Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of gurdiga@gmail.com designates
 209.85.218.211 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=nD/AV0Z5ZU7S1CSfJ3Re8CCKF22q/gttcMC8NziJ7gNcuUDGhxCjQWBBu+JXbZaRBZ
         W641NKvXNPgc2OjzhoQGwzVBwmqbewgpLZMZJCgPYgNIxY9wMqamYlzuMHRFUi0YgDDK
         +tdWFXLB2TXV7j8UKpWnp1MTfz9lWBBnYWcls=
MIME-Version: 1.0
In-Reply-To: <e282921e0909122307wa5921d1r903cd1f14c5330b4@mail.gmail.com>
References: <8F048321-4C3C-424C-8FC4-0C99354AB728@jasondavies.com>
	 <8989606E-3CAF-42C9-9935-FCAC0FAD81D3@apache.org>
	 <e282921e0909122307wa5921d1r903cd1f14c5330b4@mail.gmail.com>
Date: Sun, 13 Sep 2009 00:48:44 -0700
Message-ID: <da7069940909130048q691f54ebx9db7ed956c9989c8@mail.gmail.com>
Subject: Re: Per-DB Auth Ideas and Proposal
From: Vlad GURDIGA <gurdiga@gmail.com>
To: dev@couchdb.apache.org
Content-Type: text/plain; charset=UTF-8

I'm sorry to break the wave, but I wonder would it be practical to
have a kind of validate_doc_read.js? It would give a certain level of
consistency with the validate_doc_update.js mechanism, and we would
probably be able to have a unified security meta-data looking like:

var role = {
  editor: {
    can: {
      read: {books: true, authors: true},
      write: {books: true, authors: true},
      add: {books: true, authors: true}
    }
  }
};

var user = {

  john: {
    can: {
      read: {books: true, authors: true},
      add: {books: true, authors: true}
    },
    has: {
      role: {editor: true, administrator: true}
    }
  },

  mary: {
    can: {
      read: {authors: true},
      add: {authors: true}
    },
    has: {
      role: {editor: true}
    }
  }

};

This maybe looks a little verbose to write but feels pretty readable:

if (!user[userCtx.name].can.read.books && !user[userCtx.name].has.role.editor) {
  throw "Read access denied";
}

It would decouple security meta-data from the data itself (I'm not
saying that this would necessarily be a good thing though, let's
discuss).

What do you think?