Dfyjkt

I'm looking to have node access controls by implementing custom properties on the nodes themselves and having trouble determining the best path to take. Access to these need to be determined on the fly and cannot be determined beforehand.

For example:

Let's say I have

(bob:Person name: "Bob",access:"1000000000) - [:KNOWS] -
 (adam:Person name:"Adam",access:"110010000")

Based on the access object, there can be up to 512 different combinations to determine access to an object. In reality, the access level can have even more variations and may expand in the future. Ideally, what I would be able to do is to filter out the nodes/relationships for any query that is run against this DB. I started looking into custom procedures but I'm unsure if that's the best approach.

If every DB user has a specific access string, and s/he can only access nodes/relationships with the same access value, then it is very easy to filter for that.

For example, to get all user-visible paths (assuming that the user's access value is passed in via the $access parameter):

MATCH p=(a:Person)-[k:KNOWS]->(b:Person)
WHERE
 a.access = $access AND
 k.access = $access AND
 b.access = $access
RETURN p;

Or, more generically (but perhaps less efficiently):

MATCH p= <an arbitrary path expression>
WHERE
 ALL(n IN NODES(p) WHERE n.access = $access) AND
 ALL(r IN RELATIONSHIPS(p) WHERE r.access = $access)
RETURN p;