Skip to content

Instantly share code, notes, and snippets.

@mikesname

mikesname/GraphGist-SimpleRBAC.adoc

Last active November 13, 2024 21:03
Download ZIP

Revisions

  1. mikesname revised this gist Jul 16, 2013. 1 changed file with 5 additions and 5 deletions.
    10 changes: 5 additions & 5 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -48,7 +48,7 @@ First, check what items are accessible to everyone, because they have no constra
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors
    WHERE items.type! = 'item' AND access IS NULL
    RETURN items
    RETURN DISTINCT items
    ----

    //table
    @@ -61,7 +61,7 @@ Now lets list all items accessible to 'user1'. The result should include 'item1'
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    RETURN DISTINCT items
    ----

    //table
    @@ -74,7 +74,7 @@ Okay, that seems to work. Likewise, if we try the same thing with 'user2' we sho
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN items
    RETURN DISTINCT items
    ----

    Check if item is 'item1' is accessible to 'user1':
    @@ -84,7 +84,7 @@ Check if item is 'item1' is accessible to 'user1':
    START item = node(*)
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
    RETURN DISTINCT item, access
    ----

    Right, now let's create a new user and grant them exclusive access to 'item3':
    @@ -107,7 +107,7 @@ Now we've added a constraint to 'item3', 'user1' should only have access to 'ite
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    RETURN DISTINCT items
    ----

    //table
  2. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -54,7 +54,7 @@ RETURN items
    //table


    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO admins, and user1 belongs to role1, which in turn belongs to admins) and item3 which has no access constraints at all.
    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO 'admins', and 'user1' belongs to 'role1', which in turn belongs to 'admins') and 'item3' which has no access constraints at all.

    [source,cypher]
    ----
  3. mikesname revised this gist Jul 16, 2013. 1 changed file with 7 additions and 7 deletions.
    14 changes: 7 additions & 7 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -67,7 +67,7 @@ RETURN items
    //table


    Okay, that seems to work. Likewise, if we try the same thing with user2 we should be item2 and item3:
    Okay, that seems to work. Likewise, if we try the same thing with 'user2' we should be 'item2' and 'item3':

    [source,cypher]
    ----
    @@ -87,7 +87,7 @@ WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.n
    RETURN item, access
    ----

    Right, now let's create a new user and grant them exclusive access to item3:
    Right, now let's create a new user and grant them exclusive access to 'item3':

    [source,cypher]
    ----
    @@ -100,7 +100,7 @@ RETURN user3
    //table


    Now we've added a constraint to item3, user1 should only have access to item1:
    Now we've added a constraint to 'item3', 'user1' should only have access to 'item1':

    [source,cypher]
    ----
    @@ -113,8 +113,8 @@ RETURN items
    //table


    The above queries should now change so that user1 only has access to item1, user2 to item2, and user3 to item3. Note that the method of access is different:
    The above queries should now change so that 'user1' only has access to 'item1', 'user2' to 'item2', and 'user3' to 'item3'. Note that the method of access is different:

    * user1 belongs to role1, which belongs to admin, which has access to item1
    * user2 belongs to role2, which has direct access to item2
    * user3 has direct access to item3
    * 'user1' belongs to 'role1', which belongs to 'admin', which has access to 'item1'
    * 'user2' belongs to 'role2', which has direct access to 'item2'
    * 'user3' has direct access to 'item3'
  4. mikesname revised this gist Jul 16, 2013. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -97,7 +97,8 @@ CREATE (user3 { type: 'user', name: 'user3' }), item-[r:ACCESSIBLE_TO]->user3
    RETURN user3
    ----

    //graph
    //table


    Now we've added a constraint to item3, user1 should only have access to item1:

    @@ -111,6 +112,7 @@ RETURN items

    //table


    The above queries should now change so that user1 only has access to item1, user2 to item2, and user3 to item3. Note that the method of access is different:

    * user1 belongs to role1, which belongs to admin, which has access to item1
  5. mikesname revised this gist Jul 16, 2013. 1 changed file with 7 additions and 7 deletions.
    14 changes: 7 additions & 7 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -48,7 +48,7 @@ First, check what items are accessible to everyone, because they have no constra
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors
    WHERE items.type! = 'item' AND access IS NULL
    RETURN DISTINCT items.name
    RETURN items
    ----

    //table
    @@ -61,7 +61,7 @@ Now lets list all items accessible to 'user1'. The result should include 'item1'
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN DISTINCT items.name
    RETURN items
    ----

    //table
    @@ -74,7 +74,7 @@ Okay, that seems to work. Likewise, if we try the same thing with user2 we shoul
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN DISTINCT items.name
    RETURN items
    ----

    Check if item is 'item1' is accessible to 'user1':
    @@ -84,7 +84,7 @@ Check if item is 'item1' is accessible to 'user1':
    START item = node(*)
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN DISTINCT item.name, access
    RETURN item, access
    ----

    Right, now let's create a new user and grant them exclusive access to item3:
    @@ -94,7 +94,7 @@ Right, now let's create a new user and grant them exclusive access to item3:
    MATCH item
    WHERE item.name! = 'item3'
    CREATE (user3 { type: 'user', name: 'user3' }), item-[r:ACCESSIBLE_TO]->user3
    RETURN user3.name
    RETURN user3
    ----

    //graph
    @@ -106,7 +106,7 @@ Now we've added a constraint to item3, user1 should only have access to item1:
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN DISTINCT items.name
    RETURN items
    ----

    //table
    @@ -115,4 +115,4 @@ The above queries should now change so that user1 only has access to item1, user

    * user1 belongs to role1, which belongs to admin, which has access to item1
    * user2 belongs to role2, which has direct access to item2
    * user3 has direct access to item3
    * user3 has direct access to item3
  6. mikesname revised this gist Jul 16, 2013. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -40,6 +40,7 @@ RETURN admins, role1, role2, user1, user2, item1, item2, item3

    //graph


    First, check what items are accessible to everyone, because they have no constraints. This should return just item3.

    [source,cypher]
    @@ -52,6 +53,7 @@ RETURN DISTINCT items.name

    //table


    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO admins, and user1 belongs to role1, which in turn belongs to admins) and item3 which has no access constraints at all.

    [source,cypher]
    @@ -63,6 +65,8 @@ RETURN DISTINCT items.name
    ----

    //table


    Okay, that seems to work. Likewise, if we try the same thing with user2 we should be item2 and item3:

    [source,cypher]
  7. mikesname revised this gist Jul 16, 2013. 1 changed file with 5 additions and 5 deletions.
    10 changes: 5 additions & 5 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -47,7 +47,7 @@ First, check what items are accessible to everyone, because they have no constra
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors
    WHERE items.type! = 'item' AND access IS NULL
    RETURN items.name
    RETURN DISTINCT items.name
    ----

    //table
    @@ -59,7 +59,7 @@ Now lets list all items accessible to 'user1'. The result should include 'item1'
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items.name
    RETURN DISTINCT items.name
    ----

    //table
    @@ -70,7 +70,7 @@ Okay, that seems to work. Likewise, if we try the same thing with user2 we shoul
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN items.name
    RETURN DISTINCT items.name
    ----

    Check if item is 'item1' is accessible to 'user1':
    @@ -80,7 +80,7 @@ Check if item is 'item1' is accessible to 'user1':
    START item = node(*)
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item.name, access
    RETURN DISTINCT item.name, access
    ----

    Right, now let's create a new user and grant them exclusive access to item3:
    @@ -102,7 +102,7 @@ Now we've added a constraint to item3, user1 should only have access to item1:
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items.name
    RETURN DISTINCT items.name
    ----

    //table
  8. mikesname revised this gist Jul 16, 2013. 1 changed file with 20 additions and 6 deletions.
    26 changes: 20 additions & 6 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -35,7 +35,7 @@ CREATE
    (item3 { type: 'item', name: 'item3' })
    RETURN admins, role1, role2, user1, user2, item1, item2
    RETURN admins, role1, role2, user1, user2, item1, item2, item3
    ----

    //graph
    @@ -47,7 +47,7 @@ First, check what items are accessible to everyone, because they have no constra
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors
    WHERE items.type! = 'item' AND access IS NULL
    RETURN items
    RETURN items.name
    ----

    //table
    @@ -59,7 +59,7 @@ Now lets list all items accessible to 'user1'. The result should include 'item1'
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    RETURN items.name
    ----

    //table
    @@ -70,7 +70,7 @@ Okay, that seems to work. Likewise, if we try the same thing with user2 we shoul
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN items
    RETURN items.name
    ----

    Check if item is 'item1' is accessible to 'user1':
    @@ -80,7 +80,7 @@ Check if item is 'item1' is accessible to 'user1':
    START item = node(*)
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
    RETURN item.name, access
    ----

    Right, now let's create a new user and grant them exclusive access to item3:
    @@ -90,9 +90,23 @@ Right, now let's create a new user and grant them exclusive access to item3:
    MATCH item
    WHERE item.name! = 'item3'
    CREATE (user3 { type: 'user', name: 'user3' }), item-[r:ACCESSIBLE_TO]->user3
    RETURN user3
    RETURN user3.name
    ----

    //graph

    Now we've added a constraint to item3, user1 should only have access to item1:

    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items.name
    ----

    //table

    The above queries should now change so that user1 only has access to item1, user2 to item2, and user3 to item3. Note that the method of access is different:

    * user1 belongs to role1, which belongs to admin, which has access to item1
  9. mikesname revised this gist Jul 16, 2013. 1 changed file with 5 additions and 0 deletions.
    5 changes: 5 additions & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -38,6 +38,8 @@ CREATE
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    //graph

    First, check what items are accessible to everyone, because they have no constraints. This should return just item3.

    [source,cypher]
    @@ -48,6 +50,8 @@ WHERE items.type! = 'item' AND access IS NULL
    RETURN items
    ----

    //table

    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO admins, and user1 belongs to role1, which in turn belongs to admins) and item3 which has no access constraints at all.

    [source,cypher]
    @@ -58,6 +62,7 @@ WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    ----

    //table
    Okay, that seems to work. Likewise, if we try the same thing with user2 we should be item2 and item3:

    [source,cypher]
  10. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -38,7 +38,7 @@ CREATE
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    First, check what items are accessible to everyone, because they have no constraints:
    First, check what items are accessible to everyone, because they have no constraints. This should return just item3.

    [source,cypher]
    ----
  11. mikesname revised this gist Jul 16, 2013. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -87,3 +87,9 @@ WHERE item.name! = 'item3'
    CREATE (user3 { type: 'user', name: 'user3' }), item-[r:ACCESSIBLE_TO]->user3
    RETURN user3
    ----

    The above queries should now change so that user1 only has access to item1, user2 to item2, and user3 to item3. Note that the method of access is different:

    * user1 belongs to role1, which belongs to admin, which has access to item1
    * user2 belongs to role2, which has direct access to item2
    * user3 has direct access to item3
  12. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -72,6 +72,7 @@ Check if item is 'item1' is accessible to 'user1':

    [source,cypher]
    ----
    START item = node(*)
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
  13. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -33,7 +33,7 @@ CREATE
    item2-[r5:ACCESSIBLE_TO]->role2,
    (item3 { type: 'item', name: 'item3' }),
    (item3 { type: 'item', name: 'item3' })
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----
  14. mikesname revised this gist Jul 16, 2013. 1 changed file with 3 additions and 7 deletions.
    10 changes: 3 additions & 7 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -25,8 +25,6 @@ CREATE
    user2-[r3:BELONGS_TO]->role2,
    (user3 { type: 'user', name: 'user3' }),
    (item1 { type: 'item', name: 'item1' }),
    item1-[r4:ACCESSIBLE_TO]->admins,
    @@ -37,8 +35,6 @@ CREATE
    (item3 { type: 'item', name: 'item3' }),
    item3-[r6:ACCESSIBLE_TO]->user3
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    @@ -57,7 +53,7 @@ Now lets list all items accessible to 'user1'. The result should include 'item1'
    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors, users = user-[BELONGS_TO*]->accessors
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    ----
    @@ -67,7 +63,7 @@ Okay, that seems to work. Likewise, if we try the same thing with user2 we shoul
    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors, users = user-[BELONGS_TO*]->accessors
    MATCH access = items-[r1?:ACCESSIBLE_TO]->accessors, users = user-[r2?:BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN items
    ----
    @@ -76,7 +72,7 @@ Check if item is 'item1' is accessible to 'user1':

    [source,cypher]
    ----
    MATCH access = item-[ACCESSIBLE_TO]->accessor, users = user-[BELONGS_TO*]->accessor
    MATCH access = item-[r1?:ACCESSIBLE_TO]->accessor, users = user-[r2?:BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
    ----
  15. mikesname revised this gist Jul 16, 2013. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -35,7 +35,8 @@ CREATE
    item2-[r5:ACCESSIBLE_TO]->role2,
    (item3 { type: 'item', name: 'item3' })
    (item3 { type: 'item', name: 'item3' }),
    item3-[r6:ACCESSIBLE_TO]->user3
    RETURN admins, role1, role2, user1, user2, item1, item2
  16. mikesname revised this gist Jul 16, 2013. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -25,6 +25,8 @@ CREATE
    user2-[r3:BELONGS_TO]->role2,
    (user3 { type: 'user', name: 'user3' }),
    (item1 { type: 'item', name: 'item1' }),
    item1-[r4:ACCESSIBLE_TO]->admins,
    @@ -34,6 +36,7 @@ CREATE
    item2-[r5:ACCESSIBLE_TO]->role2,
    (item3 { type: 'item', name: 'item3' })
    item3-[r6:ACCESSIBLE_TO]->user3
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----
  17. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -83,6 +83,6 @@ Right, now let's create a new user and grant them exclusive access to item3:
    ----
    MATCH item
    WHERE item.name! = 'item3'
    CREATE item-[ACCESSIBLE_TO]->(user3 { type: 'user', name: 'user3' })
    CREATE (user3 { type: 'user', name: 'user3' }), item-[r:ACCESSIBLE_TO]->user3
    RETURN user3
    ----
  18. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -81,7 +81,7 @@ Right, now let's create a new user and grant them exclusive access to item3:

    [source,cypher]
    ----
    MATCH item = node(*)
    MATCH item
    WHERE item.name! = 'item3'
    CREATE item-[ACCESSIBLE_TO]->(user3 { type: 'user', name: 'user3' })
    RETURN user3
  19. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -81,7 +81,7 @@ Right, now let's create a new user and grant them exclusive access to item3:

    [source,cypher]
    ----
    START item = node(*)
    MATCH item = node(*)
    WHERE item.name! = 'item3'
    CREATE item-[ACCESSIBLE_TO]->(user3 { type: 'user', name: 'user3' })
    RETURN user3
  20. mikesname revised this gist Jul 16, 2013. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -83,6 +83,6 @@ Right, now let's create a new user and grant them exclusive access to item3:
    ----
    START item = node(*)
    WHERE item.name! = 'item3'
    CREATE (user3 { type: 'user', name: 'user3' })<-[r:ACCESSIBLE_TO]-item
    CREATE item-[ACCESSIBLE_TO]->(user3 { type: 'user', name: 'user3' })
    RETURN user3
    ----
  21. mikesname revised this gist Jul 16, 2013. 1 changed file with 10 additions and 0 deletions.
    10 changes: 10 additions & 0 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -38,6 +38,16 @@ CREATE
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    First, check what items are accessible to everyone, because they have no constraints:

    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors
    WHERE items.type! = 'item' AND access IS NULL
    RETURN items
    ----

    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO admins, and user1 belongs to role1, which in turn belongs to admins) and item3 which has no access constraints at all.

    [source,cypher]
  22. mikesname revised this gist Jul 16, 2013. 1 changed file with 3 additions and 1 deletion.
    4 changes: 3 additions & 1 deletion GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -71,6 +71,8 @@ Right, now let's create a new user and grant them exclusive access to item3:

    [source,cypher]
    ----
    CREATE (user3 { type: 'user', name: 'user3' })<-[r:ACCESSIBLE_TO]-item3
    START item = node(*)
    WHERE item.name! = 'item3'
    CREATE (user3 { type: 'user', name: 'user3' })<-[r:ACCESSIBLE_TO]-item
    RETURN user3
    ----
  23. mikesname revised this gist Jul 16, 2013. 1 changed file with 16 additions and 8 deletions.
    24 changes: 16 additions & 8 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -9,31 +9,31 @@ First, lets create our basic example data:
    [source,cypher]
    ----
    CREATE
    (admins { type: 'role', name: 'admins'}),
    (admins { type: 'role', name: 'admins' }),
    (role1 { type: 'role', name: 'role1'}),
    (role1 { type: 'role', name: 'role1' }),
    role1-[r1:BELONGS_TO]->admins,
    (role2 { type: 'role', name: 'role2'}),
    (role2 { type: 'role', name: 'role2' }),
    (user1 { type: 'user', name: 'user1'}),
    (user1 { type: 'user', name: 'user1' }),
    user1-[r2:BELONGS_TO]->role1,
    (user2 { type: 'user', name: 'user2'}),
    (user2 { type: 'user', name: 'user2' }),
    user2-[r3:BELONGS_TO]->role2,
    (item1 { type: 'item', name: 'item1'}),
    (item1 { type: 'item', name: 'item1' }),
    item1-[r4:ACCESSIBLE_TO]->admins,
    (item2 { type: 'item', name: 'item2'}),
    (item2 { type: 'item', name: 'item2' }),
    item2-[r5:ACCESSIBLE_TO]->role2,
    (item3 { type: 'item', name: 'item3'})
    (item3 { type: 'item', name: 'item3' })
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----
    @@ -66,3 +66,11 @@ MATCH access = item-[ACCESSIBLE_TO]->accessor, users = user-[BELONGS_TO*]->acces
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
    ----

    Right, now let's create a new user and grant them exclusive access to item3:

    [source,cypher]
    ----
    CREATE (user3 { type: 'user', name: 'user3' })<-[r:ACCESSIBLE_TO]-item3
    RETURN user3
    ----
  24. mikesname revised this gist Jul 16, 2013. 1 changed file with 11 additions and 2 deletions.
    13 changes: 11 additions & 2 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -38,7 +38,7 @@ CREATE
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    Now lets list all items accessible to 'user1':
    Now lets list all items accessible to 'user1'. The result should include 'item1' (because it is ACCESSIBLE_TO admins, and user1 belongs to role1, which in turn belongs to admins) and item3 which has no access constraints at all.

    [source,cypher]
    ----
    @@ -48,12 +48,21 @@ WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    ----

    Okay, that seems to work. Likewise, if we try the same thing with user2 we should be item2 and item3:

    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors, users = user-[BELONGS_TO*]->accessors
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user2')
    RETURN items
    ----

    Check if item is 'item1' is accessible to 'user1':

    [source,cypher]
    ----
    MATCH access = item-[ACCESSIBLE_TO]->accessor, users = user-[BELONGS_TO*]->accessor
    WHERE item.type! = 'item' AND item.name! = 'item1' AND user.name! = 'user1'
    WHERE item.type! = 'item' AND item.name! = 'item1' AND (access IS NULL OR user.name! = 'user1')
    RETURN item, access
    ----
  25. mikesname revised this gist Jul 16, 2013. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,7 @@ Now lets list all items accessible to 'user1':
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors, users = user-[BELONGS_TO*]->accessors
    WHERE items.type = 'item' AND (access IS NULL OR user.name = 'user1')
    WHERE items.type! = 'item' AND (access IS NULL OR user.name! = 'user1')
    RETURN items
    ----

    @@ -54,6 +54,6 @@ Check if item is 'item1' is accessible to 'user1':
    [source,cypher]
    ----
    MATCH access = item-[ACCESSIBLE_TO]->accessor, users = user-[BELONGS_TO*]->accessor
    WHERE item.type='item' AND item.name = 'item1' AND user.name = 'user1'
    WHERE item.type! = 'item' AND item.name! = 'item1' AND user.name! = 'user1'
    RETURN item, access
    ----
  26. mikesname revised this gist Jul 16, 2013. 1 changed file with 25 additions and 3 deletions.
    28 changes: 25 additions & 3 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -15,12 +15,12 @@ CREATE
    role1-[r1:BELONGS_TO]->admins,
    (role2 { type: 'role', name: 'role2'}),
    (user1 { type: 'user', name: 'user1'}),
    user1-[r2:BELONGS_TO]->role1,
    (role2 { type: 'role', name: 'role2'}),
    (user2 { type: 'user', name: 'user2'}),
    user2-[r3:BELONGS_TO]->role2,
    @@ -31,7 +31,29 @@ CREATE
    (item2 { type: 'item', name: 'item2'}),
    item2-[r5:ACCESSIBLE_TO]->role2
    item2-[r5:ACCESSIBLE_TO]->role2,
    (item3 { type: 'item', name: 'item3'})
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----

    Now lets list all items accessible to 'user1':

    [source,cypher]
    ----
    START items = node(*)
    MATCH access = items-[r?:ACCESSIBLE_TO]->accessors, users = user-[BELONGS_TO*]->accessors
    WHERE items.type = 'item' AND (access IS NULL OR user.name = 'user1')
    RETURN items
    ----


    Check if item is 'item1' is accessible to 'user1':

    [source,cypher]
    ----
    MATCH access = item-[ACCESSIBLE_TO]->accessor, users = user-[BELONGS_TO*]->accessor
    WHERE item.type='item' AND item.name = 'item1' AND user.name = 'user1'
    RETURN item, access
    ----
  27. mikesname revised this gist Jul 16, 2013. 1 changed file with 16 additions and 5 deletions.
    21 changes: 16 additions & 5 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -11,16 +11,27 @@ First, lets create our basic example data:
    CREATE
    (admins { type: 'role', name: 'admins'}),
    (role1 { type: 'role', name: 'role1'})-[BELONGS_TO]->admins,
    (role1 { type: 'role', name: 'role1'}),
    (user1 { type: 'user', name: 'user1'})-[BELONGS_TO]->role1,
    role1-[r1:BELONGS_TO]->admins,
    (user1 { type: 'user', name: 'user1'}),
    user1-[r2:BELONGS_TO]->role1,
    (role2 { type: 'role', name: 'role2'}),
    (user2 { type: 'user', name: 'user2'})-[BELONGS_TO]->role2,
    (user2 { type: 'user', name: 'user2'}),
    user2-[r3:BELONGS_TO]->role2,
    (item1 { type: 'item', name: 'item1'}),
    item1-[r4:ACCESSIBLE_TO]->admins,
    (item2 { type: 'item', name: 'item2'}),
    (item1 { type: 'item', name: 'item1'})-[ACCESSIBLE_TO]->admins,
    item2-[r5:ACCESSIBLE_TO]->role2
    (item2 { type: 'item', name: 'item2'})-[ACCESSIBLE_TO]->role2,
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----
  28. mikesname revised this gist Jul 16, 2013. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -9,18 +9,18 @@ First, lets create our basic example data:
    [source,cypher]
    ----
    CREATE
    (admin { type: 'role', name: 'admin'}),
    (admins { type: 'role', name: 'admins'}),
    (role1 { type: 'role', name: 'role1'})-[BELONGS_TO]->admin,
    (role1 { type: 'role', name: 'role1'})-[BELONGS_TO]->admins,
    (user1 { type: 'user', name: 'user1'})-[BELONGS_TO]->role1,
    (role2 { type: 'role', name: 'role2'}),
    (user2 { type: 'user', name: 'user2'})-[BELONGS_TO]->role2,
    (item1 { type: 'item', name: 'item1'})-[ACCESSIBLE_TO]->admin,
    (item1 { type: 'item', name: 'item1'})-[ACCESSIBLE_TO]->admins,
    (item2 { type: 'item', name: 'item2'})-[ACCESSIBLE_TO]->role2,
    RETURN admin, role1, role2, user1, user2, item1, item2
    RETURN admins, role1, role2, user1, user2, item1, item2
    ----
  29. mikesname revised this gist Jul 16, 2013. 1 changed file with 5 additions and 11 deletions.
    16 changes: 5 additions & 11 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -11,22 +11,16 @@ First, lets create our basic example data:
    CREATE
    (admin { type: 'role', name: 'admin'}),
    (role1 { type: 'role', name: 'role1'}),
    role1-[BELONGS_TO]->admin,
    (role1 { type: 'role', name: 'role1'})-[BELONGS_TO]->admin,
    (user1 { type: 'user', name: 'user1'}),
    user1-[BELONGS_TO]->role1,
    (user1 { type: 'user', name: 'user1'})-[BELONGS_TO]->role1,
    (role2 { type: 'role', name: 'role2'}),
    (user2 { type: 'user', name: 'user2'}),
    user2-[BELONGS_TO]->role2,
    (user2 { type: 'user', name: 'user2'})-[BELONGS_TO]->role2,
    (item1 { type: 'item', name: 'item1'}),
    item1-[ACCESSIBLE_TO]->admin,
    (item2 { type: 'item', name: 'item2'}),
    item2-[ACCESSIBLE_TO]->role2
    (item1 { type: 'item', name: 'item1'})-[ACCESSIBLE_TO]->admin,
    (item2 { type: 'item', name: 'item2'})-[ACCESSIBLE_TO]->role2,
    RETURN admin, role1, role2, user1, user2, item1, item2
    ----
  30. mikesname revised this gist Jul 16, 2013. 1 changed file with 5 additions and 5 deletions.
    10 changes: 5 additions & 5 deletions GraphGist-SimpleRBAC.adoc
    View file
    Original file line number Diff line number Diff line change
    @@ -14,18 +14,18 @@ CREATE
    (role1 { type: 'role', name: 'role1'}),
    role1-[BELONGS_TO]->admin,
    user1 = { type: 'user', name: 'user1'}
    (user1 { type: 'user', name: 'user1'}),
    user1-[BELONGS_TO]->role1,
    role2 = { type: 'role', name: 'role2'},
    (role2 { type: 'role', name: 'role2'}),
    user2 = { type: 'user', name: 'user2'},
    (user2 { type: 'user', name: 'user2'}),
    user2-[BELONGS_TO]->role2,
    item1 = { type: 'item', name: 'item1'},
    (item1 { type: 'item', name: 'item1'}),
    item1-[ACCESSIBLE_TO]->admin,
    item2 = { type: 'item', name: 'item2'},
    (item2 { type: 'item', name: 'item2'}),
    item2-[ACCESSIBLE_TO]->role2
    RETURN admin, role1, role2, user1, user2, item1, item2