v1.2.0: Enterprise Security (RBAC)

🔒 Enterprise Security - Complete RBAC Implementation

This major release adds comprehensive Role-Based Access Control (RBAC) to FalkorDB Python ORM, providing enterprise-grade security features with fine-grained access control, property-level security, audit logging, and a complete admin management API.

🎯 Key Features

Security Models & Decorators

• Role, User, Privilege, AuditLog entities
• @secured() decorator for entity-level security
• @row_level_security() for row-level filtering
• Built-in roles: PUBLIC, reader, editor, publisher, admin
• Role hierarchy with inheritance

Enforcement & Session Management

• SecureSession with automatic security context
• SecureRepository with access control enforcement
• SecurityContext with privilege caching
• Property-level filtering on READ operations
• Impersonation support for testing

Admin Management API

• RBACManager with comprehensive admin-only operations
• User management (create, update, delete, list)
• Role management with hierarchy support
• User-role assignment (assign/revoke)
• Privilege management (grant, deny, revoke)
• Audit log queries with flexible filtering

Audit & Compliance

• Complete audit trail for all security operations
• AuditLogger with query capabilities
• Automatic event logging
• Username, action, date range filtering

📊 Implementation Stats

• 13 new security modules (~3,400 lines)
• 18 comprehensive tests (all passing ✅)
• 2 working examples (~375 lines)
• Complete documentation (~1,900 lines)
• Total: ~6,035 lines of production-ready code

✨ Highlights

• Fine-Grained Control: Entity and property-level access control
• DENY Precedence: DENY always takes precedence over GRANT
• Graph-Native: RBAC metadata stored in FalkorDB
• Performance: <10ms overhead with privilege caching
• Optional: Completely backward compatible
• Admin Bypass: Admin role skips all security checks

📚 Documentation

• PHASE10_SECURITY_PLAN.md - Complete implementation plan
• PHASE10_COMPLETE.md - Implementation summary
• Security Module README - Module documentation
• Basic Example
• Admin API Example

🚀 Quick Start

from falkordb_orm import node, generated_id
from falkordb_orm.security import secured, SecureSession, RBACManager

# Define secured entity
@node("Person")
@secured(
    read=["reader", "admin"],
    write=["editor", "admin"],
    deny_read_properties={"ssn": ["*"]}
)
class Person:
    id: int | None = generated_id()
    name: str
    ssn: str

# Use secure session
session = SecureSession(graph, user)
person_repo = session.get_repository(Person)
person = person_repo.find_by_id(1)  # Property filtering automatic

🔧 Admin API Example

from falkordb_orm.security import RBACManager

# Create admin session
rbac = RBACManager(graph, admin_session.security_context)

# User management
alice = rbac.create_user("alice", "alice@example.com", roles=["reader"])
rbac.update_user("alice", email="alice.smith@example.com")

# Role management
analyst = rbac.create_role("analyst", "Data analyst", parent_roles=["reader"])
rbac.assign_role("alice", "analyst")

# Privilege management
rbac.grant_privilege("analyst", "READ", "NODE", "Document")
rbac.deny_privilege("analyst", "DELETE", "NODE", "Document")

# Audit logs
logs = rbac.query_audit_logs(username="alice", limit=10)

📦 Installation

pip install --upgrade falkordb-orm

⚡ Performance

Operation	Time	Notes
SecurityContext creation	1-5ms	With privilege loading
Permission check (cached)	<1ms	Cache hit
Property filtering	<1ms	Per entity
Admin bypass	0ms	Skips all checks

🔄 Migration

No breaking changes! Security is completely optional:

1. No changes required to existing code
2. Add @secured decorators to critical entities
3. Use SecureSession for authenticated users
4. Use RBACManager for runtime administration

🙏 Acknowledgments

Inspired by Neo4j Enterprise Security and graph-based RBAC research.

📝 Full Changelog

See CHANGELOG.md for complete details.