42NAM

Status description

error: syntax error or access rule violation - unsupported temporal function form in auth rule condition. { $input } cannot be used in auth rule conditions as it retrieves the current time. Only transaction start time is available at the time of auth rule evaluation. Use { $replacement } instead.

Explanation

Auth rule conditions are evaluated at a different point in time than regular queries. When a temporal function such as date(), datetime(), localdatetime(), localtime(), or time() is called with a map argument whose only key is timezone (e.g. date({timezone: 'UTC'})), it retrieves the current time. Because the current time is not available during auth rule evaluation — only the transaction start time is — these calls are not allowed in auth rule conditions.

Use the .transaction() form of the temporal function instead, which returns the transaction start time:

Disallowed form Suggested replacement

Disallowed form	Suggested replacement
`date({timezone: 'UTC'})`	`date.transaction('UTC')`
`datetime({timezone: 'Europe/Stockholm'})`	`datetime.transaction('Europe/Stockholm')`

date({timezone: 'UTC'})

date.transaction('UTC')

datetime({timezone: 'Europe/Stockholm'})

datetime.transaction('Europe/Stockholm')

This error is returned as the cause of 42001.

Example scenarios

CREATE AUTH RULE with disallowed temporal function

Try creating an auth rule whose condition uses date({timezone: 'UTC'}):

CREATE AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > date({timezone: 'UTC'});

The query returns a chain of errors where GQLSTATUS 42NAM is the cause of GQLSTATUS 42001:

GQLSTATUS error chain

42NAM: syntax error or access rule violation - unsupported temporal function form in auth rule condition. 'date({timezone: 'UTC'})' cannot be used in auth rule conditions as it retrieves the current time. Only transaction start time is available at the time of auth rule evaluation. Use 'date.transaction('UTC')' instead. (line 1, column 82 (offset: 81))
"CREATE AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > date({timezone: 'UTC'})"
                                                                                  ^
  42001: syntax error or access rule violation - invalid syntax

To resolve this, replace the function call with the .transaction() form:

CREATE AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > date.transaction('UTC');

ALTER AUTH RULE with disallowed temporal function

Try changing an auth rule whose condition uses datetime({timezone: 'Europe/Stockholm'}):

ALTER AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > datetime({timezone: 'Europe/Stockholm'});

The query returns a chain of errors where GQLSTATUS 42NAM is the cause of GQLSTATUS 42001:

GQLSTATUS error chain

42NAM: syntax error or access rule violation - unsupported temporal function form in auth rule condition. 'datetime({timezone: 'Europe/Stockholm'})' cannot be used in auth rule conditions as it retrieves the current time. Only transaction start time is available at the time of auth rule evaluation. Use 'datetime.transaction('Europe/Stockholm')' instead. (line 1, column 81 (offset: 80))
"ALTER AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > datetime({timezone: 'Europe/Stockholm'})"
                                                                                 ^
  42001: syntax error or access rule violation - invalid syntax

To resolve this, replace the function call with the .transaction() form:

ALTER AUTH RULE authRule SET CONDITION abac.oidc.user_attribute('start_date') > datetime.transaction('Europe/Stockholm');

Glossary

$action: Freeform description of an action.
$alias: An alias name, mydb-alias.
$aliasList: A list of alias names, for example, mydb-alias1, mydb-alias2.
$allocType: Allocation type (primary or secondary).
$arg: Procedure or function argument, for example, database, pause, dryrun, etc.
$argList: A list of procedure or function arguments, for example, edition, name and versions.
$argType: Argument type, either input or output.
$auth: Auth provider name, for example, ldap, native.
$authRule: ABAC auth rule name.
$boltServerState: Bolt server state, for example, READY.
$boltMsgLenLimit: Bolt message length limit, for example, 1000.
$bytes: Number of bytes.
$cause: Freeform description of what caused the error.
$cfgSetting: Configuration setting key, for example, server.https.enabled.
$clause: A Cypher clause, for example, USE, MATCH.
$clause: A list of Cypher clauses, for example, USE, MATCH.
$cmd: A Cypher command, for example, DROP DATABASE, PROFILE, SHOW PROCEDURES.
$component: A component of something, for example, hours/minutes within a time, a subset input within the whole input, TOPOLOGY clause within the whole CREATE/ALTER DB … SET TOPOLOGY, etc.
$constr: Constraint name, for example, book_isbn.
$constrDescrOrName: Constraint description, (:Label {property0, property1, property2, property1, property3}).
$context: Freeform description of a context, where something is invalid or unsupported, OPTIONS, URL, username, etc.
$coordinates: Coordinate value, for example, [3.15, 4.012, 5.905].
$count: Number of something, for example, 3.
$countAllocs: Desired number of servers to use.
$countSeeders: Number of seeding servers.
$crs: Coordinate reference system, for example, WGS84.
$db: Database name, for example, myDb.
$dbList: A list of database names.
$dim: Number representing index or point dimenionality.
$edition: Neo4j edition, for example, Community or Enterprise.
$endpointType: One of start or end of a relationship.
$entityId: ID of a node or a relationship.
$entityType: A node or a relationship.
$expr: Cypher expression, for example, 1 + n.prop.
$exprType: Freeform expression type, for example, EXISTS, COUNT, COLLECT.
$feat: Freeform feature description.
$field: Input field, for example, of a procedure, function, or deserialization.
$fun: Function name, for example, collect().
$funClass: User-defined function implementation class name, for example, MyFunctionClass.
$funType: Function type, e.g. non-deterministic or aggregate.
$graph: The name of a graph, for example, myGraph.
$graphTypeDependence: Graph type dependencency for constraint, one of UNDESIGNATED, INDEPENDENT, or DEPENDENT.
$graphTypeElement: An element of a graph type, for example (:Node ⇒ { name :: STRING}), or (:Source)-[:REL ⇒]→(:Target).
$graphTypeReference: Graph type reference, for example, (:Node ⇒) or p.
$graphTypeOperation: Graph type operation, for example, one of SET, ADD, DROP or ALTER.
$hint: Freeform description of a hint, for example, USING INDEX n:N(prop).
$hintList: A list of free form descriptions of hints like USING INDEX n:N(prop).
$ident: A generic identifier, for example my_identifier.
$idx: Index name, my_index.
$idxDescr: Index description, for example, INDEX :Person(name).
$idxDescrOrName: Index descriptor or name.
$idxOrConstr: Index or constraint name, for example, my_index or book_isbn.
$idxOrConstrPat: Index or constraint pattern, for example, CREATE CONSTRAINT bar IF NOT EXISTS FOR (n:L) REQUIRE (n.p1) IS NODE KEY.
$idxType: Index type, for example, text, vector, etc.
$input: Piece of user input.
$inputList: A list of user inputs.
$item: Freeform description of an item.
$keyword: Cypher keyword, for example, MERGE.
$label: Label name, for example, Person.
$labelExpr: Label expression, for example, (n:Movie|Person).
$labelList: A list of label names, for example, Person, Actor.
$lower: The lowest accepted number of a range.
$mapKey: Map key.
$mapKeyList: A list of map keys, for example, first and second in the map {first: 1, second: 2}.
$matchMode: GPM match mode, for example, REPEATABLE ELEMENTS.
$msg: Freeform message.
$msgTitle: Freeform message title.
$namespaceList: A list of namespaces of procedures, for example, apoc.math..
$operation: A mathematical operation, for example, / by zero, >.
$option: Option name
$optionList: A list of option names.
$param: Parameter name, for example, $pattern.
$paramList: A list of parameters, for example $pattern, $prop.
$pat: Pattern, for example, (:Person).
$pathMode: GPM path mode, for example, ACYCLIC.
$pathModeList: A list of GPM path modes, for example, TRAIL, ACYCLIC.
$port: Port name, for example, 6362.
$portList: A list of port names, for example, 6362, 6000, 7000.
$pos: A position, for example, in a sequence, for example, 2
$pred: A predicate, for example, x = 3.
$predList: A list of predicates, for example, 'x = 3', 'y > 4'.
$preparserInput: Piece of preparser input.
$proc: Procedure name, for example, db.labels().
$procClass: User-defined procedure implementation class name, for example, MyProcedureClass.
$procExeMode: Procedure execution mode, one of READ, WRITE, SCHEMA, and DBMS.
$procField: User-defined procedure implementation class argument name, for example, myArgument.
$procFieldType: User-defined procedure implementation class argument type, one of input or output.
$procFun: Procedure or function name or ID, for example, db.labels() or collect().
$procMethod: User-defined procedure implementation class method name, for example, myProcedureMethod
$procParam: User-defined procedure implementation parameter name.
$procParamFmt: Freeform user-defined procedure implementation parameter format, for example, com.example.*.
$propKey: Property key name, for example, name.
$propKeyList: A list of property key names, for example, name, age, hometown.
$query: A statement that retrieves or writes information to a database, for example, MATCH (n) WHERE n.prop.
$reasonList: A list of reasons of the failure.
$relType: Relationship type name, for example, KNOWS.
$replacement: A free-form text, a replacement of a deprecated feature, a Cypher command, etc.
$role: RBAC role name, for example, admin, public, receptionist.
$routingPolicy: Routing policy name.
$runtime: Cypher runtime name. One of slotted, pipelined, and parallel.
$schemaDescr: Schema descriptor, for example, (:Label1 {prop1}).
$schemaDescrType: Freeform type of schema descriptor, for example, label property existence constraint.
$selector: GPM path selector, for example, ALL PATHS, SHORTEST 2, etc.
$selectorOrPathMode: GPM path selector, for example, ALL PATHS, SHORTEST 2, etc, or GPM path mode, for example ACYCLIC, TRAIL, etc.
$selectorType: Selector type.
$server: Server name or ID, for example, 25a7efc7-d063-44b8-bdee-f23357f89f01.
$serverList: A list of server names or IDs, for example, 'server-1', 'server-2'.
$serverType: Server type, PRIMARY (primaryConstrained), SECONDARY (secondaryConstrained), or NONE.
$serverAddress: Server address, for example, localhost:20025.
$sig: Procedure or function signature, for example, date(input = DEFAULT_TEMPORAL_ARGUMENT :: ANY) :: DATE
$storeFormat: Store format name. One of "aligned", "block", "standard", "high_limit".
$syntax: Cypher syntax or keyword.
$temporal: Temporal value, for example, 2025-02-18.
$timeAmount: Integral amount of time unit (a number).
$timeUnit: Common time unit name, for example, seconds, minutes, hours.
$token: Token name, for example, MyLabel, MyRelationshipType, myPropertyKey.
$tokenId: Token ID.
$tokenType: One of a label, a relationship type, or a property key.
$transactionId: The transaction ID of a running query.
$typeDescription: Freeform description of a type e.g. 'a list'.
$upper: The highest accepted number of a range.
$url: A URL, for example, https://example.com.
$user: A user name, for example, neo4j.
$value: Some value.
$valueList: A list of values.
$valueType: Cypher value type, for example, STRING, BOOLEAN, INTEGER, LIST<STRING>, etc.
$valueTypeList: A list of Cypher value types.
$variable: Variable name, for example, n.
$variableList: A list of variable names, for example, a, b, c.
$version: A version, for example, 25 in CYPHER 25.