NodeDefinitionCollection ​

Set of all known authorization names Used to detect misspelled authorization names

For each authorization name, all NodeDefinitions that are always allowed

For each authorization name and NodeDefinition, the list of allow rules to check

Lookup for disallow rules by authorization name

Defensive copy of provided backingCollection, used to store NodeDefinitions

NodeDefinitions by GraphQL name lookup

Associates each NodeDefinition with all sub-NodeDefinitions and super-NodeDefinitions

Lookup from set of all subtype GraphQL names to common parent type NodeDefinition Can be used to generate Cypher queries and conditions more efficiently by not having to check for multiple different labels, but only for a common label Keys contain only GraphQL names of NodeDefinitions which are object types in the schema (no interfaces)

Checks if a relation is allowed. A relation is allowed if allow on the parent side of the relation implies allow on the remote side of the relation. Can be used to improve authorization checking when fetching nested data structures. Allow is implied if the inverse relation (if existing) is allowed from related or if this is a one-side and allows from the related side (and has no other allow rules, neither other allow from related nor allow rules).

Generates a set of always allowed NodeDefinitions for each authorization name

Associates each authorization name and NodeDefinition with a set of NodeAllowRules used to generate the allow condition

Generates the authorization condition

Generates the authorization condition for a specific type

Associates each authorization name with a set of all disallow rules (by NodeDefinition

Generates the set of NodeAllowRule for a specific authorization name and NodeDefinition Also see generateAuthorizationAllowRules

Creates a Condition to check for disallowed nodes that must be true

Takes a temporary set of NodeAllowRule and a set of allow all NodeDefinitions and creates the final set of NodeAllowRules

Generates the full authorization condition. This includes both the allowRules and all disallow rules.

Associates each NodeDefinition with all sub-NodeDefinitions and super-NodeDefinitions

Generates the authorization condition for the remote side of a relationship It is assumed that allow is present on the parent side!

Generates the supertype node definition lookup

Gets NodeDefinition based on Authorization.allowFromRelated of a MergedAuthorization

If present, returns nodeDefinition.mergedAuthorizations[name] If not, checks if the name is known, it returns an empty Authorization Otherwise throws an exception, has this hints at a misspelled name

Gets a NodeDefinition by defining class

Gets the list of NodeDefinitions associated with names If a common supertype is found (and the provided names include all subtypes), returns that supertype Otherwise the provided list is mapped to NodeDefinitions

Helper function to iterate over a graph The Collection on which it is called is treated as the set of starting nodes action is called for each node in the graph exactly once, and returns a set of nodes to iterate over. This returned set of nodes may contain duplicates, or nodes which have already been iterated over.