QueryUserOrRole> GenQueryUser(const std::optional<std::string> &username,
+                                                       const std::optional<std::string> &rolename) const override;
+
+  static std::unique_ptr<query::QueryUserOrRole> GenQueryUser(auth::SynchedAuth *auth,
+                                                              const std::optional<auth::UserOrRole> &user_or_role);
 
 #ifdef MG_ENTERPRISE
-  std::unique_ptr<memgraph::query::FineGrainedAuthChecker> GetFineGrainedAuthChecker(
-      const std::string &username, const memgraph::query::DbAccessor *dba) const override;
-
-  void ClearCache() const override;
-
+  std::unique_ptr<query::FineGrainedAuthChecker> GetFineGrainedAuthChecker(std::shared_ptr<query::QueryUserOrRole> user,
+                                                                           const query::DbAccessor *dba) const override;
 #endif
-  [[nodiscard]] static bool IsUserAuthorized(const memgraph::auth::User &user,
-                                             const std::vector<memgraph::query::AuthQuery::Privilege> &privileges,
+
+  [[nodiscard]] static bool IsUserAuthorized(const auth::User &user,
+                                             const std::vector<query::AuthQuery::Privilege> &privileges,
                                              const std::string &db_name = "");
 
+  [[nodiscard]] static bool IsRoleAuthorized(const auth::Role &role,
+                                             const std::vector<query::AuthQuery::Privilege> &privileges,
+                                             const std::string &db_name = "");
+
+  [[nodiscard]] static bool IsUserOrRoleAuthorized(const auth::UserOrRole &user_or_role,
+                                                   const std::vector<query::AuthQuery::Privilege> &privileges,
+                                                   const std::string &db_name = "");
+
  private:
-  memgraph::auth::SynchedAuth *auth_;
-  mutable memgraph::utils::Synchronized<auth::User, memgraph::utils::SpinLock> user_;  // cached user
+  auth::SynchedAuth *auth_;
+  mutable utils::Synchronized<auth::UserOrRole, utils::SpinLock> user_or_role_;  // cached user
 };
 #ifdef MG_ENTERPRISE
 class FineGrainedAuthChecker : public query::FineGrainedAuthChecker {
  public:
-  explicit FineGrainedAuthChecker(auth::User user, const memgraph::query::DbAccessor *dba);
+  explicit FineGrainedAuthChecker(auth::UserOrRole user, const query::DbAccessor *dba);
 
-  bool Has(const query::VertexAccessor &vertex, memgraph::storage::View view,
+  bool Has(const query::VertexAccessor &vertex, storage::View view,
            query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
   bool Has(const query::EdgeAccessor &edge,
            query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
-  bool Has(const std::vector<memgraph::storage::LabelId> &labels,
+  bool Has(const std::vector<storage::LabelId> &labels,
            query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
-  bool Has(const memgraph::storage::EdgeTypeId &edge_type,
+  bool Has(const storage::EdgeTypeId &edge_type,
            query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
-  bool HasGlobalPrivilegeOnVertices(
-      memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
+  bool HasGlobalPrivilegeOnVertices(query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
-  bool HasGlobalPrivilegeOnEdges(
-      memgraph::query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
+  bool HasGlobalPrivilegeOnEdges(query::AuthQuery::FineGrainedPrivilege fine_grained_privilege) const override;
 
  private:
-  auth::User user_;
-  const memgraph::query::DbAccessor *dba_;
+  auth::UserOrRole user_or_role_;
+  const query::DbAccessor *dba_;
 };
 #endif
 }  // namespace memgraph::glue

src/glue/auth_handler.cpp

@@ -15,6 +15,7 @@
 
 #include <fmt/format.h>
 
+#include "auth/auth.hpp"
 #include "auth/models.hpp"
 #include "dbms/constants.hpp"
 #include "glue/auth.hpp"
@@ -123,6 +124,29 @@ std::vector<std::vector<memgraph::query::TypedValue>> ShowRolePrivileges(
 }
 
 #ifdef MG_ENTERPRISE
+std::vector<std::vector<memgraph::query::TypedValue>> ShowDatabasePrivileges(
+    const std::optional<memgraph::auth::Role> &role) {
+  if (!memgraph::license::global_license_checker.IsEnterpriseValidFast() || !role) {
+    return {};
+  }
+
+  const auto &db = role->db_access();
+  const auto &allows = db.GetAllowAll();
+  const auto &grants = db.GetGrants();
+  const auto &denies = db.GetDenies();
+
+  std::vector<memgraph::query::TypedValue> res;  // First element is a list of granted databases, second of revoked ones
+  if (allows) {
+    res.emplace_back("*");
+  } else {
+    std::vector<memgraph::query::TypedValue> grants_vec(grants.cbegin(), grants.cend());
+    res.emplace_back(std::move(grants_vec));
+  }
+  std::vector<memgraph::query::TypedValue> denies_vec(denies.cbegin(), denies.cend());
+  res.emplace_back(std::move(denies_vec));
+  return {res};
+}
+
 std::vector<std::vector<memgraph::query::TypedValue>> ShowDatabasePrivileges(
     const std::optional<memgraph::auth::User> &user) {
   if (!memgraph::license::global_license_checker.IsEnterpriseValidFast() || !user) {
@@ -130,9 +154,15 @@ std::vector<std::vector<memgraph::query::TypedValue>> ShowDatabasePrivileges(
   }
 
   const auto &db = user->db_access();
-  const auto &allows = db.GetAllowAll();
-  const auto &grants = db.GetGrants();
-  const auto &denies = db.GetDenies();
+  auto allows = db.GetAllowAll();
+  auto grants = db.GetGrants();
+  auto denies = db.GetDenies();
+  if (const auto *role = user->role()) {
+    const auto &role_db = role->db_access();
+    allows |= role_db.GetAllowAll();
+    grants.insert(role_db.GetGrants().begin(), role_db.GetGrants().end());
+    denies.insert(role_db.GetDenies().begin(), role_db.GetDenies().end());
+  }
 
   std::vector<memgraph::query::TypedValue> res;  // First element is a list of granted databases, second of revoked ones
   if (allows) {
@@ -287,7 +317,7 @@ bool AuthQueryHandler::CreateUser(const std::string &username, const std::option
           ,
           system_tx);
 #ifdef MG_ENTERPRISE
-      GrantDatabaseToUser(auth::kAllDatabases, username, system_tx);
+      GrantDatabase(auth::kAllDatabases, username, system_tx);
       SetMainDatabase(dbms::kDefaultDB, username, system_tx);
 #endif
     }
@@ -334,51 +364,97 @@ bool AuthQueryHandler::CreateRole(const std::string &rolename, system::Transacti
 }
 
 #ifdef MG_ENTERPRISE
-bool AuthQueryHandler::RevokeDatabaseFromUser(const std::string &db_name, const std::string &username,
-                                              system::Transaction *system_tx) {
+void AuthQueryHandler::GrantDatabase(const std::string &db_name, const std::string &user_or_role,
+                                     system::Transaction *system_tx) {
   try {
     auto locked_auth = auth_->Lock();
-    auto user = locked_auth->GetUser(username);
-    if (!user) return false;
-    return locked_auth->RevokeDatabaseFromUser(db_name, username, system_tx);
+    const auto res = locked_auth->GrantDatabase(db_name, user_or_role, system_tx);
+    switch (res) {
+      using enum auth::Auth::Result;
+      case SUCCESS:
+        return;
+      case NO_USER_ROLE:
+        throw query::QueryRuntimeException("No user nor role '{}' found.", user_or_role);
+      case NO_ROLE:
+        throw query::QueryRuntimeException("Using auth module, no role '{}' found.", user_or_role);
+        break;
+    }
   } catch (const memgraph::auth::AuthException &e) {
     throw memgraph::query::QueryRuntimeException(e.what());
   }
 }
 
-bool AuthQueryHandler::GrantDatabaseToUser(const std::string &db_name, const std::string &username,
-                                           system::Transaction *system_tx) {
+void AuthQueryHandler::DenyDatabase(const std::string &db_name, const std::string &user_or_role,
+                                    system::Transaction *system_tx) {
   try {
     auto locked_auth = auth_->Lock();
-    auto user = locked_auth->GetUser(username);
-    if (!user) return false;
-    return locked_auth->GrantDatabaseToUser(db_name, username, system_tx);
+    const auto res = locked_auth->DenyDatabase(db_name, user_or_role, system_tx);
+    switch (res) {
+      using enum auth::Auth::Result;
+      case SUCCESS:
+        return;
+      case NO_USER_ROLE:
+        throw query::QueryRuntimeException("No user nor role '{}' found.", user_or_role);
+      case NO_ROLE:
+        throw query::QueryRuntimeException("Using auth module, no role '{}' found.", user_or_role);
+        break;
+    }
+  } catch (const memgraph::auth::AuthException &e) {
+    throw memgraph::query::QueryRuntimeException(e.what());
+  }
+}
+
+void AuthQueryHandler::RevokeDatabase(const std::string &db_name, const std::string &user_or_role,
+                                      system::Transaction *system_tx) {
+  try {
+    auto locked_auth = auth_->Lock();
+    const auto res = locked_auth->RevokeDatabase(db_name, user_or_role, system_tx);
+    switch (res) {
+      using enum auth::Auth::Result;
+      case SUCCESS:
+        return;
+      case NO_USER_ROLE:
+        throw query::QueryRuntimeException("No user nor role '{}' found.", user_or_role);
+      case NO_ROLE:
+        throw query::QueryRuntimeException("Using auth module, no role '{}' found.", user_or_role);
+        break;
+    }
   } catch (const memgraph::auth::AuthException &e) {
     throw memgraph::query::QueryRuntimeException(e.what());
   }
 }
 
 std::vector<std::vector<memgraph::query::TypedValue>> AuthQueryHandler::GetDatabasePrivileges(
-    const std::string &username) {
+    const std::string &user_or_role) {
   try {
     auto locked_auth = auth_->ReadLock();
-    auto user = locked_auth->GetUser(username);
-    if (!user) {
-      throw memgraph::query::QueryRuntimeException("User '{}' doesn't exist.", username);
+    if (auto user = locked_auth->GetUser(user_or_role)) {
+      return ShowDatabasePrivileges(user);
     }
-    return ShowDatabasePrivileges(user);
+    if (auto role = locked_auth->GetRole(user_or_role)) {
+      return ShowDatabasePrivileges(role);
+    }
+    throw memgraph::query::QueryRuntimeException("Neither user nor role '{}' exist.", user_or_role);
   } catch (const memgraph::auth::AuthException &e) {
     throw memgraph::query::QueryRuntimeException(e.what());
   }
 }
 
-bool AuthQueryHandler::SetMainDatabase(std::string_view db_name, const std::string &username,
+void AuthQueryHandler::SetMainDatabase(std::string_view db_name, const std::string &user_or_role,
                                        system::Transaction *system_tx) {
   try {
     auto locked_auth = auth_->Lock();
-    auto user = locked_auth->GetUser(username);
-    if (!user) return false;
-    return locked_auth->SetMainDatabase(db_name, username, system_tx);
+    const auto res = locked_auth->SetMainDatabase(db_name, user_or_role, system_tx);
+    switch (res) {
+      using enum auth::Auth::Result;
+      case SUCCESS:
+        return;
+      case NO_USER_ROLE:
+        throw query::QueryRuntimeException("No user nor role '{}' found.", user_or_role);
+      case NO_ROLE:
+        throw query::QueryRuntimeException("Using auth module, no role '{}' found.", user_or_role);
+        break;
+    }
   } catch (const memgraph::auth::AuthException &e) {
     throw memgraph::query::QueryRuntimeException(e.what());
   }

src/glue/auth_handler.hpp

@@ -37,15 +37,19 @@ class AuthQueryHandler final : public memgraph::query::AuthQueryHandler {
                    system::Transaction *system_tx) override;
 
 #ifdef MG_ENTERPRISE
-  bool RevokeDatabaseFromUser(const std::string &db_name, const std::string &username,
-                              system::Transaction *system_tx) override;
+  void GrantDatabase(const std::string &db_name, const std::string &user_or_role,
+                     system::Transaction *system_tx) override;
 
-  bool GrantDatabaseToUser(const std::string &db_name, const std::string &username,
-                           system::Transaction *system_tx) override;
+  void DenyDatabase(const std::string &db_name, const std::string &user_or_role,
+                    system::Transaction *system_tx) override;
 
-  std::vector<std::vector<memgraph::query::TypedValue>> GetDatabasePrivileges(const std::string &username) override;
+  void RevokeDatabase(const std::string &db_name, const std::string &user_or_role,
+                      system::Transaction *system_tx) override;
 
-  bool SetMainDatabase(std::string_view db_name, const std::string &username, system::Transaction *system_tx) override;
+  std::vector<std::vector<memgraph::query::TypedValue>> GetDatabasePrivileges(const std::string &user_or_role) override;
+
+  void SetMainDatabase(std::string_view db_name, const std::string &user_or_role,
+                       system::Transaction *system_tx) override;
 
   void DeleteDatabase(std::string_view db_name, system::Transaction *system_tx) override;
 #endif

src/glue/communication.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source

src/glue/query_user.cpp

@@ -0,0 +1,41 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#include "glue/query_user.hpp"
+
+#include "glue/auth_checker.hpp"
+
+namespace memgraph::glue {
+
+bool QueryUserOrRole::IsAuthorized(const std::vector<query::AuthQuery::Privilege> &privileges,
+                                   const std::string &db_name, query::UserPolicy *policy) const {
+  auto locked_auth = auth_->Lock();
+  // Check policy and update if behind (and policy permits it)
+  if (policy->DoUpdate() && !locked_auth->UpToDate(auth_epoch_)) {
+    if (user_) user_ = locked_auth->GetUser(user_->username());
+    if (role_) role_ = locked_auth->GetRole(role_->rolename());
+  }
+
+  if (user_) return AuthChecker::IsUserAuthorized(*user_, privileges, db_name);
+  if (role_) return AuthChecker::IsRoleAuthorized(*role_, privileges, db_name);
+
+  return !policy->DoUpdate() || !locked_auth->AccessControlled();
+}
+
+#ifdef MG_ENTERPRISE
+std::string QueryUserOrRole::GetDefaultDB() const {
+  if (user_) return user_->db_access().GetMain();
+  if (role_) return role_->db_access().GetMain();
+  return std::string{dbms::kDefaultDB};
+}
+#endif
+
+}  // namespace memgraph::glue

src/glue/query_user.hpp

@@ -0,0 +1,57 @@
+// Copyright 2024 Memgraph Ltd.
+//
+// Use of this software is governed by the Business Source License
+// included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
+// License, and you may not use this file except in compliance with the Business Source License.
+//
+// As of the Change Date specified in that file, in accordance with
+// the Business Source License, use of this software will be governed
+// by the Apache License, Version 2.0, included in the file
+// licenses/APL.txt.
+
+#pragma once
+
+#include <optional>
+
+#include "auth/auth.hpp"
+#include "query/query_user.hpp"
+#include "utils/variant_helpers.hpp"
+
+namespace memgraph::glue {
+
+struct QueryUserOrRole : public query::QueryUserOrRole {
+  bool IsAuthorized(const std::vector<query::AuthQuery::Privilege> &privileges, const std::string &db_name,
+                    query::UserPolicy *policy) const override;
+
+#ifdef MG_ENTERPRISE
+  std::string GetDefaultDB() const override;
+#endif
+
+  explicit QueryUserOrRole(auth::SynchedAuth *auth) : query::QueryUserOrRole{std::nullopt, std::nullopt}, auth_{auth} {}
+
+  QueryUserOrRole(auth::SynchedAuth *auth, auth::UserOrRole user_or_role)
+      : query::QueryUserOrRole{std::visit(
+                                   utils::Overloaded{[](const auto &user_or_role) { return user_or_role.username(); }},
+                                   user_or_role),
+                               std::visit(utils::Overloaded{[&](const auth::User &) -> std::optional<std::string> {
+                                                              return std::nullopt;
+                                                            },
+                                                            [&](const auth::Role &role) -> std::optional<std::string> {
+                                                              return role.rolename();
+                                                            }},
+                                          user_or_role)},
+        auth_{auth} {
+    std::visit(utils::Overloaded{[&](auth::User &&user) { user_.emplace(std::move(user)); },
+                                 [&](auth::Role &&role) { role_.emplace(std::move(role)); }},
+               std::move(user_or_role));
+  }
+
+ private:
+  friend class AuthChecker;
+  auth::SynchedAuth *auth_;
+  mutable std::optional<auth::User> user_{};
+  mutable std::optional<auth::Role> role_{};
+  mutable auth::Auth::Epoch auth_epoch_{auth::Auth::kStartEpoch};
+};
+
+}  // namespace memgraph::glue

src/io/network/endpoint.cpp

@@ -22,113 +22,15 @@
 #include "utils/message.hpp"
 #include "utils/string.hpp"
 
+namespace {
+constexpr std::string_view delimiter = ":";
+}  // namespace
+
 namespace memgraph::io::network {
 
-Endpoint::IpFamily Endpoint::GetIpFamily(const std::string &address) {
-  in_addr addr4;
-  in6_addr addr6;
-  int ipv4_result = inet_pton(AF_INET, address.c_str(), &addr4);
-  int ipv6_result = inet_pton(AF_INET6, address.c_str(), &addr6);
-  if (ipv4_result == 1) {
-    return IpFamily::IP4;
-  } else if (ipv6_result == 1) {
-    return IpFamily::IP6;
-  } else {
-    return IpFamily::NONE;
-  }
-}
-
-std::optional<std::pair<std::string, uint16_t>> Endpoint::ParseSocketOrIpAddress(
-    const std::string &address, const std::optional<uint16_t> default_port) {
-  /// expected address format:
-  ///   - "ip_address:port_number"
-  ///   - "ip_address"
-  /// We parse the address first. If it's an IP address, a default port must
-  // be given, or we return nullopt. If it's a socket address, we try to parse
-  // it into an ip address and a port number; even if a default port is given,
-  // it won't be used, as we expect that it is given in the address string.
-  const std::string delimiter = ":";
-  std::string ip_address;
-
-  std::vector<std::string> parts = utils::Split(address, delimiter);
-  if (parts.size() == 1) {
-    if (default_port) {
-      if (GetIpFamily(address) == IpFamily::NONE) {
-        return std::nullopt;
-      }
-      return std::pair{address, *default_port};
-    }
-  } else if (parts.size() == 2) {
-    ip_address = std::move(parts[0]);
-    if (GetIpFamily(ip_address) == IpFamily::NONE) {
-      return std::nullopt;
-    }
-    int64_t int_port{0};
-    try {
-      int_port = utils::ParseInt(parts[1]);
-    } catch (utils::BasicException &e) {
-      spdlog::error(utils::MessageWithLink("Invalid port number {}.", parts[1], "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-    if (int_port < 0) {
-      spdlog::error(utils::MessageWithLink("Invalid port number {}. The port number must be a positive integer.",
-                                           int_port, "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-    if (int_port > std::numeric_limits<uint16_t>::max()) {
-      spdlog::error(utils::MessageWithLink("Invalid port number. The port number exceedes the maximum possible size.",
-                                           "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-
-    return std::pair{ip_address, static_cast<uint16_t>(int_port)};
-  }
-
-  return std::nullopt;
-}
-
-std::optional<std::pair<std::string, uint16_t>> Endpoint::ParseHostname(
-    const std::string &address, const std::optional<uint16_t> default_port = {}) {
-  const std::string delimiter = ":";
-  std::string ip_address;
-  std::vector<std::string> parts = utils::Split(address, delimiter);
-  if (parts.size() == 1) {
-    if (default_port) {
-      if (!IsResolvableAddress(address, *default_port)) {
-        return std::nullopt;
-      }
-      return std::pair{address, *default_port};
-    }
-  } else if (parts.size() == 2) {
-    int64_t int_port{0};
-    auto hostname = std::move(parts[0]);
-    try {
-      int_port = utils::ParseInt(parts[1]);
-    } catch (utils::BasicException &e) {
-      spdlog::error(utils::MessageWithLink("Invalid port number {}.", parts[1], "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-    if (int_port < 0) {
-      spdlog::error(utils::MessageWithLink("Invalid port number {}. The port number must be a positive integer.",
-                                           int_port, "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-    if (int_port > std::numeric_limits<uint16_t>::max()) {
-      spdlog::error(utils::MessageWithLink("Invalid port number. The port number exceedes the maximum possible size.",
-                                           "https://memgr.ph/ports"));
-      return std::nullopt;
-    }
-    if (IsResolvableAddress(hostname, static_cast<uint16_t>(int_port))) {
-      return std::pair{hostname, static_cast<u_int16_t>(int_port)};
-    }
-  }
-  return std::nullopt;
-}
-
-std::string Endpoint::SocketAddress() const {
-  auto ip_address = address.empty() ? "EMPTY" : address;
-  return ip_address + ":" + std::to_string(port);
-}
+// NOLINTNEXTLINE
+Endpoint::Endpoint(needs_resolving_t, std::string hostname, uint16_t port)
+    : address(std::move(hostname)), port(port), family{GetIpFamily(address)} {}
 
 Endpoint::Endpoint(std::string ip_address, uint16_t port) : address(std::move(ip_address)), port(port) {
   IpFamily ip_family = GetIpFamily(address);
@@ -138,9 +40,23 @@ Endpoint::Endpoint(std::string ip_address, uint16_t port) : address(std::move(ip
   family = ip_family;
 }
 
-// NOLINTNEXTLINE
-Endpoint::Endpoint(needs_resolving_t, std::string hostname, uint16_t port)
-    : address(std::move(hostname)), port(port), family{GetIpFamily(address)} {}
+std::string Endpoint::SocketAddress() const { return fmt::format("{}:{}", address, port); }
+
+Endpoint::IpFamily Endpoint::GetIpFamily(std::string_view address) {
+  // Ensure null-terminated
+  auto const tmp = std::string(address);
+  in_addr addr4;
+  in6_addr addr6;
+  int ipv4_result = inet_pton(AF_INET, tmp.c_str(), &addr4);
+  int ipv6_result = inet_pton(AF_INET6, tmp.c_str(), &addr6);
+  if (ipv4_result == 1) {
+    return IpFamily::IP4;
+  }
+  if (ipv6_result == 1) {
+    return IpFamily::IP6;
+  }
+  return IpFamily::NONE;
+}
 
 std::ostream &operator<<(std::ostream &os, const Endpoint &endpoint) {
   // no need to cover the IpFamily::NONE case, as you can't even construct an
@@ -153,35 +69,73 @@ std::ostream &operator<<(std::ostream &os, const Endpoint &endpoint) {
   return os << endpoint.address << ":" << endpoint.port;
 }
 
-bool Endpoint::IsResolvableAddress(const std::string &address, uint16_t port) {
+// NOTE: Intentional copy to ensure null-terminated string
+bool Endpoint::IsResolvableAddress(std::string_view address, uint16_t port) {
   addrinfo hints{
       .ai_flags = AI_PASSIVE,
       .ai_family = AF_UNSPEC,     // IPv4 and IPv6
       .ai_socktype = SOCK_STREAM  // TCP socket
   };
   addrinfo *info = nullptr;
-  auto status = getaddrinfo(address.c_str(), std::to_string(port).c_str(), &hints, &info);
+  auto status = getaddrinfo(std::string(address).c_str(), std::to_string(port).c_str(), &hints, &info);
   if (info) freeaddrinfo(info);
   return status == 0;
 }
 
-std::optional<std::pair<std::string, uint16_t>> Endpoint::ParseSocketOrAddress(
-    const std::string &address, const std::optional<uint16_t> default_port) {
-  const std::string delimiter = ":";
-  std::vector<std::string> parts = utils::Split(address, delimiter);
-  if (parts.size() == 1) {
-    if (GetIpFamily(address) == IpFamily::NONE) {
-      return ParseHostname(address, default_port);
-    }
-    return ParseSocketOrIpAddress(address, default_port);
+std::optional<ParsedAddress> Endpoint::ParseSocketOrAddress(std::string_view address,
+                                                            std::optional<uint16_t> default_port) {
+  auto const parts = utils::SplitView(address, delimiter);
+
+  if (parts.size() > 2) {
+    return std::nullopt;
   }
-  if (parts.size() == 2) {
-    if (GetIpFamily(parts[0]) == IpFamily::NONE) {
-      return ParseHostname(address, default_port);
+
+  auto const port = [default_port, &parts]() -> std::optional<uint16_t> {
+    if (parts.size() == 2) {
+      return static_cast<uint16_t>(utils::ParseInt(parts[1]));
     }
-    return ParseSocketOrIpAddress(address, default_port);
+    return default_port;
+  }();
+
+  if (!ValidatePort(port)) {
+    return std::nullopt;
   }
-  return std::nullopt;
+
+  auto const addr = [address, &parts]() {
+    if (parts.size() == 2) {
+      return parts[0];
+    }
+    return address;
+  }();
+
+  if (GetIpFamily(addr) == IpFamily::NONE) {
+    if (IsResolvableAddress(addr, *port)) {  // NOLINT
+      return std::pair{addr, *port};         // NOLINT
+    }
+    return std::nullopt;
+  }
+
+  return std::pair{addr, *port};  // NOLINT
+}
+
+auto Endpoint::ValidatePort(std::optional<uint16_t> port) -> bool {
+  if (!port) {
+    return false;
+  }
+
+  if (port < 0) {
+    spdlog::error(utils::MessageWithLink("Invalid port number {}. The port number must be a positive integer.", *port,
+                                         "https://memgr.ph/ports"));
+    return false;
+  }
+
+  if (port > std::numeric_limits<uint16_t>::max()) {
+    spdlog::error(utils::MessageWithLink("Invalid port number. The port number exceedes the maximum possible size.",
+                                         "https://memgr.ph/ports"));
+    return false;
+  }
+
+  return true;
 }
 
 }  // namespace memgraph::io::network

src/io/network/endpoint.hpp

@@ -19,11 +19,8 @@
 
 namespace memgraph::io::network {
 
-/**
- * This class represents a network endpoint that is used in Socket.
- * It is used when connecting to an address and to get the current
- * connection address.
- */
+using ParsedAddress = std::pair<std::string_view, uint16_t>;
+
 struct Endpoint {
   static const struct needs_resolving_t {
   } needs_resolving;
@@ -31,59 +28,35 @@ struct Endpoint {
   Endpoint() = default;
   Endpoint(std::string ip_address, uint16_t port);
   Endpoint(needs_resolving_t, std::string hostname, uint16_t port);
+
   Endpoint(Endpoint const &) = default;
   Endpoint(Endpoint &&) noexcept = default;
+
   Endpoint &operator=(Endpoint const &) = default;
   Endpoint &operator=(Endpoint &&) noexcept = default;
+
   ~Endpoint() = default;
 
   enum class IpFamily : std::uint8_t { NONE, IP4, IP6 };
 
-  std::string SocketAddress() const;
+  static std::optional<ParsedAddress> ParseSocketOrAddress(std::string_view address,
+                                                           std::optional<uint16_t> default_port = {});
 
-  bool operator==(const Endpoint &other) const = default;
-  friend std::ostream &operator<<(std::ostream &os, const Endpoint &endpoint);
+  std::string SocketAddress() const;
 
   std::string address;
   uint16_t port{0};
   IpFamily family{IpFamily::NONE};
 
-  static std::optional<std::pair<std::string, uint16_t>> ParseSocketOrAddress(const std::string &address,
-                                                                              std::optional<uint16_t> default_port);
+  bool operator==(const Endpoint &other) const = default;
+  friend std::ostream &operator<<(std::ostream &os, const Endpoint &endpoint);
 
-  /**
-   * Tries to parse the given string as either a socket address or ip address.
-   * Expected address format:
-   *   - "ip_address:port_number"
-   *   - "ip_address"
-   * We parse the address first. If it's an IP address, a default port must
-   * be given, or we return nullopt. If it's a socket address, we try to parse
-   * it into an ip address and a port number; even if a default port is given,
-   * it won't be used, as we expect that it is given in the address string.
-   */
-  static std::optional<std::pair<std::string, uint16_t>> ParseSocketOrIpAddress(
-      const std::string &address, std::optional<uint16_t> default_port = {});
+ private:
+  static IpFamily GetIpFamily(std::string_view address);
 
-  /**
-   * Tries to parse given string as either socket address or hostname.
-   * Expected address format:
-   *    - "hostname:port_number"
-   *    - "hostname"
-   * After we parse hostname and port we try to resolve the hostname into an ip_address.
-   */
-  static std::optional<std::pair<std::string, uint16_t>> ParseHostname(const std::string &address,
-                                                                       std::optional<uint16_t> default_port);
+  static bool IsResolvableAddress(std::string_view address, uint16_t port);
 
-  static IpFamily GetIpFamily(const std::string &address);
-
-  static bool IsResolvableAddress(const std::string &address, uint16_t port);
-
-  /**
-   * Tries to resolve hostname to its corresponding IP address.
-   * Given a DNS hostname, this function performs resolution and returns
-   * the IP address associated with the hostname.
-   */
-  static std::string ResolveHostnameIntoIpAddress(const std::string &address, uint16_t port);
+  static auto ValidatePort(std::optional<uint16_t> port) -> bool;
 };
 
 }  // namespace memgraph::io::network

src/memgraph.cpp

@@ -27,6 +27,7 @@
 #include "helpers.hpp"
 #include "license/license_sender.hpp"
 #include "memory/global_memory_control.hpp"
+#include "query/auth_checker.hpp"
 #include "query/auth_query_handler.hpp"
 #include "query/config.hpp"
 #include "query/discard_value_stream.hpp"
@@ -57,8 +58,13 @@ constexpr uint64_t kMgVmMaxMapCount = 262144;
 void InitFromCypherlFile(memgraph::query::InterpreterContext &ctx, memgraph::dbms::DatabaseAccess &db_acc,
                          std::string cypherl_file_path, memgraph::audit::Log *audit_log = nullptr) {
   memgraph::query::Interpreter interpreter(&ctx, db_acc);
-  std::ifstream file(cypherl_file_path);
+  // Temporary empty user
+  // TODO: Double check with buda
+  memgraph::query::AllowEverythingAuthChecker tmp_auth_checker;
+  auto tmp_user = tmp_auth_checker.GenQueryUser(std::nullopt, std::nullopt);
+  interpreter.SetUser(tmp_user);
 
+  std::ifstream file(cypherl_file_path);
   if (!file.is_open()) {
     spdlog::trace("Could not find init file {}", cypherl_file_path);
     return;
@@ -328,7 +334,8 @@ int main(int argc, char **argv) {
       .salient.items = {.properties_on_edges = FLAGS_storage_properties_on_edges,
                         .enable_schema_metadata = FLAGS_storage_enable_schema_metadata},
       .salient.storage_mode = memgraph::flags::ParseStorageMode()};
-
+  spdlog::info("config recover on startup {}, flags {} {}", db_config.durability.recover_on_startup,
+               FLAGS_storage_recover_on_startup, FLAGS_data_recovery_on_startup);
   memgraph::utils::Scheduler jemalloc_purge_scheduler;
   jemalloc_purge_scheduler.Run("Jemalloc purge", std::chrono::seconds(FLAGS_storage_gc_cycle_sec),
                                [] { memgraph::memory::PurgeUnusedMemory(); });

src/memory/global_memory_control.cpp

@@ -122,11 +122,11 @@ static bool my_commit(extent_hooks_t *extent_hooks, void *addr, size_t size, siz
 
   [[maybe_unused]] auto blocker = memgraph::utils::MemoryTracker::OutOfMemoryExceptionBlocker{};
   if (GetQueriesMemoryControl().IsThreadTracked()) [[unlikely]] {
-    bool ok = GetQueriesMemoryControl().TrackAllocOnCurrentThread(length);
+    [[maybe_unused]] bool ok = GetQueriesMemoryControl().TrackAllocOnCurrentThread(length);
     DMG_ASSERT(ok);
   }
 
-  auto ok = memgraph::utils::total_memory_tracker.Alloc(static_cast<int64_t>(length));
+  [[maybe_unused]] auto ok = memgraph::utils::total_memory_tracker.Alloc(static_cast<int64_t>(length));
   DMG_ASSERT(ok);
 
   return false;

src/mg_import_csv.cpp

@@ -416,7 +416,7 @@ memgraph::storage::PropertyValue StringToValue(const std::string &str, const std
 std::string GetIdSpace(const std::string &type) {
   // The format of this field is as follows:
   // [START_|END_]ID[(<id_space>)]
-  std::regex format(R"(^(START_|END_)?ID(\(([^\(\)]+)\))?$)", std::regex::extended);
+  static std::regex format(R"(^(START_|END_)?ID(\(([^\(\)]+)\))?$)", std::regex::extended);
   std::smatch res;
   if (!std::regex_match(type, res, format))
     throw LoadException(

src/query/CMakeLists.txt

@@ -40,6 +40,7 @@ set(mg_query_sources
     db_accessor.cpp
     auth_query_handler.cpp
     interpreter_context.cpp
+    query_user.cpp
 )
 
 add_library(mg-query STATIC ${mg_query_sources})

src/query/auth_checker.hpp

@@ -1,4 +1,4 @@
-// Copyright 2023 Memgraph Ltd.
+// Copyright 2024 Memgraph Ltd.
 //
 // Use of this software is governed by the Business Source License
 // included in the file licenses/BSL.txt; by using this file, you agree to be bound by the terms of the Business Source
@@ -16,7 +16,9 @@
 #include <string>
 #include <vector>
 
+#include "dbms/constants.hpp"
 #include "query/frontend/ast/ast.hpp"
+#include "query/query_user.hpp"
 #include "storage/v2/id_types.hpp"
 
 namespace memgraph::query {
@@ -29,15 +31,12 @@ class AuthChecker {
  public:
   virtual ~AuthChecker() = default;
 
-  [[nodiscard]] virtual bool IsUserAuthorized(const std::optional<std::string> &username,
-                                              const std::vector<AuthQuery::Privilege> &privileges,
-                                              const std::string &db_name) const = 0;
+  virtual std::shared_ptr<QueryUserOrRole> GenQueryUser(const std::optional<std::string> &username,
+                                                        const std::optional<std::string> &rolename) const = 0;
 
 #ifdef MG_ENTERPRISE
   [[nodiscard]] virtual std::unique_ptr<FineGrainedAuthChecker> GetFineGrainedAuthChecker(
-      const std::string &username, const DbAccessor *db_accessor) const = 0;
-
-  virtual void ClearCache() const = 0;
+      std::shared_ptr<QueryUserOrRole> user, const DbAccessor *db_accessor) const = 0;
 #endif
 };
 #ifdef MG_ENTERPRISE
@@ -98,19 +97,29 @@ class AllowEverythingFineGrainedAuthChecker final : public FineGrainedAuthChecke
 
 class AllowEverythingAuthChecker final : public AuthChecker {
  public:
-  bool IsUserAuthorized(const std::optional<std::string> & /*username*/,
-                        const std::vector<AuthQuery::Privilege> & /*privileges*/,
-                        const std::string & /*db*/) const override {
-    return true;
+  struct User : query::QueryUserOrRole {
+    User() : query::QueryUserOrRole{std::nullopt, std::nullopt} {}
+    User(std::string name) : query::QueryUserOrRole{std::move(name), std::nullopt} {}
+    bool IsAuthorized(const std::vector<AuthQuery::Privilege> & /*privileges*/, const std::string & /*db_name*/,
+                      UserPolicy * /*policy*/) const override {
+      return true;
+    }
+#ifdef MG_ENTERPRISE
+    std::string GetDefaultDB() const override { return std::string{dbms::kDefaultDB}; }
+#endif
+  };
+
+  std::shared_ptr<query::QueryUserOrRole> GenQueryUser(const std::optional<std::string> &name,
+                                                       const std::optional<std::string> & /*role*/) const override {
+    if (name) return std::make_shared<User>(std::move(*name));
+    return std::make_shared<User>();
   }
 
 #ifdef MG_ENTERPRISE
-  std::unique_ptr<FineGrainedAuthChecker> GetFineGrainedAuthChecker(const std::string & /*username*/,
+  std::unique_ptr<FineGrainedAuthChecker> GetFineGrainedAuthChecker(std::shared_ptr<QueryUserOrRole> /*user*/,
                                                                     const DbAccessor * /*dba*/) const override {
     return std::make_unique<AllowEverythingFineGrainedAuthChecker>();
   }
-
-  void ClearCache() const override {}
 #endif
 };
 

src/query/auth_query_handler.hpp

@@ -46,15 +46,17 @@ class AuthQueryHandler {
                            system::Transaction *system_tx) = 0;
 
 #ifdef MG_ENTERPRISE
-  /// Return true if access revoked successfully
-  /// @throw QueryRuntimeException if an error ocurred.
-  virtual bool RevokeDatabaseFromUser(const std::string &db, const std::string &username,
-                                      system::Transaction *system_tx) = 0;
-
   /// Return true if access granted successfully
   /// @throw QueryRuntimeException if an error ocurred.
-  virtual bool GrantDatabaseToUser(const std::string &db, const std::string &username,
-                                   system::Transaction *system_tx) = 0;
+  virtual void GrantDatabase(const std::string &db, const std::string &username, system::Transaction *system_tx) = 0;
+
+  /// Return true if access revoked successfully
+  /// @throw QueryRuntimeException if an error ocurred.
+  virtual void DenyDatabase(const std::string &db, const std::string &username, system::Transaction *system_tx) = 0;
+
+  /// Return true if access revoked successfully
+  /// @throw QueryRuntimeException if an error ocurred.
+  virtual void RevokeDatabase(const std::string &db, const std::string &username, system::Transaction *system_tx) = 0;
 
   /// Returns database access rights for the user
   /// @throw QueryRuntimeException if an error ocurred.
@@ -62,7 +64,7 @@ class AuthQueryHandler {
 
   /// Return true if main database set successfully
   /// @throw QueryRuntimeException if an error ocurred.
-  virtual bool SetMainDatabase(std::string_view db, const std::string &username, system::Transaction *system_tx) = 0;
+  virtual void SetMainDatabase(std::string_view db, const std::string &username, system::Transaction *system_tx) = 0;
 
   /// Delete database from all users
   /// @throw QueryRuntimeException if an error ocurred.

src/query/db_accessor.hpp

@@ -371,6 +371,62 @@ class VerticesIterable final {
   }
 };
 
+class EdgesIterable final {
+  std::variant<storage::EdgesIterable, std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                                          utils::Allocator<EdgeAccessor>> *>
+      iterable_;
+
+ public:
+  class Iterator final {
+    std::variant<storage::EdgesIterable::Iterator,
+                 std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                    utils::Allocator<EdgeAccessor>>::iterator>
+        it_;
+
+   public:
+    explicit Iterator(storage::EdgesIterable::Iterator it) : it_(std::move(it)) {}
+    explicit Iterator(std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                         utils::Allocator<EdgeAccessor>>::iterator it)
+        : it_(it) {}
+
+    EdgeAccessor operator*() const {
+      return std::visit([](auto &it_) { return EdgeAccessor(*it_); }, it_);
+    }
+
+    Iterator &operator++() {
+      std::visit([](auto &it_) { ++it_; }, it_);
+      return *this;
+    }
+
+    bool operator==(const Iterator &other) const { return it_ == other.it_; }
+
+    bool operator!=(const Iterator &other) const { return !(other == *this); }
+  };
+
+  explicit EdgesIterable(storage::EdgesIterable iterable) : iterable_(std::move(iterable)) {}
+  explicit EdgesIterable(std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                            utils::Allocator<EdgeAccessor>> *edges)
+      : iterable_(edges) {}
+
+  Iterator begin() {
+    return std::visit(
+        memgraph::utils::Overloaded{
+            [](storage::EdgesIterable &iterable_) { return Iterator(iterable_.begin()); },
+            [](std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                  utils::Allocator<EdgeAccessor>> *iterable_) { return Iterator(iterable_->begin()); }},
+        iterable_);
+  }
+
+  Iterator end() {
+    return std::visit(
+        memgraph::utils::Overloaded{
+            [](storage::EdgesIterable &iterable_) { return Iterator(iterable_.end()); },
+            [](std::unordered_set<EdgeAccessor, std::hash<EdgeAccessor>, std::equal_to<void>,
+                                  utils::Allocator<EdgeAccessor>> *iterable_) { return Iterator(iterable_->end()); }},
+        iterable_);
+  }
+};
+
 class DbAccessor final {
   storage::Storage::Accessor *accessor_;
 
@@ -416,6 +472,10 @@ class DbAccessor final {
     return VerticesIterable(accessor_->Vertices(label, property, lower, upper, view));
   }
 
+  EdgesIterable Edges(storage::View view, storage::EdgeTypeId edge_type) {
+    return EdgesIterable(accessor_->Edges(edge_type, view));
+  }
+
   VertexAccessor InsertVertex() { return VertexAccessor(accessor_->CreateVertex()); }
 
   storage::Result<EdgeAccessor> InsertEdge(VertexAccessor *from, VertexAccessor *to,
@@ -572,6 +632,8 @@ class DbAccessor final {
     return accessor_->LabelPropertyIndexExists(label, prop);
   }
 
+  bool EdgeTypeIndexExists(storage::EdgeTypeId edge_type) const { return accessor_->EdgeTypeIndexExists(edge_type); }
+
   std::optional<storage::LabelIndexStats> GetIndexStats(const storage::LabelId &label) const {
     return accessor_->GetIndexStats(label);
   }
@@ -638,6 +700,10 @@ class DbAccessor final {
     return accessor_->CreateIndex(label, property);
   }
 
+  utils::BasicResult<storage::StorageIndexDefinitionError, void> CreateIndex(storage::EdgeTypeId edge_type) {
+    return accessor_->CreateIndex(edge_type);
+  }
+
   utils::BasicResult<storage::StorageIndexDefinitionError, void> DropIndex(storage::LabelId label) {
     return accessor_->DropIndex(label);
   }
@@ -647,6 +713,10 @@ class DbAccessor final {
     return accessor_->DropIndex(label, property);
   }
 
+  utils::BasicResult<storage::StorageIndexDefinitionError, void> DropIndex(storage::EdgeTypeId edge_type) {
+    return accessor_->DropIndex(edge_type);
+  }
+
   utils::BasicResult<storage::StorageExistenceConstraintDefinitionError, void> CreateExistenceConstraint(
       storage::LabelId label, storage::PropertyId property) {
     return accessor_->CreateExistenceConstraint(label, property);

src/query/dump.cpp

@@ -242,6 +242,10 @@ void DumpLabelIndex(std::ostream *os, query::DbAccessor *dba, const storage::Lab
   *os << "CREATE INDEX ON :" << EscapeName(dba->LabelToName(label)) << ";";
 }
 
+void DumpEdgeTypeIndex(std::ostream *os, query::DbAccessor *dba, const storage::EdgeTypeId edge_type) {
+  *os << "CREATE EDGE INDEX ON :" << EscapeName(dba->EdgeTypeToName(edge_type)) << ";";
+}
+
 void DumpLabelPropertyIndex(std::ostream *os, query::DbAccessor *dba, storage::LabelId label,
                             storage::PropertyId property) {
   *os << "CREATE INDEX ON :" << EscapeName(dba->LabelToName(label)) << "(" << EscapeName(dba->PropertyToName(property))
@@ -297,7 +301,9 @@ PullPlanDump::PullPlanDump(DbAccessor *dba, dbms::DatabaseAccess db_acc)
                    // Internal index cleanup
                    CreateInternalIndexCleanupPullChunk(),
                    // Dump all triggers
-                   CreateTriggersPullChunk()} {}
+                   CreateTriggersPullChunk(),
+                   // Dump all edge-type indices
+                   CreateEdgeTypeIndicesPullChunk()} {}
 
 bool PullPlanDump::Pull(AnyStream *stream, std::optional<int> n) {
   // Iterate all functions that stream some results.
@@ -352,6 +358,33 @@ PullPlanDump::PullChunk PullPlanDump::CreateLabelIndicesPullChunk() {
   };
 }
 
+PullPlanDump::PullChunk PullPlanDump::CreateEdgeTypeIndicesPullChunk() {
+  // Dump all label indices
+  return [this, global_index = 0U](AnyStream *stream, std::optional<int> n) mutable -> std::optional<size_t> {
+    // Delay the construction of indices vectors
+    if (!indices_info_) {
+      indices_info_.emplace(dba_->ListAllIndices());
+    }
+    const auto &edge_type = indices_info_->edge_type;
+
+    size_t local_counter = 0;
+    while (global_index < edge_type.size() && (!n || local_counter < *n)) {
+      std::ostringstream os;
+      DumpEdgeTypeIndex(&os, dba_, edge_type[global_index]);
+      stream->Result({TypedValue(os.str())});
+
+      ++global_index;
+      ++local_counter;
+    }
+
+    if (global_index == edge_type.size()) {
+      return local_counter;
+    }
+
+    return std::nullopt;
+  };
+}
+
 PullPlanDump::PullChunk PullPlanDump::CreateLabelPropertyIndicesPullChunk() {
   return [this, global_index = 0U](AnyStream *stream, std::optional<int> n) mutable -> std::optional<size_t> {
     // Delay the construction of indices vectors

src/query/dump.hpp

@@ -63,5 +63,6 @@ struct PullPlanDump {
   PullChunk CreateDropInternalIndexPullChunk();
   PullChunk CreateInternalIndexCleanupPullChunk();
   PullChunk CreateTriggersPullChunk();
+  PullChunk CreateEdgeTypeIndicesPullChunk();
 };
 }  // namespace memgraph::query

src/query/frontend/ast/ast.cpp

@@ -186,6 +186,9 @@ constexpr utils::TypeInfo query::ProfileQuery::kType{utils::TypeId::AST_PROFILE_
 
 constexpr utils::TypeInfo query::IndexQuery::kType{utils::TypeId::AST_INDEX_QUERY, "IndexQuery", &query::Query::kType};
 
+constexpr utils::TypeInfo query::EdgeIndexQuery::kType{utils::TypeId::AST_EDGE_INDEX_QUERY, "EdgeIndexQuery",
+                                                       &query::Query::kType};
+
 constexpr utils::TypeInfo query::Create::kType{utils::TypeId::AST_CREATE, "Create", &query::Clause::kType};
 
 constexpr utils::TypeInfo query::CallProcedure::kType{utils::TypeId::AST_CALL_PROCEDURE, "CallProcedure",

src/query/frontend/ast/ast.hpp

@@ -21,6 +21,7 @@
 #include "query/interpret/awesome_memgraph_functions.hpp"
 #include "query/typed_value.hpp"
 #include "storage/v2/property_value.hpp"
+#include "utils/exceptions.hpp"
 #include "utils/typeinfo.hpp"
 
 namespace memgraph::query {
@@ -2223,6 +2224,34 @@ class IndexQuery : public memgraph::query::Query {
   friend class AstStorage;
 };
 
+class EdgeIndexQuery : public memgraph::query::Query {
+ public:
+  static const utils::TypeInfo kType;
+  const utils::TypeInfo &GetTypeInfo() const override { return kType; }
+
+  enum class Action { CREATE, DROP };
+
+  EdgeIndexQuery() = default;
+
+  DEFVISITABLE(QueryVisitor<void>);
+
+  memgraph::query::EdgeIndexQuery::Action action_;
+  memgraph::query::EdgeTypeIx edge_type_;
+
+  EdgeIndexQuery *Clone(AstStorage *storage) const override {
+    EdgeIndexQuery *object = storage->Create<EdgeIndexQuery>();
+    object->action_ = action_;
+    object->edge_type_ = storage->GetEdgeTypeIx(edge_type_.name);
+    return object;
+  }
+
+ protected:
+  EdgeIndexQuery(Action action, EdgeTypeIx edge_type) : action_(action), edge_type_(edge_type) {}
+
+ private:
+  friend class AstStorage;
+};
+
 class Create : public memgraph::query::Clause {
  public:
   static const utils::TypeInfo kType;
@@ -2819,6 +2848,7 @@ class AuthQuery : public memgraph::query::Query {
     SHOW_ROLE_FOR_USER,
     SHOW_USERS_FOR_ROLE,
     GRANT_DATABASE_TO_USER,
+    DENY_DATABASE_FROM_USER,
     REVOKE_DATABASE_FROM_USER,
     SHOW_DATABASE_PRIVILEGES,
     SET_MAIN_DATABASE,
@@ -3034,8 +3064,6 @@ class ReplicationQuery : public memgraph::query::Query {
 
   enum class SyncMode { SYNC, ASYNC };
 
-  enum class ReplicaState { READY, REPLICATING, RECOVERY, MAYBE_BEHIND, DIVERGED_FROM_MAIN };
-
   ReplicationQuery() = default;
 
   DEFVISITABLE(QueryVisitor<void>);
@@ -3587,7 +3615,7 @@ class PatternComprehension : public memgraph::query::Expression {
   bool Accept(HierarchicalTreeVisitor &visitor) override {
     if (visitor.PreVisit(*this)) {
       if (variable_) {
-        variable_->Accept(visitor);
+        throw utils::NotYetImplemented("Variable in pattern comprehension.");
       }
       pattern_->Accept(visitor);
       if (filter_) {
@@ -3616,7 +3644,8 @@ class PatternComprehension : public memgraph::query::Expression {
   int32_t symbol_pos_{-1};
 
   PatternComprehension *Clone(AstStorage *storage) const override {
-    PatternComprehension *object = storage->Create<PatternComprehension>();
+    auto *object = storage->Create<PatternComprehension>();
+    object->variable_ = variable_ ? variable_->Clone(storage) : nullptr;
     object->pattern_ = pattern_ ? pattern_->Clone(storage) : nullptr;
     object->filter_ = filter_ ? filter_->Clone(storage) : nullptr;
     object->resultExpr_ = resultExpr_ ? resultExpr_->Clone(storage) : nullptr;
@@ -3626,7 +3655,8 @@ class PatternComprehension : public memgraph::query::Expression {
   }
 
  protected:
-  PatternComprehension(Identifier *variable, Pattern *pattern) : variable_(variable), pattern_(pattern) {}
+  PatternComprehension(Identifier *variable, Pattern *pattern, Where *filter, Expression *resultExpr)
+      : variable_(variable), pattern_(pattern), filter_(filter), resultExpr_(resultExpr) {}
 
  private:
   friend class AstStorage;

src/query/frontend/ast/ast_visitor.hpp

@@ -82,6 +82,7 @@ class AuthQuery;
 class ExplainQuery;
 class ProfileQuery;
 class IndexQuery;
+class EdgeIndexQuery;
 class DatabaseInfoQuery;
 class SystemInfoQuery;
 class ConstraintQuery;
@@ -143,11 +144,11 @@ class ExpressionVisitor
 
 template <class TResult>
 class QueryVisitor
-    : public utils::Visitor<TResult, CypherQuery, ExplainQuery, ProfileQuery, IndexQuery, AuthQuery, DatabaseInfoQuery,
-                            SystemInfoQuery, ConstraintQuery, DumpQuery, ReplicationQuery, LockPathQuery,
-                            FreeMemoryQuery, TriggerQuery, IsolationLevelQuery, CreateSnapshotQuery, StreamQuery,
-                            SettingQuery, VersionQuery, ShowConfigQuery, TransactionQueueQuery, StorageModeQuery,
-                            AnalyzeGraphQuery, MultiDatabaseQuery, ShowDatabasesQuery, EdgeImportModeQuery,
-                            CoordinatorQuery> {};
+    : public utils::Visitor<TResult, CypherQuery, ExplainQuery, ProfileQuery, IndexQuery, EdgeIndexQuery, AuthQuery,
+                            DatabaseInfoQuery, SystemInfoQuery, ConstraintQuery, DumpQuery, ReplicationQuery,
+                            LockPathQuery, FreeMemoryQuery, TriggerQuery, IsolationLevelQuery, CreateSnapshotQuery,
+                            StreamQuery, SettingQuery, VersionQuery, ShowConfigQuery, TransactionQueueQuery,
+                            StorageModeQuery, AnalyzeGraphQuery, MultiDatabaseQuery, ShowDatabasesQuery,
+                            EdgeImportModeQuery, CoordinatorQuery> {};
 
 }  // namespace memgraph::query

src/query/frontend/ast/cypher_main_visitor.cpp

@@ -265,6 +265,27 @@ antlrcpp::Any CypherMainVisitor::visitDropIndex(MemgraphCypher::DropIndexContext
   return index_query;
 }
 
+antlrcpp::Any CypherMainVisitor::visitEdgeIndexQuery(MemgraphCypher::EdgeIndexQueryContext *ctx) {
+  MG_ASSERT(ctx->children.size() == 1, "EdgeIndexQuery should have exactly one child!");
+  auto *index_query = std::any_cast<EdgeIndexQuery *>(ctx->children[0]->accept(this));
+  query_ = index_query;
+  return index_query;
+}
+
+antlrcpp::Any CypherMainVisitor::visitCreateEdgeIndex(MemgraphCypher::CreateEdgeIndexContext *ctx) {
+  auto *index_query = storage_->Create<EdgeIndexQuery>();
+  index_query->action_ = EdgeIndexQuery::Action::CREATE;
+  index_query->edge_type_ = AddEdgeType(std::any_cast<std::string>(ctx->labelName()->accept(this)));
+  return index_query;
+}
+
+antlrcpp::Any CypherMainVisitor::visitDropEdgeIndex(MemgraphCypher::DropEdgeIndexContext *ctx) {
+  auto *index_query = storage_->Create<EdgeIndexQuery>();
+  index_query->action_ = EdgeIndexQuery::Action::DROP;
+  index_query->edge_type_ = AddEdgeType(std::any_cast<std::string>(ctx->labelName()->accept(this)));
+  return index_query;
+}
+
 antlrcpp::Any CypherMainVisitor::visitAuthQuery(MemgraphCypher::AuthQueryContext *ctx) {
   MG_ASSERT(ctx->children.size() == 1, "AuthQuery should have exactly one child!");
   auto *auth_query = std::any_cast<AuthQuery *>(ctx->children[0]->accept(this));
@@ -1780,22 +1801,35 @@ antlrcpp::Any CypherMainVisitor::visitShowUsersForRole(MemgraphCypher::ShowUsers
 /**
  * @return AuthQuery*
  */
-antlrcpp::Any CypherMainVisitor::visitGrantDatabaseToUser(MemgraphCypher::GrantDatabaseToUserContext *ctx) {
+antlrcpp::Any CypherMainVisitor::visitGrantDatabaseToUserOrRole(MemgraphCypher::GrantDatabaseToUserOrRoleContext *ctx) {
   auto *auth = storage_->Create<AuthQuery>();
   auth->action_ = AuthQuery::Action::GRANT_DATABASE_TO_USER;
   auth->database_ = std::any_cast<std::string>(ctx->wildcardName()->accept(this));
-  auth->user_ = std::any_cast<std::string>(ctx->user->accept(this));
+  auth->user_ = std::any_cast<std::string>(ctx->userOrRole->accept(this));
   return auth;
 }
 
 /**
  * @return AuthQuery*
  */
-antlrcpp::Any CypherMainVisitor::visitRevokeDatabaseFromUser(MemgraphCypher::RevokeDatabaseFromUserContext *ctx) {
+antlrcpp::Any CypherMainVisitor::visitDenyDatabaseFromUserOrRole(
+    MemgraphCypher::DenyDatabaseFromUserOrRoleContext *ctx) {
+  auto *auth = storage_->Create<AuthQuery>();
+  auth->action_ = AuthQuery::Action::DENY_DATABASE_FROM_USER;
+  auth->database_ = std::any_cast<std::string>(ctx->wildcardName()->accept(this));
+  auth->user_ = std::any_cast<std::string>(ctx->userOrRole->accept(this));
+  return auth;
+}
+
+/**
+ * @return AuthQuery*
+ */
+antlrcpp::Any CypherMainVisitor::visitRevokeDatabaseFromUserOrRole(
+    MemgraphCypher::RevokeDatabaseFromUserOrRoleContext *ctx) {
   auto *auth = storage_->Create<AuthQuery>();
   auth->action_ = AuthQuery::Action::REVOKE_DATABASE_FROM_USER;
   auth->database_ = std::any_cast<std::string>(ctx->wildcardName()->accept(this));
-  auth->user_ = std::any_cast<std::string>(ctx->user->accept(this));
+  auth->user_ = std::any_cast<std::string>(ctx->userOrRole->accept(this));
   return auth;
 }
 
@@ -1805,7 +1839,7 @@ antlrcpp::Any CypherMainVisitor::visitRevokeDatabaseFromUser(MemgraphCypher::Rev
 antlrcpp::Any CypherMainVisitor::visitShowDatabasePrivileges(MemgraphCypher::ShowDatabasePrivilegesContext *ctx) {
   auto *auth = storage_->Create<AuthQuery>();
   auth->action_ = AuthQuery::Action::SHOW_DATABASE_PRIVILEGES;
-  auth->user_ = std::any_cast<std::string>(ctx->user->accept(this));
+  auth->user_ = std::any_cast<std::string>(ctx->userOrRole->accept(this));
   return auth;
 }
 
@@ -1816,7 +1850,7 @@ antlrcpp::Any CypherMainVisitor::visitSetMainDatabase(MemgraphCypher::SetMainDat
   auto *auth = storage_->Create<AuthQuery>();
   auth->action_ = AuthQuery::Action::SET_MAIN_DATABASE;
   auth->database_ = std::any_cast<std::string>(ctx->db->accept(this));
-  auth->user_ = std::any_cast<std::string>(ctx->user->accept(this));
+  auth->user_ = std::any_cast<std::string>(ctx->userOrRole->accept(this));
   return auth;
 }