Neo4j 4.0 RBAC

rbac.cql

CREATE DATABASE library;
CREATE DATABASE c360;
CREATE DATABASE iam;

SHOW DATABASES;

:use system;

START DATABASE library;
START DATABASE c360;
START DATABASE iam;

CREATE ROLE contractors;
CREATE ROLE itonly;
CREATE ROLE governmentonly;
CREATE ROLE interns;

DENY MATCH(*) ON GRAPH iam TO contractors;
DENY WRITE(*) ON GRAPH iam TO contractors;
DENY READ(*) ON GRAPH iam TO contractors;
DENY TRAVERSE ON GRAPH iam TO contractors;

GRANT READ(*) ON GRAPH iam TO interns;

GRANT WRITE(*) ON GRAPH iam TO governmentonly;
GRANT READ(*) ON GRAPH iam TO governmentonly;
GRANT TRAVERSE ON GRAPH iam TO governmentonly;

GRANT READ(*) ON GRAPH iam TO interns;
GRANT MATCH(*) ON GRAPH iam to interns;

GRANT MATCH (*) ON GRAPHS library NODES Documents,Document TO interns;
GRANT READ (title,author,createdDate)  ON GRAPH library NODES Documents TO interns;

GRANT MATCH (*) ON GRAPHS library ELEMENTS * TO governmentonly;
GRANT WRITE (*) ON GRAPH library ELEMENTS * TO governmentonly;
GRANT READ (*) ON GRAPH library ELEMENTS * TO governmentonly;
GRANT TRAVERSE ON GRAPH library ELEMENTS * TO governmentonly;

GRANT MATCH (*) ON GRAPHS library ELEMENTS * TO itonly;
GRANT WRITE (*) ON GRAPH library ELEMENTS * TO itonly;
GRANT READ (*) ON GRAPH library ELEMENTS * TO itonly;
GRANT TRAVERSE ON GRAPH library ELEMENTS * TO itonly;


GRANT MATCH (*) ON GRAPHS library ELEMENTS * TO contractors;
GRANT READ(*) ON GRAPH library ELEMENTS * TO contractors;
GRANT TRAVERSE ON GRAPH library ELEMENTS * TO contractors;

DENY MATCH(*) ON GRAPH c360 TO interns;
DENY WRITE(*) ON GRAPH c360 TO interns;
DENY READ(*) ON GRAPH c360 TO interns;
DENY TRAVERSE ON GRAPH c360 TO interns;

DENY MATCH(*) ON GRAPH c360 TO contractors;
DENY WRITE(*) ON GRAPH c360 TO contractors;
DENY READ(*) ON GRAPH c360 TO contractors;
DENY TRAVERSE ON GRAPH c360 TO contractors;

GRANT MATCH (*) ON GRAPHS c360 ELEMENTS * TO itonly;
GRANT WRITE (*) ON GRAPH c360 ELEMENTS * TO itonly;
GRANT READ (*) ON GRAPH c360 ELEMENTS * TO itonly;
GRANT TRAVERSE ON GRAPH c360 ELEMENTS * TO itonly;

GRANT MATCH (*) ON GRAPHS c360 ELEMENTS * TO governmentonly;
GRANT WRITE (*) ON GRAPH c360 ELEMENTS * TO governmentonly;
GRANT READ (*) ON GRAPH c360 ELEMENTS * TO governmentonly;
GRANT TRAVERSE ON GRAPH c360 ELEMENTS * TO governmentonly;