Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of jchris@gmail.com designates
 209.85.219.166 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=bVIFoF3mb53qwf5vA1Bp0cWPd/gH13l8pz9q8aOAvCn7Lw60DHSr3rnYcpgzrR2U68
         je5LkmklbHg3fnUseq1pXqSWoFOOdLqDzY3OzS/0hegXnZzQv4UoMBazJtAT12i7xQD/
         FHPrZsJuvnjHCUP7DsWOP2qgV7JUhe8SLt5e0=
MIME-Version: 1.0
Sender: jchris@gmail.com
In-Reply-To: <200904091632.03736.alexweb@gmail.com>
References: <200904091632.03736.alexweb@gmail.com>
Date: Thu, 9 Apr 2009 08:39:06 -0700
Message-ID: <e282921e0904090839x6705ebaencf504f2f5ff9e7a5@mail.gmail.com>
Subject: Re: Permissions and partial replication
From: Chris Anderson <jchris@apache.org>
To: user@couchdb.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

2009/4/9 Alexander <alexweb@gmail.com>:
> Hi folks
>
> I'm thinking about using couchDB for the next project, but I have a few
> questions regarding the possibility to replicate docs with permissions
> respect.
> Let me to start with an example. Lets's say we have a database which hold=
s a
> products. Each product is a document with a simple structure:
>
> Product
> {
> =A0 =A0 =A0 =A0"_id": 123,
> =A0 =A0 =A0 =A0"category":"category_id_here"
> =A0 =A0 =A0 =A0"name": "product1",
> =A0 =A0 =A0 =A0"description": "product1 description"
> }
>
> Category
> {
> =A0 =A0 =A0 =A0"_id": 123,
> =A0 =A0 =A0 =A0"name": "name"
> =A0 =A0 =A0 =A0"parent_id": "12"
> }
>
> Lets's say we have a category tree:
>
> brands /
> =A0 =A0 =A0 =A0some_brand1 /
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 1
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 2
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 3
> =A0 =A0 =A0 =A0some_brand2 /
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 5
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 6
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0Product 7
>
> We also have a two managers: Manager1 is responsible for products in
> some_brand1 category and Manager2 is responsible for products in some_bra=
nd2
> category. Each person can manage products ONLY in his own category. Here =
is a
> small mockup of how we want to work.
> http://img209.imageshack.us/img209/5048/couchdb.png
>
> So each manager should be able to replicate data only from his own catego=
ry.
> Possible? Not possible? Will be possible in future?
>
>

You need to distinguish between read permissions and write
permissions. Currently it is possible to restrict changes to a given
document to users who are listed on that document itself. This
restriction will hold for inbound replication as well as local edits.
Outbound replication is just reading, which does not have access
control at this time.

Validation functions are applied on update, to local edits as well as
to inbound replication.


--=20
Chris Anderson
http://jchrisa.net
http://couch.io