MarkLogic Server
XQUERY API DOCUMENTATION
3.2
This page was generated
January 5, 2009
5:42 PM
XQuery Built-In and Modules Function Reference
  All XQuery Functions
 MarkLogic Server Built-In Functions
  Extension (xdmp:)
   Search (cts:)
   cts:query Constructors (cts:)
   Classifier (cts:)
   Math (math:)
   Document Conversion (xdmp:)
   Update (xdmp:)
   App Server (xdmp:)
   Security (xdmp:)
  Server Monitoring (xdmp:)
   Profile (prof:)
   Debug (dbg:)
  XQuery Module Functions
  Security (sec:)
   Thesaurus (thsr:)
   Spell (:)
   Triggers (trgr:)
   Content Processing Framework (cpf:)
   Links (lnk:)
   Domains (dom:)
   Pipelines (p:)
   Generic Conversion (cvt:)
   MSWord Conversion (msword:)
   Excel Conversion (excel:)
   Powerpoint Conversion (ppt:)
   PDF Conversion (pdf:)
   DocBook Conversion (dbk:)
   CSS Conversion (css:)
   XHTML Conversion (xhtml:)
  W3C Built-In Functions
  Accessor (fn:)
   AnyURI (fn:)
   String (fn:)
   Boolean (fn:)
   Context (fn:)
   DurationDateTime (fn:)
   Node (fn:)
   Numeric (fn:)
   Sequence (fn:)
   QName (fn:)
   Error and Trace (fn:)
   W3C XQuery Reference
  W3C XQuery Functions
   W3C XQuery Language

Built-In: Security

The security built-in functions are XQuery functions to perform many security-related tasks in MarkLogic Server.
Function Summary
xdmp:amp-roles Returns the set of all roles assigned to an amp, including roles directly assigned to the amp and roles inherited by other roles.
xdmp:can-grant-roles Tests whether a user can grant or revoke a set of roles.
xdmp:default-collections Returns the collections any new document would get if the current user were to insert a document without specifying the collections.
xdmp:default-permissions Returns the permissions any new document would get if the current user were to insert a document without specifying the default permissions.
xdmp:document-get-permissions Returns the permissions to a given document.
xdmp:get-current-roles Returns all the current roles, both assigned and inherited by the current user and any received from amps.
xdmp:get-current-user Returns the name of the current user.
xdmp:get-request-user Returns the id of the current user.
xdmp:has-privilege Tests whether the current user has at least one of a given set of privileges.
xdmp:permission Returns a permission element in the security namespace corresponding to the named role and capability given.
xdmp:privilege-roles Returns the set of all roles that have a given privilege.
xdmp:role-roles Returns the set of all roles inherited by a given role, including roles directly assigned to the role and roles inherited from other roles.
xdmp:security-assert Tests whether the current user has at least one of a given set of privileges.
xdmp:user-roles Returns all roles assigned to a user, including roles directly assigned to the user and roles inherited by other roles.
Function Detail
xdmp:amp-roles(
$namespace-uri as xs:string,
$localname as xs:string,
$document-uri as xs:string,
$database-id as xs:unsignedLong
)  as  xs:unsignedLong*
Summary:

Returns the set of all roles assigned to an amp, including roles directly assigned to the amp and roles inherited by other roles.

Parameters:
$namespace-uri : The amped function namespace URI.
$localname : The amped function localname.
$document-uri : The amped function module URI.
$database-id : The database ID containing the module.

Example: 
  xdmp:amp-roles("http://marklogic.com", 
                 "read-docs", 
                 "/app/docs.xqy",
                 239487239487)
  =>(2349872340, 432987324)
xdmp:can-grant-roles(
$roles as xs:string*
)  as  empty()
Summary:

Tests whether a user can grant or revoke a set of roles. Raises an error if the session user can not.

Parameters:
$roles : A set of role names

Example: 
  xdmp:can-grant-roles(("development", "qa"))
xdmp:default-collections(
[$uri as xs:string]
)  as  element()*
Summary:

Returns the collections any new document would get if the current user were to insert a document without specifying the collections.

Parameters:
$uri (optional): The document URI to get parent directory.

Example: 
  xdmp:default-collections()
  =>("http://example.com/docs",
        "http://example.com/manuals")
xdmp:default-permissions(
[$uri as xs:string]
)  as  element()*
Summary:

Returns the permissions any new document would get if the current user were to insert a document without specifying the default permissions.

Parameters:
$uri (optional): The document URI to get parent directory.

Example: 
  xdmp:default-permissions("http://example.com/content/foo.xml")
  =>(<sec:permission>
          <sec:capability>read</sec:capability>
          <sec:role-id>324978243</sec:role-id>
        </sec:permission>,
        <sec:permission>
          <sec:capability>read</sec:capability>
          <sec:role-id>32493478578243</sec:role-id>
        </sec:permission>,
        <sec:permission>
          <sec:capability>update</sec:capability>
          <sec:role-id>32493478578243</sec:role-id>
        </sec:permission>)
xdmp:document-get-permissions(
$uri as xs:string
)  as  element()*
Summary:

Returns the permissions to a given document.

Parameters:
$uri : The document URI.

Example: 
  xdmp:document-get-permissions("chapter5.xml")
  =>(<sec:permission>
          <sec:capability>read</sec:capability>
          <sec:role-id>324978243</sec:role-id>
        </sec:permission>,
        <sec:permission>
          <sec:capability>read</sec:capability>
          <sec:role-id>32493478578243</sec:role-id>
        </sec:permission>,
        <sec:permission>
          <sec:capability>update</sec:capability>
          <sec:role-id>32493478578243</sec:role-id>
        </sec:permission>)
xdmp:get-current-roles( ) as xs:unsignedLong*
Summary:

Returns all the current roles, both assigned and inherited by the current user and any received from amps.

Example: 
  xdmp:get-current-roles()
  =>(2349872340, 432987324)
xdmp:get-current-user( ) as xs:string
Summary:

Returns the name of the current user.

Example: 
  xdmp:get-current-user()
  =>"ian"
xdmp:get-request-user( ) as xs:unsignedLong
Summary:

Returns the id of the current user.

Example: 
  xdmp:get-request-user()
  =>23987236
xdmp:has-privilege(
$privileges as xs:string*,
$kind as xs:string
)  as  xs:boolean
Summary:

Tests whether the current user has at least one of a given set of privileges. Returns true if they do, false otherwise.

Parameters:
$privileges : The set of privilege URIs. These are the URIs for the privileges, not the names of the privileges.
$kind : The kind of privileges (either "execute" or "uri").

Example: 
xdmp:has-privilege("http://myprivs/function-foo", "execute")
  => true if the current user has the execute privilege on a 
     privilege with the URI "http://myprivs/function-foo"
xdmp:permission(
$role as xs:string,
$capability as xs:string
)  as  element()
Summary:

Returns a permission element in the security namespace corresponding to the named role and capability given.

Parameters:
$role : A role name.
$capability : A capability (read, update, insert, or execute).

Example: 
  xdmp:permission("development", "read")
  =><sec:permission>
          <sec:capability>read</sec:capability>
          <sec:role-id>32497824353</sec:role-id>
       </sec:permission>
xdmp:privilege-roles(
$action as xs:string,
$kind as xs:string
)  as  xs:unsignedLong*
Summary:

Returns the set of all roles that have a given privilege.

Parameters:
$action : The privilege action.
$kind : The privilege kind.

Example: 
  xdmp:privilege-roles(
         "http://marklogic.com/privileges/delete-all", 
         "execute")
  =>(2349872340, 432987324)
xdmp:role-roles(
$name as xs:string
)  as  xs:unsignedLong*
Summary:

Returns the set of all roles inherited by a given role, including roles directly assigned to the role and roles inherited from other roles.

Parameters:
$name : The role name.

Example: 
  xdmp:role-roles("vp")
  =>(2349872340, 432987324)
xdmp:security-assert(
$privileges as xs:string*,
$kind as xs:string
)  as  empty()
Summary:

Tests whether the current user has at least one of a given set of privileges. Raises an error if the user does not have any of the privileges.

Parameters:
$privileges : The set of privilege URIs. These are the URIs for the privileges, not the names of the privileges.
$kind : The kind of privileges (either "execute" or "uri").

Example: 
  xdmp:security-assert("function-foo", "execute")
xdmp:user-roles(
$name as xs:string
)  as  xs:unsignedLong*
Summary:

Returns all roles assigned to a user, including roles directly assigned to the user and roles inherited by other roles.

Parameters:
$name : The user name.

Example: 
  xdmp:user-roles("ian")
  =>(2349872340, 432987324)
© Copyright 2002-2008 Mark Logic Corporation.  All rights reserved.