Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: local policy)
User-Agent: Kaiten Mail
In-Reply-To: 
 <CAPNuaCjcJfFVYn2anYkJ03mU0d=4VfgEEj-s3Wp=udhgJF_92w@mail.gmail.com>
References: <52C28C30.7010809@meredrica.org>
 <CAHdjipKDnJL=FMsB9LFzLR2oLTLV6n-+5rc_G06+XX_Y1J-m1w@mail.gmail.com>
 <52C291F9.80708@meredrica.org>
 <ACE57B78-1CE5-4D4F-AAB5-032415799F52@couchbase.com>
 <0C582CB4-CAA4-4BB4-A4EB-9529E177F0C9@apache.org>
 <43fe89b9-4cd4-4765-b406-33b7c3f7f66b@email.android.com>
 <10410DFE-478D-49EC-A022-01B89E498182@apache.org>
 <CAPNuaCjcJfFVYn2anYkJ03mU0d=4VfgEEj-s3Wp=udhgJF_92w@mail.gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain;
 charset=UTF-8
Subject: Re: Disabling doc include
From: "Florian Westreicher Bakk.techn." <stuff@meredrica.org>
Date: Thu, 02 Jan 2014 20:33:10 +0100
To: user@couchdb.apache.org
Message-ID: <c838aa64-dd4a-4059-9ec7-78ad639f2de7@email.android.com>

List function are bad for performance since they are evaluated every time they run. I wanted to avoid them and use views (disk storage is cheap, CPU is not) 

Stanley Iriele <siriele2x3@gmail.com> wrote:
>Correct me if I'm wrong here... If every doc had some meta info with
>it...
>And every URL rewrite went to a show or list function...couldn't you
>use
>the sec object passed on the request object to get what you want?... Or
>pass in some application level user credentials... Granted that doesn't
>sound very elegant
>On Jan 2, 2014 7:22 AM, "Robert Newson" <rnewson@apache.org> wrote:
>
>>
>> It doesn’t achieve the same effect, though, the virtual host + url
>> rewriter is not an access control mechanism. You’re still granting
>> database-wide read permissions to the user.
>>
>> B.
>>
>>
>> On 2 Jan 2014, at 09:09, Florian Westreicher Bakk.techn. <
>> stuff@meredrica.org> wrote:
>>
>> > I put a design doc behind a desk record / virtual host, that should
>do
>> the trick. The user that is used by the app is read only
>> >
>> > Robert Newson <rnewson@apache.org> wrote:
>> >> "there’s no notion of read-protection in CouchDB."
>> >>
>> >> There’s no document level read protection, but you can certainly
>grant
>> >> or deny read access to users on a per database basis. That’s by
>design
>> >> due to the ease that information could leak out through views
>> >> (particularly reduce views). The restrictive proxy approach is
>brittle,
>> >> it requires that you know all the URL patterns to block and keep
>them
>> >> up to date when you upgrade CouchDB. It can work, it’s just not
>> >> awesome.
>> >>
>> >> B.
>> >>
>> >> .
>> >>
>> >> On 1 Jan 2014, at 20:47, Jens Alfke <jens@couchbase.com> wrote:
>> >>
>> >>>
>> >>> On Dec 31, 2013, at 1:44 AM, meredrica <stuff@meredrica.org>
>wrote:
>> >>>
>> >>>> I expose CouchDB directly to mobile clients and wanted to hide
>some
>> >>>> information from them.
>> >>>
>> >>> You can’t really do that; there’s no notion of read-protection in
>> >> CouchDB.
>> >>> As a workaround you can put CouchDB behind a proxy or gateway,
>and
>> >> restrict the URL patterns that clients are allowed to send.
>> >>>
>> >>> —Jens
>> >>>
>> >
>> > --
>> > Sent from Kaiten Mail. Please excuse my brevity.
>>
>>

-- 
Sent from Kaiten Mail. Please excuse my brevity.