Named query visibility scope and accidental public access in kdeneon

Answer to the Core Question

kdeneon does not expose a native permission system for named query visibility. In the JPA/Hibernate ecosystem, a named query is registered once in a persistence unit (via @NamedQuery, @NamedQueries, or an orm.xml element). After registration, any code that has access to the EntityManager or Session can invoke it with createNamedQuery(\"queryName\"). The framework itself performs no visibility check, nor does it distinguish between "internal" and "public" packages.

Parameter Binding (:name)

The :name syntax is purely a query‑execution feature. It protects against SQL injection by binding a value to a named parameter, but it carries no permission semantics. kdeneon's permission evaluation, if any, will only be applied when the repository or service method that calls the named query is guarded by application‑level security (e.g., Spring Security @PreAuthorize).

Package‑Level Visibility?

JPA/Hibernate provide no mechanism to restrict a named query to a particular package or to mark it as private. The only scoping is the persistence unit itself. If you need to enforce that only code in certain packages can call a query, you must wrap the call in a service method that checks the caller's role or package, or you can expose the query through a repository interface that is annotated with security constraints.

Practical Steps for Your Environment

1. Verify the JPA/Hibernate version. org.hibernate.version or javax.persistence.version can be printed at runtime. Older releases (pre-2.0) relied more on XML, but the visibility behaviour is the same.
2. Control access at the service level.

   @Service
   public class UserService {
       @PreAuthorize("hasRole('ADMIN')")
       public List<User> findActiveUsers() {
           return entityManager.createNamedQuery("User.findActive", User.class)
                               .getResultList();
       }
   }
   

3. Do not expose the EntityManager to untrusted code. Keep it inside beans that are subject to the security framework.
4. Document the intended visibility. In your internal wiki, note that named queries are global within the persistence unit and that any access control must be enforced by the application layer.

Version‑Dependent Caveats

• Hibernate 5.x and earlier allow named queries to be defined in orm.xml only; annotations (@NamedQuery) are standard since JPA 1.0 but are still fully supported.
• There is no change in visibility semantics across versions; the lack of scoping remains constant.
• If kdeneon introduces a proprietary wrapper around the JPA provider, you must consult its own documentation—no standard JPA feature will enforce package‑level visibility.

Missing Diagnostic Detail

To tailor the recommendation more precisely, could you confirm whether kdeneon is an internal, proprietary framework that extends JPA/Hibernate, or if you are simply using the standard JPA stack? Knowing the exact framework version and any custom security extensions will help determine if additional, framework‑specific controls exist.