Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of kevin.r.coombes@gmail.com
 designates 209.85.160.180 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:organization:user-agent:mime-version:to:cc
         :subject:references:in-reply-to:content-type
         :content-transfer-encoding;
        b=nUAftrOeIDXbMJycxwy+nEauYF9ddC9dW1pLC6ao88utDzOwqpobp69xPalujqObWi
         XB1wXSb2EuOZ02q0U5Sfu5ahfb1b59tV4o9PX4JNgdDg1QwO0XOqzqleedMOcNDgBBkV
         mVBuMa5W4NyM3gOmRJE2FpOy1JrnRb5uuVTQQ=
Message-ID: <4DB8910F.2070008@gmail.com>
Date: Wed, 27 Apr 2011 16:56:31 -0500
From: "Kevin R. Coombes" <kevin.r.coombes@gmail.com>
Organization: UT M.D. Anderson Cancer Center
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US;
 rv:1.9.2.14) Gecko/20110221 Thunderbird/3.1.8
MIME-Version: 1.0
To: dev@couchdb.apache.org
CC: Benoit Chesneau <bchesneau@gmail.com>
Subject: Re: doc permission mask proposal
References: <BANLkTinPpJo0X6C8iCRvoqd3UEbChj5ngA@mail.gmail.com>
	<ADD6E836-633B-4240-B3A9-70D51F549C3D@apache.org>
 <BANLkTikmxyTTHmW4LN+Ep7tS_GPz44eupQ@mail.gmail.com>
In-Reply-To: <BANLkTikmxyTTHmW4LN+Ep7tS_GPz44eupQ@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

So it would be possible to have access to a view that allows you see a 
doc that you don't have permission to see? Or am I misinterpreting 
something?

On 4/27/2011 4:43 PM, Benoit Chesneau wrote:
> On Wed, Apr 27, 2011 at 11:33 PM, Jan Lehnardt<jan@apache.org>  wrote:
>> On 27 Apr 2011, at 03:36, Benoit Chesneau wrote:
>>
>>> I'm thinking to add simple permissions handling to a doc by using
>>> _uid, _gid, _mod members to a doc where members are defined like this:
>>>
>>> _uid: user owning the doc
>>> _gid: group owning the doc
>>> _mod: octal number, doc mode bits corresponding to chmod(1) values.
>>>
>>> By doing this and if enable in settings we could do simple acl
>>> handling like a file system when getting doc. access to views would be
>>> handled by the access to the design doc containing them.
>>>
>>> thoughts?
>> http://mail-archives.apache.org/mod_mbox/couchdb-dev/201010.mbox/%3cC4B01815-5A28-4E5F-975D-70344B7570EC@apache.org%3e
>>
>> How does this address the issue where a reduced value doesn't have an ACL associated with it?
>>
>> Cheers
>> Jan
>> --
> you can't access to the view or reduce if yu don't have access to the
> design doc in my design. So we don't try to check permissions for each
> docs.
>
> - beno�t