diff --git a/community/cypher/cypher/src/main/scala/org/neo4j/cypher/internal/spi/v3_1/TransactionBoundQueryContext.scala b/community/cypher/cypher/src/main/scala/org/neo4j/cypher/internal/spi/v3_1/TransactionBoundQueryContext.scala index 2418a8a96521c..6ceb9d62615a8 100644 --- a/community/cypher/cypher/src/main/scala/org/neo4j/cypher/internal/spi/v3_1/TransactionBoundQueryContext.scala +++ b/community/cypher/cypher/src/main/scala/org/neo4j/cypher/internal/spi/v3_1/TransactionBoundQueryContext.scala @@ -586,7 +586,7 @@ final class TransactionBoundQueryContext(val transactionalContext: Transactional override def callReadOnlyProcedure(name: QualifiedProcedureName, args: Seq[Any], allowed: String) = { val revertable = transactionalContext.accessMode match { - case a: AuthSubject if a.hasRole(allowed) => + case a: AuthSubject if a.allowsProcedureWith(allowed) => Some(transactionalContext.restrictCurrentTransaction(AccessMode.Static.OVERRIDE_READ)) case _ => None } @@ -595,7 +595,7 @@ final class TransactionBoundQueryContext(val transactionalContext: Transactional override def callReadWriteProcedure(name: QualifiedProcedureName, args: Seq[Any], allowed: String) = { val revertable = transactionalContext.accessMode match { - case a: AuthSubject if a.hasRole(allowed) => + case a: AuthSubject if a.allowsProcedureWith(allowed) => Some(transactionalContext.restrictCurrentTransaction(AccessMode.Static.OVERRIDE_WRITE)) case _ => None } @@ -606,7 +606,7 @@ final class TransactionBoundQueryContext(val transactionalContext: Transactional override def callSchemaWriteProcedure(name: QualifiedProcedureName, args: Seq[Any], allowed: String) = { val revertable = transactionalContext.accessMode match { - case a: AuthSubject if a.hasRole(allowed) => + case a: AuthSubject if a.allowsProcedureWith(allowed) => Some(transactionalContext.restrictCurrentTransaction(AccessMode.Static.OVERRIDE_SCHEMA)) case _ => None } diff --git a/community/kernel/src/main/java/org/neo4j/kernel/api/security/AuthSubject.java b/community/kernel/src/main/java/org/neo4j/kernel/api/security/AuthSubject.java index c0e85a2d30b46..fd93f3c3ae918 100644 --- a/community/kernel/src/main/java/org/neo4j/kernel/api/security/AuthSubject.java +++ b/community/kernel/src/main/java/org/neo4j/kernel/api/security/AuthSubject.java @@ -39,7 +39,13 @@ public interface AuthSubject extends AccessMode */ void setPassword( String password ) throws IOException, InvalidArgumentsException; - boolean hasRole( String roleName ) throws InvalidArgumentsException; + /** + * Determines whether this subject is allowed to execute a procedure with the parameter string in its procedure annotation. + * @param roleName + * @return + * @throws InvalidArgumentsException + */ + boolean allowsProcedureWith( String roleName ) throws InvalidArgumentsException; /** * Implementation to use when authentication has not yet been performed. Allows nothing. @@ -64,7 +70,7 @@ public void setPassword( String password ) throws IOException, InvalidArgumentsE } @Override - public boolean hasRole( String roleName ) + public boolean allowsProcedureWith( String roleName ) { return false; } @@ -164,7 +170,7 @@ public void setPassword( String password ) throws IOException, InvalidArgumentsE } @Override - public boolean hasRole( String roleName ) + public boolean allowsProcedureWith( String roleName ) { return true; } diff --git a/community/security/src/main/java/org/neo4j/server/security/auth/BasicAuthSubject.java b/community/security/src/main/java/org/neo4j/server/security/auth/BasicAuthSubject.java index ebc529f3f4ff9..b1b2072f75bb2 100644 --- a/community/security/src/main/java/org/neo4j/server/security/auth/BasicAuthSubject.java +++ b/community/security/src/main/java/org/neo4j/server/security/auth/BasicAuthSubject.java @@ -98,7 +98,7 @@ public void setPassword( String password ) throws IOException, InvalidArgumentsE } @Override - public boolean hasRole( String roleName ) + public boolean allowsProcedureWith( String roleName ) { return false; } diff --git a/enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/EnterpriseAuthSubject.java b/enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/EnterpriseAuthSubject.java index 2f7e80714347c..1989b12bc375d 100644 --- a/enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/EnterpriseAuthSubject.java +++ b/enterprise/security/src/main/java/org/neo4j/server/security/enterprise/auth/EnterpriseAuthSubject.java @@ -76,7 +76,7 @@ public void setPassword( String password ) throws IOException, InvalidArgumentsE } @Override - public boolean hasRole( String roleName ) throws InvalidArgumentsException + public boolean allowsProcedureWith( String roleName ) throws InvalidArgumentsException { return getUserManager().getRoleNamesForUser( name() ).contains( roleName ); }