Overview
Privileges are a key access control mechanism that determine the operations a user can perform on the graph database. They enforce security by restricting access to specific operations, such as querying, updating, or administering the database. A set of privileges can be granted to a role, which can then be assigned to users. Alternatively, individual privileges can be directly assigned to users.
Types of Privileges in Ultipa:
- Graph privileges: Includes operations for manipulating and reading data and structure of specific graphs, as well as managing their indexes, jobs, HDC graphs, etc.
- System privileges: Includes operations for managing graphs, processes, privileges, roles, users, servers, etc., within the database.
- Property privileges: Includes
read,write, anddeny, applied specifically to certain properties.
For details of each privilege, please refer to All Privileges.
All Privileges
Graph Privileges
Privilege |
Description | UQL |
|---|---|---|
READ |
Reads data from graphs. | find(), ab(), autonet(), spread(), khop(), n()...n() |
INSERT |
Inserts nodes and edges into graphs. | insert() |
UPSERT |
Updates or inserts nodes and edges in graphs. | upsert() |
UPDATE |
Updates nodes and edges in graphs. | update() |
DELETE |
Deletes nodes and edges in graphs. | delete() |
CREATE_SCHEMA |
Creates schemas in graphs. | create().node_schema(), create().edge_schema() |
DROP_SCHEMA |
Drops schemas in graphs. | drop().node_schema(), drop().edge_schema() |
ALTER_SCHEMA |
Alters schemas in graphs. | alter().node_schema(), alter().edge_schema() |
SHOW_SCHEMA |
Shows schemas in graphs. | show().schema(), show().node_schema(), show().edge_schema() |
RELOAD_SCHEMA |
Reloads the total number of nodes and edges in graphs. | db.schema.reload() |
CREATE_PROPERTY |
Creates properties in graphs. | create().node_property(), create().edge_property() |
DROP_PROPERTY |
Drops properties in graphs. | drop().node_property(), drop().edge_property() |
ALTER_PROPERTY |
Alters properties in graphs. | alter().node_property(), alter().edge_property() |
SHOW_PROPERTY |
Shows properties in graphs. | show().property(), show().node_property(), show().edge_property() |
CREATE_FULLTEXT |
Creates full-text indexes in graphs. | create().node_fulltext(), create().edge_fulltext() |
DROP_FULLTEXT |
Drop full-text indexes in graphs. | drop().node_fulltext(), drop().edge_fulltext() |
SHOW_FULLTEXT |
Shows full-text indexes in graphs. | show().fulltext(), show().node_fulltext(), show().edge_fulltext() |
CREATE_INDEX |
Creates indexes in graphs. | create().node_index(), create().edge_index() |
DROP_INDEX |
Drops indexes in graphs. | drop().node_index(), drop().edge_index() |
SHOW_INDEX |
Shows indexes in graphs. | show().index(), show().node_index(), show().edge_index() |
LTE |
Loads properties from disk into the computing engine. | LTE().node_property(), LTE().edge_property() |
UFE |
Unloads properties from the computing engine. | UFE().node_property(), UFE().edge_property() |
CLEAR_JOB |
Clear jobs in graphs. | clear().job() |
STOP_JOB |
Stops jobs in graphs. | stop().job() |
SHOW_JOB |
Shows jobs in graphs. | show().job() |
ALGO |
Runs algorithms for graphs. | algo() |
CREATE_PROJECT |
Creates distributed projections for graphs. | create().projection() |
SHOW_PROJECT |
Shows distributed projections of graphs. | show().projection() |
DROP_PROJECT |
Drops distributed projections of graphs. | drop().projection() |
CREATE_HDC_GRAPH |
Creates HDC graphs for graphs. | hdc.graph.create() |
SHOW_HDC_GRAPH |
Shows HDC graphs of graphs. | hdc.graph.show() |
DROP_HDC_GRAPH |
Drops HDC graphs of graphs. | hdc.graph.drop() |
COMPACT_HDC_GRAPH |
Compacts HDC graphs of graphs. | hdc.graph.compact() |
System Privileges
Privilege |
Description | UQL |
|---|---|---|
TRUNCATE |
Truncates graphs in database. | truncate().graph() |
COMPACT |
Compacts graphs in database. | compact().graph() |
CREATE_GRAPH |
Creates graphs in database. | create().graph() |
SHOW_GRAPH |
Shows graphs in database. | show().graph() |
DROP_GRAPH |
Drops graphs in database. | drop().graph() |
ALTER_GRAPH |
Alters graphs in database. | alter().graph() |
TOP |
Shows processes in database. | top() |
KILL |
Kills processes in database. | kill() |
STAT |
Shows statistics of the database. | stats() |
SHOW_POLICY |
Shows policies in database. | show().policy() |
CREATE_POLICY |
Creates policies in database. | create().policy() |
DROP_POLICY |
Drops policies in database. | drop().policy() |
ALTER_POLICY |
Alters policies in database. | alter().policy() |
SHOW_USER |
Shows users in database. | show().user() |
CREATE_USER |
Creates users in database. | create().user() |
DROP_USER |
Drops users in database. | drop().user() |
ALTER_USER |
Alters users in database. | alter().user() |
SHOW_PRIVILEGE |
Shows privileges in database. | show().privilege() |
SHOW_META |
Show meta servers of the database. | show().meta() |
SHOW_SHARD |
Show shard servers of the database. | show().shard() |
ADD_SHARD |
Adds shard servers to the database. | alter().shard().add() |
DELETE_SHARD |
Deletes shard servers from the database. | alter().shard().delete() |
SHOW_HDC_SERVER |
Show HDC servers of the database. | show().hdc() |
ADD_HDC_SERVER |
Adds HDC servers to the database. | alter().hdc().add() |
DELETE_HDC_SERVER |
Deletes HDC servers from the database. | alter().hdc().delete() |
LICENSE_UPDATE |
Updates license of the database. | license().update() |
LICENSE_DUMP |
Dumps license of the database. | license().dump() |
Property Privileges
Privilege |
Description |
|---|---|
read |
Allows reading a specific property in graphs. |
write |
Allows both reading and writing a specific property in graphs. |
deny |
Denies the right to read or write a specific property in graphs. deny takes precedence over read and write. If both deny and read (or write) are granted to a user or policy, the effective privilege is deny. |
read
If the read privilege for the @user.name property is not granted:
Operation |
Examples |
|---|---|
| Return the property | find().nodes({@user}) as n return n{*}This query will exclude the name property from the results.find().nodes({@user}) as n return n.nameThis query throws an error as you cannot read the name property. |
| Filter the property | find().nodes({name == "johndoe"}) as n return nThis query throws an error as you cannot read the name property. |
| Export | You cannot export the properties which you cannot read. |
write
If the write privilege for the @user.name property is not granted:
Operation |
Examples |
|---|---|
| Insert | insert().into(@user).nodes({_id: "U873", name:"johndoe"})This query throws an error as you cannot write the name property.insert().into(@user).nodes({_id: "U873"})This query inserts a @user node with its _id set to U873, while name and other properties set to null. |
| Overwrite | insert().overwrite().into(@user).nodes({_id: "U872"})This query throws an error since the insert().overwrite().into() operation requires full write privilege on the target schema. |
| Upsert | upsert().into(@user).nodes({_id: "U873", name:"johndoe"})This query throws an error as you cannot write the name property.upsert().into(@user).nodes({_id: "U873", level: "2"})This query either:
|
| Update | update().nodes({@user._id == "U873"}).nodes({name: "johndoe"})This query throws an error as you cannot write the name property.update().nodes({@user._id == "U873"}).nodes({level: "2"})This query updates the level of the node U873 to 2, while leaving other properties unchanged. |
| Delete | You can delete properties, nodes or edges even if you don't have write privileges, as long as you possess the DELETE and DROP_PROPERTY graph privileges. |