diff --git a/antora.yml b/antora.yml index ae444e43..80a22542 100644 --- a/antora.yml +++ b/antora.yml @@ -1,12 +1,12 @@ name: status-codes title: Status Codes for Errors & Notifications -version: '2025.09' +version: '2025.10' start_page: ROOT:index.adoc nav: - modules/ROOT/content-nav.adoc asciidoc: attributes: page-origin-private: false - neo4j-version: '2025.09' - neo4j-version-exact: '2025.09.0' - neo4j-buildnumber: '2025.09' + neo4j-version: '2025.10' + neo4j-version-exact: '2025.10.1' + neo4j-buildnumber: '2025.10' diff --git a/modules/ROOT/content-nav.adoc b/modules/ROOT/content-nav.adoc index ae93a833..9d8fefe5 100644 --- a/modules/ROOT/content-nav.adoc +++ b/modules/ROOT/content-nav.adoc @@ -266,6 +266,7 @@ **** xref:errors/gql-errors/42I65.adoc[] **** xref:errors/gql-errors/42I66.adoc[] **** xref:errors/gql-errors/42I67.adoc[] +**** xref:errors/gql-errors/42I68.adoc[] **** xref:errors/gql-errors/42N00.adoc[] **** xref:errors/gql-errors/42N01.adoc[] **** xref:errors/gql-errors/42N02.adoc[] @@ -510,6 +511,7 @@ **** xref:errors/gql-errors/52N41.adoc[] **** xref:errors/gql-errors/52U00.adoc[] *** xref:errors/gql-errors/index.adoc#function-exceptions[Function exceptions] +**** xref:errors/gql-errors/53N33.adoc[] **** xref:errors/gql-errors/53N34.adoc[] **** xref:errors/gql-errors/53N35.adoc[] **** xref:errors/gql-errors/53N37.adoc[] diff --git a/modules/ROOT/pages/errors/gql-errors/42I68.adoc b/modules/ROOT/pages/errors/gql-errors/42I68.adoc new file mode 100644 index 00000000..d13df723 --- /dev/null +++ b/modules/ROOT/pages/errors/gql-errors/42I68.adoc @@ -0,0 +1,30 @@ +:page-role: new-2025.10 += 42I68 + +== Status description +error: syntax error or access rule violation - mismatched pattern. Pattern, `{ <>1 }`, does not match input, `{ <>2 }`. Verify that the pattern is valid for constructing `{ <> }`. + +== Example scenario + +For example, when parsing a duration string value: + +[source,cypher] +---- +RETURN duration("5 hours 12 minutes 15 seconds", "h 'hours' m 'minutes'") AS d +---- + +You will receive an error with GQLSTATUS xref:errors/gql-errors/42001.adoc[42001]. +This error has a cause detailed in xref:errors/gql-errors/42I68.adoc[42I68] and status description: + + +[source] +---- +error: syntax error or access rule violation - mismatched pattern. Pattern, `"h 'hours' m 'minutes'"`, does not match input, `"5 hours 12 minutes 15 seconds"`. Verify that the pattern is valid for constructing `DURATION`. +---- + +ifndef::backend-pdf[] +[discrete.glossary] +== Glossary + +include::partial$glossary.adoc[] +endif::[] \ No newline at end of file diff --git a/modules/ROOT/pages/errors/gql-errors/53N33.adoc b/modules/ROOT/pages/errors/gql-errors/53N33.adoc new file mode 100644 index 00000000..3be9d32e --- /dev/null +++ b/modules/ROOT/pages/errors/gql-errors/53N33.adoc @@ -0,0 +1,29 @@ +:page-role: new-2025.10 += 53N33 + +== Status description +error: function exception - function invocation failed. Failed to invoke function `{ <> }` caused by: `{ <> }` + +== Example scenario + +For example, when parsing a duration string value: + +[source,cypher] +---- +RETURN duration({hours: 1}, "hh-mm-ss") as r +---- + +You will receive an error with GQLSTATUS xref:errors/gql-errors/53N33.adoc[53N33] and status description: + + +[source] +---- +error: function exception - function invocation failed. Failed to invoke function duration(input :: ANY, pattern = DEFAULT_TEMPORAL_ARGUMENT :: STRING) :: DURATION caused by: A pattern can only be used in conjunction with a `STRING` input. +---- + +ifndef::backend-pdf[] +[discrete.glossary] +== Glossary + +include::partial$glossary.adoc[] +endif::[] diff --git a/modules/ROOT/pages/errors/gql-errors/index.adoc b/modules/ROOT/pages/errors/gql-errors/index.adoc index fa88de55..eb8cda81 100644 --- a/modules/ROOT/pages/errors/gql-errors/index.adoc +++ b/modules/ROOT/pages/errors/gql-errors/index.adoc @@ -1092,6 +1092,11 @@ Status description:: error: syntax error or access rule violation - pattern pars Status description:: error: syntax error or access rule violation - unsupported language feature. The query is a valid `CYPHER { <>2 }` query, but it is run in `CYPHER { <>1 }`. Consider changing the database default Cypher version using `ALTER DATABASE SET DEFAULT LANGUAGE` or prefix the query with `CYPHER { <>2 }`. +[role=label--new-2025.10] +=== xref:errors/gql-errors/42I68.adoc[42I68] + +Status description:: error: syntax error or access rule violation - mismatched pattern. Pattern, `{ <>1 }`, does not match input, `{ <>2 }`. Verify that the pattern is valid for constructing `{ <> }`. + [role=label--changed-2025.03] === xref:errors/gql-errors/42N00.adoc[42N00] @@ -2084,6 +2089,11 @@ Status description:: error: procedure exception - custom procedure execution err [[function-exceptions]] == Function exceptions +[role=label--new-2025.10] +=== xref:errors/gql-errors/53N33.adoc[53N33] + +Status description:: error: function exception - function invocation failed. Failed to invoke function `{ <> }` caused by: `{ <> }` + === xref:errors/gql-errors/53N34.adoc[53N34] Status description:: error: function exception - function restricted. `{ <> }` is restricted and accesses database internals. User-defined function restriction is controlled by the `dbms.security.procedures.unrestricted` setting. Only un-restrict user-defined functions you can trust with access to database internals. diff --git a/modules/ROOT/pages/notifications/all-notifications.adoc b/modules/ROOT/pages/notifications/all-notifications.adoc index fd39dcf9..2fc0d13e 100644 --- a/modules/ROOT/pages/notifications/all-notifications.adoc +++ b/modules/ROOT/pages/notifications/all-notifications.adoc @@ -3649,6 +3649,130 @@ m|SECURITY m|WARNING |=== +[#_neo_clientnotification_security_oidccredentialforwardingnotenabled] +=== OIDC credential forwarding is not enabled + +.Notification details +[cols="<1s,<4"] +|=== +|Neo4j code +m|Neo.ClientNotification.Security.OidcCredentialForwardingNotEnabled +|Title +a|OIDC credential forwarding is not enabled. +|Description +a|Use setting 'dbms.security.allow_oidc_credential_forwarding_enabled' to enable OIDC credential forwarding. +|Category +m|SECURITY +|GQLSTATUS code +m|01N74 +|Status description +|warn: OIDC credential forwarding disabled. +Use the setting `dbms.security.allow_oidc_credential_forwarding_enabled` to enable OIDC credential forwarding. +|Classification +m|SECURITY +|SeverityLevel +m|WARNING +|=== + +.Create a remote database alias with remote credentials set to OIDC credential forwarding when OIDC credential forwarding is not enabled. +[.tabbed-example] +===== +[.include-with-GQLSTATUS-code] +====== +Command:: ++ +[source, cypher] +---- +CREATE ALIAS `remote-neo4j` FOR DATABASE `neo4j` AT "neo4j+s://location:7687" OIDC CREDENTIAL FORWARDING +---- + +Returned GQLSTATUS code:: +01N74 + +Returned status description:: +warn: OIDC credential forwarding disabled. +Use the setting 'dbms.security.allow_oidc_credential_forwarding_enabled' to enable OIDC credential forwarding. + +Suggestions for improvement:: +The remote database alias has been successfully created, but OIDC credential forwarding is not enabled. To use the alias to connect to the remote Neo4j DBMS, allow OIDC credential forwarding by setting `dbms.security.allow_oidc_credential_forwarding_enabled` to `true`. + +====== +[.include-with-neo4j-code] +====== +Command:: ++ +[source, cypher] +---- +CREATE ALIAS `remote-neo4j` FOR DATABASE `neo4j` AT "neo4j+s://location:7687" OIDC CREDENTIAL FORWARDING +---- + +Suggestions for improvement:: +The remote database alias has been successfully created, but OIDC credential forwarding is not enabled. To use the alias to connect to the remote Neo4j DBMS, allow OIDC credential forwarding by setting `dbms.security.allow_oidc_credential_forwarding_enabled` to `true`. +====== +===== + +[#_neo_clientnotification_security_shardedperformance] +=== Sharded privilege performance + +.Notification details +[cols="<1s,<4"] +|=== +|Neo4j code +m|Neo.ClientNotification.Security.ShardedPrivilegePerformance +|Title +a|Privilege with a severe performance impact on sharded databases. +|Description +a|The specified privilege severely reduces the performance of queries run on sharded databases. Consider excluding sharded databases for now. +|Category +m|SECURITY +|GQLSTATUS code +m|01N73 +|Status description +|warn: sharded privilege performance. +The specified privilege severely reduces the performance of queries run on sharded databases. Consider excluding sharded databases for now. +|Classification +m|SECURITY +|SeverityLevel +m|WARNING +|=== + +.Grant a property access rule privilege on all databases +[.tabbed-example] +===== +[.include-with-GQLSTATUS-code] +====== +Command:: ++ +[source, cypher] +---- +GRANT TRAVERSE ON GRAPH * TO ROLE exampleRole +---- + +Returned GQLSTATUS code:: +01N73 + +Returned status description:: +warn: sharded privilege performance. +The specified privilege severely reduces the performance of queries run on sharded databases. Consider excluding sharded databases for now. + +Suggestions for improvement:: +Grant the privilege explicitly to databases instead of to all. + +====== +[.include-with-neo4j-code] +====== +Command:: ++ +[source, cypher] +---- +GRANT TRAVERSE ON GRAPH * TO ROLE exampleRole +---- + +Suggestions for improvement:: +Grant the privilege explicitly to databases instead of to all. +====== +===== + [#_topology_notifications] == `TOPOLOGY` notifications