Introduction to TypeDB

define

credential sub attribute, value string;
username sub attribute, value string;
email sub attribute, value string;

subject sub entity, abstract, owns credential;
user sub subject, abstract, owns username;
employee sub user, owns email;

insert $e isa employee, 
   has credential "passwd", has username "jdoe", has email "[email protected]";

CREATE TABLE subjects (
   id integer PRIMARY KEY, 
   credential text);

CREATE TABLE users (
   id integer PRIMARY KEY, 
   s_id integer REFERENCES subjects(id), 
   username text);

CREATE TABLE employees (
   id integer PRIMARY KEY, 
   u_id integer REFERENCES users(id), 
   email text);

-- three inserts required
INSERT INTO subjects VALUES (1, 'password');
INSERT INTO users VALUES (1, 1, 'jdoe');
INSERT INTO employees VALUES (1, 1, '[email protected]');

db.createCollection("employees", {
   validator: {
      $jsonSchema: {
         bsonType: "object",
         title: "IAM employee",
         required: [ "credential", "username", "email"],
         properties: {
            credential: {
               bsonType: "string",
               description: "'credential' must be a string and is required"},
            username: {
               bsonType: "string",
               description: "'username' must be a string and is required"},
            email: {
               bsonType: "string",
               description: "'email' must be a string and is required"}
         }
      }
   }
})

db.employees.insert({credentials: "passwd", username: "jdoe", 
   email: "[email protected]" })

CREATE CONSTRAINT [subject_credential_string] [IF NOT EXISTS]
FOR (n:Subject)
REQUIRE n.credential IS :: STRING

CREATE CONSTRAINT [user_username_string] [IF NOT EXISTS]
FOR (n:User)
REQUIRE n.username IS :: STRING

CREATE CONSTRAINT [employee_email_string] [IF NOT EXISTS]
FOR (n:Employee)
REQUIRE n.email IS :: STRING

CREATE (emp:Subject:User:Employee 
   {
      credential: 'passwd', 
      username: 'jdoe',
      email: '[email protected]'
   })

# find all files in the /usr/bin directory which 
# John Doe has permission to write
match
   $e isa employee, has email "[email protected]";
   $f isa file, has path "/usr/bin/"; 
   $a isa action, has name "WRITE";
   $ac ($f, $a) isa access;
   $p ($e, $ac) isa permission;

-- find all files in the /usr/bin directory which 
-- John Doe has permission to write
SELECT f.path
FROM permissions p
JOIN employees e ON e.id = p.subject_id
JOIN access ac ON ac.id = p.access_id
JOIN actions a ON a.id = ac.action_id
JOIN files f ON f.id = ac.object_id
WHERE e.email = '[email protected]' AND
   f.path LIKE '/usr/bin/%' AND
   a.name = 'WRITE';

// find all files in the /usr/bin directory which 
// John Doe has permission to write
db.permissions.aggregate([
  {
    $match: {
      email: "[email protected]",
    },
  },
  {
    $lookup: {
      from: "permissions",
      localField: "email",
      foreignField: "subject",
      as: "permission",
    },
  },
  {
    $unwind: {
      path: "$permission",
    },
  },
  {
    $lookup: {
      from: "accesses",
      localField: "permission.access_id",
      foreignField: "access_id",
      as: "access",
    },
  },
  {
    $lookup: {
      from: "actions",
      localField: "access.action_name",
      foreignField: "name",
      as: "action",
      pipeline: [
        {
          $match: {
            $expr: {
              $eq: ["$name", "WRITE"],
            },
          },
        },
      ],
    },
  },
  {
    $lookup: {
      from: "files",
      localField: "access.resource_id",
      foreignField: "resource_id",
      as: "resource",
      pipeline: [
        {
          $match: {
            $expr: {
              $eq: ["$path", "/usr/bin"],
            },
          },
        },
      ],
    },
  },
  {
    $match:
      {
        resource: {
          $ne: [],
        },
      },
  },
])

// find all files in the /usr/bin directory which 
// John Doe has permission to write
MATCH 
   (e:Employee)-[:GRANTED]-(p:Permission), 
   (p)-[:INCLUDES]-(x:Access), 
   (x)-[:HAS]-(a:Action),
   (x)-[:ON]-(f:File)
WHERE e.email = '[email protected]' AND
   f.path STARTS WITH 'usr/bin' AND
   a.name = 'WRITE'
RETURN p

# find all of Jane Doe's permissions on restricted objects
match
   $e isa employee, has email "[email protected]";
   $p (subject: $e) isa permission, has restricted true;

-- find all of Jane Doe's permissions
WITH RECURSIVE user_groups AS (
   SELECT member_id, group_id,
   FROM user_group_members
   WHERE email = "[email protected]"
   UNION ALL
   SELECT member_ug.member_id, member_ug.group_id
   FROM user_group_members member_ug
   JOIN user_groups group_ug ON group_ug.group_id = member_ug.member_id
)
SELECT p.id
FROM user_groups ugs
JOIN permissions p ON p.subject_id = ugs.group_id
UNION
SELECT p.id
FROM permissions p
WHERE p.subject_id = 1;

// find all of Jane Doe's permissions
db.group-memberships.aggregate([
  {
    $match: {
      email: "[email protected]",
    },
  },
  {
    $graphLookup: {
      from: "group-memberships",
      startWith: "$group_name",
      connectFromField: "group_name",
      connectToField: "member_id",
      as: "groups",
    },
  },
  {
    $set: {
      group_names: {
        $concatArrays: [
          ["$group_name"],
          "$groups.group_name",
        ],
      },
    },
  },
  {
    $lookup: {
      from: "permissions",
      localField: "group_names",
      foreignField: "subject_id",
      as: "group_permissions",
    },
  },
  {
    $lookup: {
      from: "permissions",
      localField: "email",
      foreignField: "subject_id",
      as: "member_permissions",
    },
  },
  {
    $set: {
      permissions: {
        $concatArrays: [
          "$group_permissions",
          "$member_permissions",
        ],
      },
    },
  },
])

// find all of Jane Doe's permissions on restricted objects
MATCH 
    (e:Employee)-[:GRANTED_TO]-(p:Permission),
    (p)-[:FOR_ACCESS|ON_OBJECT*]-(r:Resource)
WHERE 
    e.email = '[email protected]' AND 
    (
        r.hostname = 'db001' OR               // restricted server
        r.path STARTS WITH '/opt/secure' OR   // restricted directory
        r.name = 'account_numbers' OR         // restricted table
        r.pk = '100'                          // restricted row
    )
RETURN p