cmql-core.roles — org.cmql/cmql-core 0.2.0-SNAPSHOT

create-role clj/s

(create-role db-name command-map & args)

Roles like users belong to a database,admin database is better to be used to know where all info is Requires = createRole/grantRole actions. Built in role 'userAdmin' can do those actions setAuthenticationRestriction action

create-role-def clj/s

create-update-role clj/s

(create-update-role db-name command-map update? args)

drop-all-roles-from-database clj/s

(drop-all-roles-from-database db-name & args)

Removes all roles from the argument db(users that belong to the database) Requires = dropRole action

drop-role clj/s

(drop-role db-name rolename & args)

Requires = dropRole action

grant-privileges-to-role clj/s

(grant-privileges-to-role db-name rolename privileges & args)

grant-roles-to-role clj/s

(grant-roles-to-role db-name rolename roles & args)

invalidate-user-cache clj/s

(invalidate-user-cache db-name & args)

Flushes user information from in-memory cache, including removal of each user’s credentials and roles. This allows you to purge the cache at any given moment, regardless of the interval set in the userCacheInvalidationIntervalSecs parameter Requires = invalidateUserCache action on the cluster resource in order to use this command

revoke-privileges-from-role clj/s

(revoke-privileges-from-role db-name rolename privileges & args)

The resource must be an exact much. Actions can be subsets

revoke-role-from-role clj/s

(revoke-role-from-role db-name rolename privileges & args)

Both built-in roles and user-defined roles Requires = revokeRole action

roles-info clj/s

(roles-info db-name command-map & args)

Command { rolesInfo: <see below> showPrivileges: <Boolean> showBuiltinRoles: <Boolean> }

rolesInfo { rolesInfo: 1, showBuiltinRoles: true } all from the db run command { rolesInfo: { role: <rolename>, db: <database> } } { rolesInfo: [ 'roleName' { role : <name>, db: <db> } ...] } many Requires = viewRole action to see a role you dont have (but each user is allowed to see their personal roles info)

update-role clj/s

(update-role db-name command-map & args)

Requires = revokeRole action on all databases in order to update a role grantRole action on the database of each role in the roles array to update the array grantRole action on the database of each privilege in the privileges array to update the array If a privilege’s resource spans databases, you must have grantRole on the admin database. A privilege spans databases if the privilege is any of the following a collection in all database all collections and all databas the cluster resource setAuthenticationRestriction action on the database of the target role if change :authenticationRestrictions

A top level field that is present in the update command => completly replace the old one its like invoke first and grant after For not fully replace use grant/revoke commands