docs: clarify GRAPH.RO_QUERY read-only ACL limitation (#3356)

AG
20h ago
+35-1

Summary

Clarifies the documented Redis ACL behavior for GRAPH.RO_QUERY in FalkorDB v6.0.2.

Problem

The existing ACL documentation recommends %R~* for read-only graph access. However, users can encounter NOPERM No permissions to access a key when executing GRAPH.RO_QUERY with read-only key permissions.
Related issue: FalkorDB/FalkorDB#3356

Changes

  • Documented the known read-only ACL compatibility limitation.
  • Added an ACL-selector workaround for graph keys matching app2:*.
  • Recommended validating permissions using ACL DRYRUN.
  • Linked the original bug report for additional context.

Verification

Validated the ACL-selector workaround against FalkorDB v6.0.2 in Docker using a disposable test graph and restricted user.

  • ACL SETUSER reader3356 reset on >test3356pass +PING +INFO (~app2:* +GRAPH.RO_QUERY) returned OK.
  • ACL DRYRUN reader3356 GRAPH.RO_QUERY app2:users "MATCH (n) RETURN count(n)" returned OK.
  • ACL DRYRUN reader3356 GRAPH.QUERY app2:users "CREATE (:Unauthorized)" denied access to GRAPH.QUERY.
  • An actual authenticated GRAPH.RO_QUERY executed successfully and returned count(n) = 1.

These results confirm the documented selector approach for this tested configuration. They do not fix the underlying %R~* read-only key-specification issue.

Scope

This is a documentation-only change. It does not modify the underlying Redis command key specifications or resolve the implementation bug.

Summary by cubic

Documents the FalkorDB 6.0.2 ACL compatibility issue where GRAPH.RO_QUERY can fail with NOPERM No permissions to access a key even when %R~* read-only key permissions are granted, and adds a workaround using ACL selectors. Documentation-only change; it does not alter command key specifications or fix the underlying bug.

  • Recommends an ACL-selector configuration that resets prior rules, grants GRAPH.RO_QUERY, and avoids GRAPH.QUERY and @connection.
  • Notes the selector grants full key access within its scope, so allowed commands must be narrowly scoped.
  • Advises validating permissions with ACL DRYRUN and an authenticated restricted client per deployment.
  • References the underlying bug report in FalkorDB/FalkorDB#3356.

Summary by CodeRabbit

  • Documentation
    • Clarified that a read-only ACL pattern may cause GRAPH.RO_QUERY to fail on FalkorDB 6.0.2.
    • Documented a potential ACL-selector workaround, noting its broad access to matching keys and the importance of limiting allowed commands.
    • Recommended validating permissions with ACL DRYRUN and an authenticated restricted client before production use.