Add documentation for the alter database privileges on database level #2490

Hunterness · 2025-07-18T13:02:26Z

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for DATABASE *)

Hunterness

Some open questions

Hunterness · 2025-07-18T13:02:44Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc


-image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"]
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
+image::privileges_hierarchy_database.svg[width="800", title="Database privileges hierarchy"]


do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure

modules/ROOT/pages/authentication-authorization/database-administration.adoc

Hunterness · 2025-07-18T13:03:53Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

-
-image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"]
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
+image::privileges_grant_and_deny_syntax_database_privileges.svg[width="800", title="Syntax of GRANT and DENY Database Privileges"]


do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure

Hunterness · 2025-07-18T13:04:16Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 ----

-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:


the example query had system... (even if starting and stopping system isn't really a thing I think)

Maybe it's better to update the example to use neo4j?

maybe, but it would require more changes as that also affects the show output and such 🤷 I decided to start with the smallest change to fix it as it wasn't what I was updating the docs for

Hunterness · 2025-07-18T13:04:20Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 ----

-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:


the example query had system... (even if starting and stopping system isn't really a thing I think)

As above, I don't think we want an example that doesn't work .

modules/ROOT/pages/authentication-authorization/database-administration.adoc

Hunterness · 2025-07-18T13:06:48Z

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc


 |===

+From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.


is this a good enough marker for when it was introduced?

does it also need neo4j version?

I assume whatever the answer is here that it should also apply to the other ones in this file

probably? but how do we nicely fit that in? (or do we only say 2025.08 instead of Cypher 25?)

Perhaps it should be implicit that if it's new in 2025.08 it will be in in Cypher 25 only, since we don't add new stuff to Cypher 5 anymore. But this is a new process, I'm not sure if users would understand it yet. But it's probably for the docs team to decide.

Hunterness · 2025-07-21T09:35:50Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 |===

+[role=label--new-2025.08]
+.Database privilege syntax


Do we want to also mark it as Cypher 25 only, and if so how?

yes, I'll add it.

Hunterness · 2025-07-21T09:36:10Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc


+[role=label--new-2025.08]
+[[access-control-database-administration-alter-db]]
+== The alter database related privileges


Do we want to also mark it as Cypher 25 only, and if so how?

Hunterness · 2025-07-21T09:36:42Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

+|===
+
+[role=label--new-2025.08]
+.Database privilege syntax


Do we want to also mark it as Cypher 25 only, and if so how?

modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg

mnd999 · 2025-07-22T13:28:45Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 ----

-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:


Maybe it's better to update the example to use neo4j?

mnd999 · 2025-07-22T13:29:35Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 ----

-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:


As above, I don't think we want an example that doesn't work .

modules/ROOT/pages/authentication-authorization/database-administration.adoc

mnd999 · 2025-07-22T13:46:23Z

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc


 |===

+From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.


Perhaps it should be implicit that if it's new in 2025.08 it will be in in Cypher 25 only, since we don't add new stuff to Cypher 5 anymore. But this is a new process, I'm not sure if users would understand it yet. But it's probably for the docs team to decide.

mnd999

Okay my me now, but I think there are a few things to discuss with the docs team.

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`)

Still need to figure out if/how to mark them as cypher 25 as well

Co-authored-by: Mark Dixon <1756429+mnd999@users.noreply.github.com>

renetapopova

I added some comments, which I'll address shortly.

renetapopova · 2025-08-13T11:49:13Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 |===

+[role=label--new-2025.08]
+.Database privilege syntax


yes, I'll add it.

renetapopova · 2025-08-13T11:49:31Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

+|===
+
+[role=label--new-2025.08]
+.Database privilege syntax


renetapopova · 2025-08-13T11:49:53Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

 |===

-
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure


I think one is enough.

then maybe we should have removed the TODOs

neo4j-docops-agent · 2025-08-13T13:17:32Z

Thanks for the documentation updates.

The preview documentation has now been torn down - reopening this PR will republish it.

mnd999 · 2025-08-19T12:35:19Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc


 The hierarchy between the different database privileges is shown in the image below.

+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure


nit: Should we do something about this TODO?

Reneta answered on the other one that we probably only needed one image, so we should remove the TODOs

mnd999

Seems fine

…neo4j#2490) Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`) --------- Co-authored-by: Mark Dixon <1756429+mnd999@users.noreply.github.com> Co-authored-by: Reneta Popova <reneta.popova@neo4j.com>

Hunterness added DO NOT MERGE team-cypher-operations labels Jul 18, 2025

Hunterness commented Jul 18, 2025

View reviewed changes

mnd999 self-assigned this Jul 21, 2025

Hunterness added the 2025.08 label Jul 21, 2025

Hunterness commented Jul 21, 2025

View reviewed changes

mnd999 reviewed Jul 22, 2025

View reviewed changes

mnd999 approved these changes Jul 22, 2025

View reviewed changes

renetapopova assigned renetapopova and unassigned mnd999 Aug 12, 2025

renetapopova removed the DO NOT MERGE label Aug 12, 2025

Hunterness and others added 4 commits August 13, 2025 12:44

Add documentation for the alter database privileges on database level

fd3ca3c

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`)

Add role labels for introduced version

c609744

Still need to figure out if/how to mark them as cypher 25 as well

Apply suggestions from code review

f5a5ee0

Co-authored-by: Mark Dixon <1756429+mnd999@users.noreply.github.com>

Update image sizes

ee88244

renetapopova force-pushed the dev-move-alter-database-privileges branch from c67b5df to ee88244 Compare August 13, 2025 11:45

renetapopova reviewed Aug 13, 2025

View reviewed changes

renetapopova added 2 commits August 13, 2025 13:22

Add Cypher 25 label and udpate some syntax headings

fb23651

change all mentions to a note

990d7dd

renetapopova approved these changes Aug 14, 2025

View reviewed changes

mnd999 reviewed Aug 19, 2025

View reviewed changes

mnd999 approved these changes Aug 19, 2025

View reviewed changes

NataliaIvakina merged commit 6b3aea3 into neo4j:dev Aug 19, 2025
8 checks passed


		\|===

		From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.

		\|===


		// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure


		The hierarchy between the different database privileges is shown in the image below.

		// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure

Add documentation for the alter database privileges on database level #2490

Add documentation for the alter database privileges on database level #2490

Uh oh!

Conversation

Hunterness commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Hunterness left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mnd999 left a comment

Choose a reason for hiding this comment

Uh oh!

renetapopova left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neo4j-docops-agent commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mnd999 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Hunterness commented Jul 18, 2025 •

edited

Loading

neo4j-docops-agent commented Aug 13, 2025 •

edited

Loading