Effective Access Analysis

// ------------------
// Constraints
//-------------------
CREATE CONSTRAINT identity_id
FOR (i:Identity) REQUIRE i.id IS UNIQUE;

CREATE CONSTRAINT group_id
FOR (g:Group) REQUIRE g.id IS UNIQUE;

CREATE CONSTRAINT role_id
FOR (r:Role) REQUIRE r.id IS UNIQUE;

CREATE CONSTRAINT resource_id
FOR (r:Resource) REQUIRE r.id IS UNIQUE;

//--------------------
// Create Identities
//--------------------
CREATE (alice:Identity {id:"alice", type:"user"})      // Operations employee
CREATE (bob:Identity {id:"bob", type:"user"})          // Payroll specialist
CREATE (charlie:Identity {id:"charlie", type:"user"})  // Outsourced IT support contractor
CREATE (dana:Identity {id:"dana", type:"user"})        // Direct access exception
CREATE (svcBackup:Identity {id:"svc-backup", type:"service_account", status:"active"}) //Service account

//--------------------
// Create Groups
//--------------------
CREATE (gEmployees:Group {id:"group-emp", name:"Employees"})
CREATE (gOps:Group {id:"group-ops", name:"Operations"})
CREATE (gFinance:Group {id:"group-fin", name:"Finance"})
CREATE (gPayroll:Group {id:"group-payroll", name:"Payroll Team"})
CREATE (gIT:Group {id:"group-it", name:"IT Support (Outsourced)"})
CREATE (gProcProject:Group {id:"group-proc-project", name:"Procurement Project"})

//-------------------------
// Create Group Hierarchies
//-------------------------
CREATE (gPayroll)-[:MEMBER_OF]->(gFinance)
CREATE (gFinance)-[:MEMBER_OF]->(gEmployees)
CREATE (gOps)-[:MEMBER_OF]->(gEmployees)

//--------------------
// Create Roles
//--------------------
CREATE (rReader:Role  {id:"role-content-reader", name:"Content Reader", system:"content"})
CREATE (rEditor:Role  {id:"role-content-editor", name:"Content Editor", system:"content"})
CREATE (rPayroll:Role {id:"role-payroll-processor", name:"Payroll Processor", system:"hr"})
CREATE (rITOps:Role   {id:"role-it-operator", name:"IT Operator", system:"it"})

//--------------------
// Create Entitlements
//--------------------
CREATE (eRead:Entitlement {action:"read"})
CREATE (eEdit:Entitlement {action:"edit"})
CREATE (eViewPayslips:Entitlement {action:"view_payslips"})
CREATE (eApprovePayroll:Entitlement {action:"approve_payroll"})
CREATE (eLogin:Entitlement {action:"login"})
CREATE (eRestart:Entitlement {action:"restart_service"})

//--------------------------------------------------
// Create Resources (documents/folders + IT assets)
//--------------------------------------------------
CREATE (resKB:Resource {id:"folder-knowledge-base", type:"folder"})
CREATE (resVendorContracts:Resource {id:"doc-vendor-contracts", type:"document"})
CREATE (resPayrollFolder:Resource {id:"folder-payroll", type:"folder"})
CREATE (resPayslips:Resource {id:"doc-payslips-q4", type:"document"})
CREATE (resHRPortal:Resource {id:"app-hr-portal", type:"application"})
CREATE (resFileServer:Resource {id:"server-fileshare-01", type:"server"})

//-------------------------------------
// Create Identity → Group memberships
//-------------------------------------
CREATE (alice)-[:MEMBER_OF]->(gOps)
CREATE (bob)-[:MEMBER_OF]->(gPayroll)
CREATE (bob)-[:MEMBER_OF]->(gProcProject)
CREATE (charlie)-[:MEMBER_OF]->(gIT)
CREATE (svcBackup)-[:MEMBER_OF]->(gIT)
CREATE (dana)-[:MEMBER_OF]->(gEmployees)

//-----------------------------
// Create Group → Role grants
//-----------------------------
CREATE (gEmployees)-[:GRANTS_ROLE]->(rReader)
CREATE (gFinance)-[:GRANTS_ROLE]->(rEditor)
CREATE (gPayroll)-[:GRANTS_ROLE]->(rPayroll)
CREATE (gProcProject)-[:GRANTS_ROLE]->(rEditor)
CREATE (gIT)-[:GRANTS_ROLE]->(rITOps)

//-----------------------------------
// Direct role assignment (exception)
//-----------------------------------
CREATE (dana)-[:ASSIGNED_ROLE]->(rEditor)

//----------------------------------
// Create Role → Entitlement grants
//----------------------------------
CREATE (rReader)-[:GRANTS]->(eRead)

CREATE (rEditor)-[:GRANTS]->(eRead)
CREATE (rEditor)-[:GRANTS]->(eEdit)

CREATE (rPayroll)-[:GRANTS]->(eViewPayslips)
CREATE (rPayroll)-[:GRANTS]->(eApprovePayroll)

CREATE (rITOps)-[:GRANTS]->(eLogin)
CREATE (rITOps)-[:GRANTS]->(eRestart)

//-------------------------------
// Create Entitlement → Resource
//-------------------------------
CREATE (eRead)-[:APPLIES_TO]->(resKB)
CREATE (eRead)-[:APPLIES_TO]->(resVendorContracts)

CREATE (eEdit)-[:APPLIES_TO]->(resVendorContracts)
CREATE (eApprovePayroll)-[:APPLIES_TO]->(resPayrollFolder)
CREATE (eViewPayslips)-[:APPLIES_TO]->(resPayslips)

CREATE (eLogin)-[:APPLIES_TO]->(resHRPortal)
CREATE (eRestart)-[:APPLIES_TO]->(resFileServer)

MATCH p=(i:Identity {id:"bob"})-->{1,50}(e:Entitlement)-[:APPLIES_TO]->(r:Resource)
RETURN r.id AS resource, e.action AS action
ORDER BY resource, action

MATCH p=(i:Identity {id:$id})-->{1,}(e:Entitlement)-[:APPLIES_TO]->(r:Resource WHERE r.type IN ["folder","document"])
RETURN distinct r.id AS resource, r.type AS type, e.action AS entitlement

MATCH p=(r:Resource {id:"doc-vendor-contracts"})<-[:APPLIES_TO]-(:Entitlement)<--{1,}(i:Identity)
RETURN distinct i.id AS identity
ORDER BY identity

MATCH p=(r:Resource {id:"doc-vendor-contracts"})<-[:APPLIES_TO]-(:Entitlement)<--{1,}(i:Identity)
RETURN i.id AS identity, reverse([n in nodes(p) | COALESCE(n.id, n.action)]) AS accessPath
ORDER BY identity, size(accessPath)

MATCH path = SHORTEST 1 (i:Identity {id:"bob"})-->{1,}(e:Entitlement {action:"edit"})-[:APPLIES_TO]->(r:Resource {id:"doc-vendor-contracts"})
RETURN path

MATCH p=(i:Identity {type:
"service_account"})-->{1,}(e:Entitlement)-[:APPLIES_TO]->(r:Resource WHERE r.type IN ["server","application"])
RETURN distinct r.id AS resource, r.type AS type, e.action AS entitlement

MATCH (:Role {id: "role-content-editor"})-[:GRANTS]->(e:Entitlement)-[:APPLIES_TO]->(r:Resource)
RETURN r.id AS resource, r.type AS type, e.action AS entitlement
ORDER BY resource

MATCH (r:Role {id: $id})
CALL(r) {
MATCH path=(r)<-[:GRANTS_ROLE]-(g:Group)<-[:MEMBER_OF]-{1,}(i:Identity)
RETURN path

UNION

MATCH path=(r)<-[:ASSIGNED_ROLE]-(i:Identity)
RETURN path
}

RETURN path