Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\))
Subject: Re: Cloudant document-level permissions feature?
From: =?utf-8?Q?Aur=C3=A9lien_B=C3=A9nel?= <aurelien.benel@utt.fr>
In-Reply-To: <CA+tVtbC7ZGVMvibbH3RUJPiTRyrsH4S1Qf2U5nO_VPwdRg9auA@mail.gmail.com>
Date: Thu, 25 Aug 2016 15:43:14 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <99CB9C42-3F19-4A83-9F51-07A4C5B29D9D@utt.fr>
References: <CA+tVtbC7ZGVMvibbH3RUJPiTRyrsH4S1Qf2U5nO_VPwdRg9auA@mail.gmail.com>
To: user@couchdb.apache.org
archived-at: Thu, 25 Aug 2016 13:43:35 -0000

Hi William,

> Ran into the old 'need document-level permissions' problem here.

As replied by the devs, there is not a generic off-the-shelf =
high-performance document level permission feature in CouchDB.

However, there are numbers of workarounds depending on your needs:
1. If authorizations depend only on document UUID, just set a reverse =
proxy in front of CouchDB;
2. If they depend on the document content (e.g. an updatable access =
list) then a `show` depending on the `userCtx` object can be your friend =
to control reads (if you hide the default API behind a reverse proxy) =
and a `validate_doc_update` function, depending also on the `userCtx`, =
let you control updates.


Regards,

Aur=C3=A9lien=