Examples with AccessMode org.neo4j.internal.kernel.api.security.AccessMode used on opensource projects

Example 1 with AccessMode

use of org.neo4j.internal.kernel.api.security.AccessMode in project neo4j by neo4j.

the class BuiltInProcedures method listRelationshipTypes.

@SystemProcedure
@Description("List all available relationship types in the database.")
@Procedure(name = "db.relationshipTypes", mode = READ)
public Stream<RelationshipTypeResult> listRelationshipTypes() {
    if (callContext.isSystemDatabase()) {
        return Stream.empty();
    }
    AccessMode mode = kernelTransaction.securityContext().mode();
    TokenRead tokenRead = kernelTransaction.tokenRead();
    List<RelationshipTypeResult> relTypesInUse;
    try (KernelTransaction.Revertable ignore = kernelTransaction.overrideWith(SecurityContext.AUTH_DISABLED)) {
        // Get all relTypes that are in use as seen by a super user
        relTypesInUse = stream(RELATIONSHIP_TYPES.inUse(kernelTransaction)).filter(type -> mode.allowsTraverseRelType(tokenRead.relationshipType(type.name()))).map(RelationshipTypeResult::new).collect(Collectors.toList());
    }
    return relTypesInUse.stream();
}

Example 2 with AccessMode

use of org.neo4j.internal.kernel.api.security.AccessMode in project neo4j by neo4j.

the class SchemaProcedure method buildSchemaGraph.

public GraphResult buildSchemaGraph() {
    final Map<String, VirtualNodeHack> nodes = new HashMap<>();
    final Map<String, Set<VirtualRelationshipHack>> relationships = new HashMap<>();
    final KernelTransaction kernelTransaction = internalTransaction.kernelTransaction();
    AccessMode mode = kernelTransaction.securityContext().mode();
    try (KernelTransaction.Revertable ignore = kernelTransaction.overrideWith(SecurityContext.AUTH_DISABLED)) {
        Read dataRead = kernelTransaction.dataRead();
        TokenRead tokenRead = kernelTransaction.tokenRead();
        SchemaRead schemaRead = kernelTransaction.schemaRead();
        List<Pair<String, Integer>> labelNamesAndIds = new ArrayList<>();
        // Get all labels that are in use as seen by a super user
        List<Label> labelsInUse = stream(LABELS.inUse(kernelTransaction)).collect(Collectors.toList());
        for (Label label : labelsInUse) {
            String labelName = label.name();
            int labelId = tokenRead.nodeLabel(labelName);
            // Filter out labels that are denied or aren't explicitly allowed
            if (mode.allowsTraverseNode(labelId)) {
                labelNamesAndIds.add(Pair.of(labelName, labelId));
                Map<String, Object> properties = new HashMap<>();
                Iterator<IndexDescriptor> indexReferences = schemaRead.indexesGetForLabel(labelId);
                List<String> indexes = new ArrayList<>();
                while (indexReferences.hasNext()) {
                    IndexDescriptor index = indexReferences.next();
                    if (!index.isUnique()) {
                        String[] propertyNames = PropertyNameUtils.getPropertyKeys(tokenRead, index.schema().getPropertyIds());
                        indexes.add(String.join(",", propertyNames));
                    }
                }
                properties.put("indexes", indexes);
                Iterator<ConstraintDescriptor> nodePropertyConstraintIterator = schemaRead.constraintsGetForLabel(labelId);
                List<String> constraints = new ArrayList<>();
                while (nodePropertyConstraintIterator.hasNext()) {
                    ConstraintDescriptor constraint = nodePropertyConstraintIterator.next();
                    constraints.add(constraint.userDescription(tokenRead));
                }
                properties.put("constraints", constraints);
                getOrCreateLabel(label.name(), properties, nodes);
            }
        }
        // Get all relTypes that are in use as seen by a super user
        List<RelationshipType> relTypesInUse = stream(RELATIONSHIP_TYPES.inUse(kernelTransaction)).collect(Collectors.toList());
        for (RelationshipType relationshipType : relTypesInUse) {
            String relationshipTypeGetName = relationshipType.name();
            int relId = tokenRead.relationshipType(relationshipTypeGetName);
            // Filter out relTypes that are denied or aren't explicitly allowed
            if (mode.allowsTraverseRelType(relId)) {
                List<VirtualNodeHack> startNodes = new LinkedList<>();
                List<VirtualNodeHack> endNodes = new LinkedList<>();
                for (Pair<String, Integer> labelNameAndId : labelNamesAndIds) {
                    String labelName = labelNameAndId.first();
                    int labelId = labelNameAndId.other();
                    Map<String, Object> properties = new HashMap<>();
                    VirtualNodeHack node = getOrCreateLabel(labelName, properties, nodes);
                    if (dataRead.countsForRelationship(labelId, relId, TokenRead.ANY_LABEL) > 0) {
                        startNodes.add(node);
                    }
                    if (dataRead.countsForRelationship(TokenRead.ANY_LABEL, relId, labelId) > 0) {
                        endNodes.add(node);
                    }
                }
                for (VirtualNodeHack startNode : startNodes) {
                    for (VirtualNodeHack endNode : endNodes) {
                        addRelationship(startNode, endNode, relationshipTypeGetName, relationships);
                    }
                }
            }
        }
    }
    return getGraphResult(nodes, relationships);
}

Example 3 with AccessMode

use of org.neo4j.internal.kernel.api.security.AccessMode in project neo4j by neo4j.

the class KernelToken method labelsGetAllTokens.

@Override
public Iterator<NamedToken> labelsGetAllTokens() {
    ktx.assertOpen();
    AccessMode mode = ktx.securityContext().mode();
    return Iterators.stream(tokenHolders.labelTokens().getAllTokens().iterator()).filter(label -> mode.allowsTraverseNode(label.id())).iterator();
}

Example 4 with AccessMode

use of org.neo4j.internal.kernel.api.security.AccessMode in project neo4j by neo4j.

the class AllStoreHolder method nodeExists.

@Override
public boolean nodeExists(long reference) {
    ktx.assertOpen();
    if (hasTxStateWithChanges()) {
        TransactionState txState = txState();
        if (txState.nodeIsDeletedInThisTx(reference)) {
            return false;
        } else if (txState.nodeIsAddedInThisTx(reference)) {
            return true;
        }
    }
    AccessMode mode = ktx.securityContext().mode();
    boolean existsInNodeStore = storageReader.nodeExists(reference, ktx.cursorContext());
    if (mode.allowsTraverseAllLabels()) {
        return existsInNodeStore;
    } else if (!existsInNodeStore) {
        return false;
    } else {
        // DefaultNodeCursor already contains traversal checks within next()
        try (DefaultNodeCursor node = cursors.allocateNodeCursor(ktx.cursorContext())) {
            ktx.dataRead().singleNode(reference, node);
            return node.next();
        }
    }
}

Example 5 with AccessMode

use of org.neo4j.internal.kernel.api.security.AccessMode in project neo4j by neo4j.

the class AllStoreHolder method callProcedure.

private RawIterator<AnyValue[], ProcedureException> callProcedure(int id, AnyValue[] input, final AccessMode.Static procedureMode, ProcedureCallContext procedureCallContext) throws ProcedureException {
    ktx.assertOpen();
    AccessMode mode = ktx.securityContext().mode();
    if (!mode.allowsExecuteProcedure(id)) {
        String message = format("Executing procedure is not allowed for %s.", ktx.securityContext().description());
        throw ktx.securityAuthorizationHandler().logAndGetAuthorizationException(ktx.securityContext(), message);
    }
    final SecurityContext procedureSecurityContext = mode.shouldBoostProcedure(id) ? ktx.securityContext().withMode(new OverriddenAccessMode(mode, procedureMode)).withMode(AdminAccessMode.FULL) : ktx.securityContext().withMode(new RestrictedAccessMode(mode, procedureMode));
    final RawIterator<AnyValue[], ProcedureException> procedureCall;
    try (KernelTransaction.Revertable ignore = ktx.overrideWith(procedureSecurityContext);
        Statement statement = ktx.acquireStatement()) {
        procedureCall = globalProcedures.callProcedure(prepareContext(procedureSecurityContext, procedureCallContext), id, input, statement);
    }
    return createIterator(procedureSecurityContext, procedureCall);
}