Add documentation for the alter database privileges on database level #2490

Hunterness · 2025-07-18T13:02:26Z

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for DATABASE *)

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`)

Hunterness

Some open questions

Hunterness · 2025-07-18T13:02:44Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -184,7 +186,8 @@ See link:{neo4j-docs-base-uri}/status-codes/{page-version}/notifications/all-not

 The hierarchy between the different database privileges is shown in the image below.

-image::privileges_hierarchy_database.svg[title="Database privileges hierarchy"]
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
+image::privileges_hierarchy_database.svg[width="800", title="Database privileges hierarchy"]


do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure

modules/ROOT/pages/authentication-authorization/database-administration.adoc

Hunterness · 2025-07-18T13:03:53Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

-
-image::privileges_grant_and_deny_syntax_database_privileges.svg[title="Syntax of GRANT and DENY Database Privileges"]
+// TODO: do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure
+image::privileges_grant_and_deny_syntax_database_privileges.svg[width="800", title="Syntax of GRANT and DENY Database Privileges"]


do we want two pictures, one for Cypher 5 and one for Cypher 25? I'd guess not but I'm not sure

Hunterness · 2025-07-18T13:04:16Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -564,7 +613,7 @@ DENY [IMMUTABLE] START
  TO role[, ...]
 ----

-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:


the example query had system... (even if starting and stopping system isn't really a thing I think)

Maybe it's better to update the example to use neo4j?

maybe, but it would require more changes as that also affects the show output and such 🤷 I decided to start with the smallest change to fix it as it wasn't what I was updating the docs for

Hunterness · 2025-07-18T13:04:20Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP
  TO role[, ...]
 ----

-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:


the example query had system... (even if starting and stopping system isn't really a thing I think)

As above, I don't think we want an example that doesn't work .

modules/ROOT/pages/authentication-authorization/database-administration.adoc

Hunterness · 2025-07-18T13:06:48Z

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc

@@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT

 |===

+From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.


is this a good enough marker for when it was introduced?

does it also need neo4j version?

I assume whatever the answer is here that it should also apply to the other ones in this file

probably? but how do we nicely fit that in? (or do we only say 2025.08 instead of Cypher 25?)

Perhaps it should be implicit that if it's new in 2025.08 it will be in in Cypher 25 only, since we don't add new stuff to Cypher 5 anymore. But this is a new process, I'm not sure if users would understand it yet. But it's probably for the docs team to decide.

Still need to figure out if/how to mark them as cypher 25 as well

Hunterness · 2025-07-21T09:35:50Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -237,6 +240,52 @@ GRANT [IMMUTABLE] { START \| STOP }

 |===

+[role=label--new-2025.08]
+.Database privilege syntax


Do we want to also mark it as Cypher 25 only, and if so how?

Hunterness · 2025-07-21T09:36:10Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -628,6 +677,172 @@ a|Rows: 6
 Note that `START` and `STOP` privileges are not included in the xref:authentication-authorization/database-administration.adoc#access-control-database-administration-all[`ALL DATABASE PRIVILEGES`].
 ====

+[role=label--new-2025.08]
+[[access-control-database-administration-alter-db]]
+== The alter database related privileges


Do we want to also mark it as Cypher 25 only, and if so how?

Hunterness · 2025-07-21T09:36:42Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

+|===
+
+[role=label--new-2025.08]
+.Database privilege syntax


Do we want to also mark it as Cypher 25 only, and if so how?

modules/ROOT/images/privileges_grant_and_deny_syntax_database_privileges.svg

mnd999 · 2025-07-22T13:28:45Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -564,7 +613,7 @@ DENY [IMMUTABLE] START
  TO role[, ...]
 ----

-For example, to deny the role `regularUsers` the ability to start to the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to start to the database `system`, use:


Maybe it's better to update the example to use neo4j?

mnd999 · 2025-07-22T13:29:35Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

@@ -596,7 +645,7 @@ DENY [IMMUTABLE] STOP
  TO role[, ...]
 ----

-For example, to deny the role `regularUsers` the ability to stop the database `neo4j`, use:
+For example, to deny the role `regularUsers` the ability to stop the database `system`, use:


As above, I don't think we want an example that doesn't work .

modules/ROOT/pages/authentication-authorization/database-administration.adoc

mnd999 · 2025-07-22T13:40:23Z

modules/ROOT/pages/authentication-authorization/database-administration.adoc

+  TO role[, ...]
+----
+
+This should not be confused with the `ACCESS` privileges that enables the ability for a user to access a database.


Hmm, good point

modules/ROOT/pages/authentication-authorization/database-administration.adoc

mnd999 · 2025-07-22T13:46:23Z

modules/ROOT/pages/authentication-authorization/dbms-administration.adoc

@@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT

 |===

+From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.


Perhaps it should be implicit that if it's new in 2025.08 it will be in in Cypher 25 only, since we don't add new stuff to Cypher 5 anymore. But this is a new process, I'm not sure if users would understand it yet. But it's probably for the docs team to decide.

Co-authored-by: Mark Dixon <[email protected]>

neo4j-docops-agent · 2025-07-22T14:12:54Z

This PR includes documentation updates
View the updated docs at https://neo4j-docs-operations-2490.surge.sh

Updated pages:

mnd999

Okay my me now, but I think there are a few things to discuss with the docs team.

Add documentation for the alter database privileges on database level

f6b5aac

Since we moved them over from DBMS level (while still keeping the DBMS level syntax, just as another syntax for `DATABASE *`)

Hunterness added DO NOT MERGE team-cypher-operations labels Jul 18, 2025

Hunterness commented Jul 18, 2025

View reviewed changes

mnd999 self-assigned this Jul 21, 2025

Add role labels for introduced version

1288a3d

Still need to figure out if/how to mark them as cypher 25 as well

Hunterness added the 2025.08 label Jul 21, 2025

Hunterness commented Jul 21, 2025

View reviewed changes

mnd999 reviewed Jul 22, 2025

View reviewed changes

Hunterness and others added 2 commits July 22, 2025 16:04

Apply suggestions from code review

0c93f80

Co-authored-by: Mark Dixon <[email protected]>

Update image sizes

c67b5df

mnd999 approved these changes Jul 22, 2025

View reviewed changes

		@@ -1070,6 +1070,10 @@ GRANT [IMMUTABLE] DATABASE MANAGEMENT

		\|===

		From Cypher 25, the `ALTER DATABASE`, `SET DATABASE ACCESS`, `SET DATABASE DEFAULT LANGUAGE`, and `ALTER COMPOSITE DATABASE` privileges can be granted both as database privileges and as DBMS privileges.

Add documentation for the alter database privileges on database level #2490

Are you sure you want to change the base?

Add documentation for the alter database privileges on database level #2490

Uh oh!

Conversation

Hunterness commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Hunterness left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

neo4j-docops-agent commented Jul 22, 2025

Uh oh!

mnd999 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Hunterness commented Jul 18, 2025 •

edited

Loading