Skip to content

Commit e1d10bb

Browse files
andrejtonevmatea16
andrejtonev
and
matea16
authored
Detailed list of queries and their privileges (#1433)
* Added detailed list of queries and their privileges * Apply suggestions from code review --------- Co-authored-by: Matea Pesic <80577904+matea16@users.noreply.github.com>
1 parent 5aba275 commit e1d10bb

File tree

2 files changed

+276
-0
lines changed

2 files changed

+276
-0
lines changed

‎pages/database-management/authentication-and-authorization/query-privileges.mdx‎

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
---
2+
title: Query privileges reference
3+
description: Comprehensive reference for query privileges and required permissions in Memgraph.
4+
---
5+
6+
import { Callout } from 'nextra/components'
7+
8+
# Query privileges reference <sup style={{ fontSize: '0.6em', color: '#888' }}>Enterprise</sup>
9+
10+
This comprehensive reference provides detailed information about the privilege system in Memgraph, including which privileges are required for different types of queries and operations.
11+
12+
<Callout type="info">
13+
This page complements the [Role-based access control](/database-management/authentication-and-authorization/role-based-access-control) documentation by providing detailed privilege requirements for specific queries and operations.
14+
</Callout>
15+
16+
17+
Memgraph's privilege system controls access to various database operations through a comprehensive set of privileges. The system analyzes queries and determines the required privileges using the `PrivilegeExtractor` class, which implements the visitor pattern to traverse the Abstract Syntax Tree (AST) and extract privilege requirements.
18+
19+
## Cypher query privileges
20+
21+
### Basic operations
22+
23+
| Query Type | Required Privileges | Example |
24+
|------------|-------------------|---------|
25+
| `CREATE` | `CREATE` | `CREATE (n:Person {name: "Alice"})` |
26+
| `MATCH` | `MATCH` | `MATCH (n:Person) RETURN n` |
27+
| `DELETE` | `DELETE` | `MATCH (n) DELETE n` |
28+
| `MERGE` | `MERGE` | `MERGE (n:Person {id: 1})` |
29+
| `SET` (properties) | `SET` | `MATCH (n) SET n.name = "Bob"` |
30+
| `SET` (labels) | `SET` | `MATCH (n) SET n:Employee` |
31+
| `REMOVE` (properties) | `REMOVE` | `MATCH (n) REMOVE n.temp` |
32+
| `REMOVE` (labels) | `REMOVE` | `MATCH (n) REMOVE n:Temp` |
33+
34+
### Complex queries
35+
36+
| Query Type | Required Privileges | Example |
37+
|------------|-------------------|---------|
38+
| `MATCH` + `DELETE` | `MATCH`, `DELETE` | `MATCH (n) DELETE n` |
39+
| `MATCH` + `CREATE` | `MATCH`, `CREATE` | `MATCH (n) CREATE (m)-[:KNOWS]->(n)` |
40+
| `MATCH` + `SET` | `MATCH`, `SET` | `MATCH (n) SET n.updated = true` |
41+
| `MATCH` + `REMOVE` | `MATCH`, `REMOVE` | `MATCH (n) REMOVE n:Old` |
42+
43+
## Index operations
44+
45+
| Query Type | Required Privileges | Example |
46+
|------------|-------------------|---------|
47+
| `CREATE INDEX` | `INDEX` | `CREATE INDEX ON :Person(name)` |
48+
| `DROP INDEX` | `INDEX` | `DROP INDEX ON :Person(name)` |
49+
| `CREATE EDGE INDEX` | `INDEX` | `CREATE EDGE INDEX ON :KNOWS` |
50+
| `CREATE TEXT INDEX` | `INDEX` | `CREATE TEXT INDEX ON :Person(name)` |
51+
| `CREATE VECTOR INDEX` | `INDEX` | `CREATE VECTOR INDEX ON :Document(embedding)` |
52+
| `CREATE TEXT EDGE INDEX` | `INDEX` | `CREATE TEXT EDGE INDEX ON :KNOWS(description)` |
53+
| `CREATE VECTOR EDGE INDEX` | `INDEX` | `CREATE VECTOR EDGE INDEX ON :SIMILAR(embedding)` |
54+
| `ANALYZE GRAPH` | `INDEX` | `ANALYZE GRAPH` |
55+
| `DROP ALL INDEXES` | `INDEX` | `DROP ALL INDEXES` |
56+
57+
## Constraint operations
58+
59+
| Query Type | Required Privileges | Example |
60+
|------------|-------------------|---------|
61+
| `CREATE CONSTRAINT` | `CONSTRAINT` | `CREATE CONSTRAINT ON (n:Person) ASSERT n.id IS UNIQUE` |
62+
| `DROP CONSTRAINT` | `CONSTRAINT` | `DROP CONSTRAINT ON (n:Person) ASSERT n.id IS UNIQUE` |
63+
| `DROP ALL CONSTRAINTS` | `CONSTRAINT` | `DROP ALL CONSTRAINTS` |
64+
65+
## Authentication and authorization
66+
67+
| Query Type | Required Privileges | Special Cases |
68+
|------------|-------------------|---------------|
69+
| `CREATE ROLE` | `AUTH` | |
70+
| `DROP ROLE` | `AUTH` | |
71+
| `SHOW ROLES` | `AUTH` | |
72+
| `CREATE USER` | `AUTH` | |
73+
| `SET PASSWORD` | `AUTH` | |
74+
| `CHANGE PASSWORD` | **None** | Users can change their own password. |
75+
| `DROP USER` | `AUTH` | |
76+
| `SHOW CURRENT USER` | **None** | Users can always see their own info. |
77+
| `SHOW CURRENT ROLE` | **None** | Users can always see their current role. |
78+
| `SHOW USERS` | `AUTH` | |
79+
| `SET ROLE` | `AUTH` | |
80+
| `CLEAR ROLE` | `AUTH` | |
81+
| `GRANT PRIVILEGE` | `AUTH` | |
82+
| `DENY PRIVILEGE` | `AUTH` | |
83+
| `REVOKE PRIVILEGE` | `AUTH` | |
84+
| `SHOW PRIVILEGES` | `AUTH` | |
85+
| `SHOW ROLE FOR USER` | `AUTH` | |
86+
| `SHOW USERS FOR ROLE` | `AUTH` | |
87+
| `GRANT DATABASE TO USER` | `AUTH` | |
88+
| `DENY DATABASE FROM USER` | `AUTH` | |
89+
| `REVOKE DATABASE FROM USER` | `AUTH` | |
90+
| `SHOW DATABASE PRIVILEGES` | `AUTH` | |
91+
| `SET MAIN DATABASE` | `AUTH` | |
92+
| `GRANT IMPERSONATE USER` | `AUTH` | |
93+
| `DENY IMPERSONATE USER` | `AUTH` | |
94+
95+
## Database information queries
96+
97+
| Query Type | Required Privileges | Example |
98+
|------------|-------------------|---------|
99+
| `SHOW INDEX INFO` | `INDEX` | `SHOW INDEX INFO` |
100+
| `SHOW EDGE TYPES` | `INDEX` | `SHOW EDGE_TYPES INFO` |
101+
| `SHOW NODE LABELS` | `INDEX` | `SHOW NODE_LABELS INFO` |
102+
| `SHOW VECTOR INDEX INFO` | `INDEX` | `SHOW VECTOR INDEX INFO` |
103+
| `SHOW CONSTRAINT INFO` | `CONSTRAINT` | `SHOW CONSTRAINT INFO` |
104+
| `SHOW METRICS` | `STATS` | `SHOW METRICS INFO` |
105+
106+
## System information queries
107+
108+
| Query Type | Required Privileges | Example |
109+
|------------|-------------------|---------|
110+
| `SHOW STORAGE INFO` | `STATS` | `SHOW STORAGE INFO` |
111+
| `SHOW BUILD INFO` | `STATS` | `SHOW BUILD INFO` |
112+
| `SHOW ACTIVE USERS` | `STATS` | `SHOW ACTIVE USERS` |
113+
| `SHOW LICENSE INFO` | `CONFIG` | `SHOW LICENSE INFO` |
114+
| `SHOW INSTANCE` | `STATS` | `SHOW INSTANCE` |
115+
| `SHOW INSTANCES` | `STATS` | `SHOW INSTANCES` |
116+
117+
## Administrative operations
118+
119+
| Query Type | Required Privileges | Example |
120+
|------------|-------------------|---------|
121+
| `DUMP DATABASE` | `DUMP` | `DUMP DATABASE` |
122+
| `LOCK DATA DIRECTORY` | `DURABILITY` | `LOCK DATA DIRECTORY` |
123+
| `UNLOCK DATA DIRECTORY` | `DURABILITY` | `UNLOCK DATA DIRECTORY` |
124+
| `DATA DIRECTORY LOCK STATUS` | `DURABILITY` | `DATA DIRECTORY LOCK STATUS` |
125+
| `FREE MEMORY` | `FREE_MEMORY` | `FREE MEMORY` |
126+
| `SHOW CONFIG` | `CONFIG` | `SHOW CONFIG` |
127+
| `CREATE TRIGGER` | `TRIGGER` | `CREATE TRIGGER ...` |
128+
| `DROP TRIGGER` | `TRIGGER` | `DROP TRIGGER ...` |
129+
| `SHOW TRIGGERS` | `TRIGGER` | `SHOW TRIGGERS` |
130+
| `SHOW TRIGGER INFO` | `TRIGGER` | `SHOW TRIGGER INFO` |
131+
| `CREATE STREAM` | `STREAM` | `CREATE STREAM ...` |
132+
| `DROP STREAM` | `STREAM` | `DROP STREAM ...` |
133+
| `SET ISOLATION LEVEL` | `CONFIG` | `SET ISOLATION LEVEL ...` |
134+
| `SET STORAGE MODE` | `STORAGE_MODE` | `SET STORAGE MODE ...` |
135+
| `CREATE SNAPSHOT` | `DURABILITY` | `CREATE SNAPSHOT` |
136+
| `RECOVER SNAPSHOT` | `DURABILITY` | `RECOVER SNAPSHOT` |
137+
| `SHOW SNAPSHOTS` | `DURABILITY` | `SHOW SNAPSHOTS` |
138+
| `SHOW NEXT SNAPSHOT` | `DURABILITY` | `SHOW NEXT SNAPSHOT` |
139+
| `SET SETTING` | `CONFIG` | `SET SETTING ...` |
140+
| `SHOW VERSION` | `STATS` | `SHOW VERSION` |
141+
| `SHOW TRANSACTIONS` | `TRANSACTION_MANAGEMENT` | `SHOW TRANSACTIONS` |
142+
| `TERMINATE TRANSACTIONS` | `TRANSACTION_MANAGEMENT` | `TERMINATE TRANSACTIONS 'transaction_id'` |
143+
144+
## Replication operations
145+
146+
| Query Type | Required Privileges | Example |
147+
|------------|-------------------|---------|
148+
| `REPLICATION` operations | `REPLICATION` | Various replication commands. |
149+
| `SHOW REPLICATION ROLE` | `REPLICATION` | `SHOW REPLICATION ROLE` |
150+
| `SHOW REPLICAS` | `REPLICATION` | `SHOW REPLICAS` |
151+
| `SHOW REPLICATION LAG` | `COORDINATOR` | `SHOW REPLICATION LAG` |
152+
153+
## Multi-database operations
154+
155+
| Query Type | Required Privileges | Special Cases |
156+
|------------|-------------------|---------------|
157+
| `CREATE DATABASE` | `MULTI_DATABASE_EDIT` | |
158+
| `DROP DATABASE` | `MULTI_DATABASE_EDIT` | |
159+
| `RENAME DATABASE` | `MULTI_DATABASE_EDIT` | |
160+
| `DROP DATABASE FORCE` | `MULTI_DATABASE_EDIT`, `TRANSACTION_MANAGEMENT` | Requires both privileges. |
161+
| `USE DATABASE` | `MULTI_DATABASE_USE` | |
162+
| `SHOW DATABASE` | **None** | Users can see current database. |
163+
| `SHOW DATABASES` | `MULTI_DATABASE_USE` | |
164+
165+
## Enum operations
166+
167+
| Query Type | Required Privileges | Example |
168+
|------------|-------------------|---------|
169+
| `CREATE ENUM` | `CREATE` | `CREATE ENUM ...` |
170+
| `SHOW ENUMS` | `STATS` | `SHOW ENUMS` |
171+
| `ALTER ENUM ADD VALUE` | `CREATE` | `ALTER ENUM ... ADD VALUE ...` |
172+
| `ALTER ENUM UPDATE VALUE` | `CREATE` | `ALTER ENUM ... UPDATE VALUE ...` |
173+
| `ALTER ENUM REMOVE VALUE` | `DELETE` | `ALTER ENUM ... REMOVE VALUE ...` |
174+
| `DROP ENUM` | `DELETE` | `DROP ENUM ...` |
175+
176+
## TTL operations
177+
178+
| Query Type | Required Privileges | Note |
179+
|------------|-------------------|------|
180+
| `TTL` operations | `CONFIG`, `INDEX`, `MATCH`, `DELETE` | Requires multiple privileges. |
181+
182+
## Coordinator operations
183+
184+
| Query Type | Required Privileges | Example |
185+
|------------|-------------------|---------|
186+
| `COORDINATOR` operations | `COORDINATOR` | Various coordinator commands. |
187+
| `SHOW COORDINATOR SETTINGS` | `COORDINATOR` | `SHOW COORDINATOR SETTINGS` |
188+
189+
## Schema information
190+
191+
| Query Type | Required Privileges | Example |
192+
|------------|-------------------|---------|
193+
| `SHOW SCHEMA INFO` | `STATS` | `SHOW SCHEMA INFO` |
194+
195+
## User profile operations
196+
197+
| Query Type | Required Privileges | Example |
198+
|------------|-------------------|---------|
199+
| `USER PROFILE` operations | `PROFILE_RESTRICTION` | User profile management. |
200+
201+
## Procedure calls
202+
203+
| Procedure Type | Required Privileges | Example |
204+
|----------------|-------------------|---------|
205+
| `mg.get_module_files` | `MODULE_READ` | `CALL mg.get_module_files()` |
206+
| `mg.create_module_file` | `MODULE_WRITE` | `CALL mg.create_module_file(...)` |
207+
| `mg.update_module_file` | `MODULE_WRITE` | `CALL mg.update_module_file(...)` |
208+
| `mg.get_module_file` | `MODULE_READ` | `CALL mg.get_module_file(...)` |
209+
| `mg.delete_module_file` | `MODULE_WRITE` | `CALL mg.delete_module_file(...)` |
210+
| Other procedures | **Procedure-specific** | Depends on procedure definition. |
211+
212+
## File operations
213+
214+
| Query Type | Required Privileges | Example |
215+
|------------|-------------------|---------|
216+
| `LOAD CSV` | `READ_FILE` | `LOAD CSV FROM "file.csv" AS row` |
217+
218+
## Special cases
219+
220+
| Query Type | Required Privileges | Notes |
221+
|------------|-------------------|-------|
222+
| `EXPLAIN` | **Inherits privileges from inner query** | Privileges depend on the explained query. |
223+
| `PROFILE` | **Inherits privileges from inner query** | Privileges depend on the profiled query. |
224+
| `SET SESSION TRACE` | **None** | No privileges required. |
225+
226+
### Examples
227+
228+
```cypher
229+
-- EXPLAIN inherits privileges from the inner query
230+
EXPLAIN MATCH (n:Person) RETURN n; -- Requires MATCH privilege
231+
232+
-- PROFILE inherits privileges from the inner query
233+
PROFILE CREATE (n:Person {name: "Alice"}); -- Requires CREATE privilege
234+
```
235+
236+
## Troubleshooting
237+
238+
### Common privilege errors
239+
240+
<Callout type="warning">
241+
If you encounter "Vertex not created due to not having enough permission!" errors, you likely need to grant fine-grained access control privileges to the user.
242+
</Callout>
243+
244+
### Checking privileges
245+
246+
```cypher
247+
-- Show all privileges for a user or role
248+
SHOW PRIVILEGES FOR username;
249+
250+
-- Show privileges in specific database context
251+
SHOW PRIVILEGES FOR username ON DATABASE db_name;
252+
253+
-- Verify the current logged-in user
254+
SHOW CURRENT USER;
255+
256+
-- Show current user's privileges
257+
SHOW PRIVILEGES FOR CURRENT USER;
258+
```
259+
260+
### Privilege inheritance
261+
262+
Remember that:
263+
- **Grants**: If any role grants a permission, the user has that permission
264+
- **Denies**: If any role denies a permission, the user is denied that permission
265+
- **Database Access**: If any role grants access to a database, the user has access
266+
- **Fine-grained Permissions**: Combined using the same grant/deny logic
267+
268+
<Callout type="info">
269+
Privilege changes take effect after the user reconnects to the database.
270+
</Callout>

‎pages/database-management/authentication-and-authorization/role-based-access-control.mdx‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,10 +172,16 @@ of the following commands:
172172
| Privilege to change [storage mode](/fundamentals/storage-memory-usage#storage-modes). | `STORAGE_MODE` |
173173
| Privilege to manage [multi-tenant databases](/database-management/multi-tenancy). | `MULTI_DATABASE_EDIT` |
174174
| Privilege to use a database within the multi-tenant architecture. | `MULTI_DATABASE_USE` |
175+
| Privilege to configure [high-availability](/clustering/high-availability) coordinators. | `COORDINATOR` |
176+
| Privilege to [impersonate other users](/database-management/authentication-and-authorization/impersonate-user). | `IMPERSONATE_USER` |
175177
| Privilege to set limits and monitor resource usage per user. | `PROFILE_RESTRICTION` |
176178
| Privileges to specific labels. | `ALL LABELS` |
177179
| Privileges to specific relationships types. | `ALL EDGE TYPES` |
178180

181+
<Callout type="info">
182+
For a comprehensive reference of which privileges are required for specific queries and operations, see the [Query privileges reference](/database-management/authentication-and-authorization/query-privileges) documentation.
183+
</Callout>
184+
179185
## Authentication and authorization requirements
180186

181187
<Callout type="info">

0 commit comments

Comments
 (0)