/query/graph scoping was a documented no-op (graph_service returned the
query unscoped) and neo4j_client permitted writes; a live probe showed a
nonexistent user could read the whole graph.
- Add Neo4jClient.execute_read() that opens the session with
default_access_mode=READ_ACCESS so the database refuses writes even if
validation is bypassed.
- GraphService.execute_query() now rejects queries containing
CREATE/MERGE/DELETE/DETACH/SET/REMOVE/DROP/FOREACH/LOAD or any CALL
(conservative word-boundary denylist on the uppercased query) and
executes through the read-only session; the no-op _scope_query_to_user
is removed.
- Remove the false user-scoping claims from /query/graph (main.py) and
/graph/query docs and the CypherQueryRequest model: the endpoints are
documented as admin/debug, unscoped read-only (per-tenant label
injection for arbitrary Cypher would need a real parser; /graph/nodes
remains the tenant-scoped path).
- Offline unit tests: denylist coverage (incl. lowercase/multiline/CALL),
word-boundary false-positive check, and READ_ACCESS session assertion.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
jpmschweitzerandClaude Fable 5
a4c299bf9b