Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of b.candler@pobox.com
 designates 208.72.237.25 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=date:from:to
	:subject:message-id:references:mime-version:content-type
	:in-reply-to; q=dns; s=sasl; b=A9vdx62mW7cPWmkickiz6WZYKp8FsTHev
	4iVu1om66oWlyKaN8AeBFpEEzQYCHJxz5n0IEz/bcDcdSlZHVQhSeVb01mbHKJjp
	d+lxTl3kNVifUKtyyaEVJY/u2iPAc3WnZutgOcBpz8SDVb/PUnH2uMD055VqPjcE
	LNXmw1/Kks=
Date: Tue, 9 Feb 2010 10:04:19 +0000
From: Brian Candler <B.Candler@pobox.com>
To: dev@couchdb.apache.org
Subject: Re: DB ACLs (was Re: 0.11 Release / Feature Freeze for 1.0)
Message-ID: <20100209100419.GB5270@uk.tiscali.com>
References: <e282921e1002030921g53af1711r3b46ebe31f4cb38b@mail.gmail.com>
 <20100203212426.GA10515@uk.tiscali.com> <015a01caa529$3d24e230$b76ea690$@com>
 <2C591A9F-55E4-49DD-A3E3-9BA075EAE633@apache.org>
 <20100205224225.GA8463@uk.tiscali.com> <20100206095856.GA5057@uk.tiscali.com>
 <e282921e1002061052t6b58a416h8ac75513a9c0f839@mail.gmail.com>
 <20100207091927.GA4771@uk.tiscali.com> <20100208161946.GA6227@uk.tiscali.com>
 <20100209100053.GA5270@uk.tiscali.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100209100053.GA5270@uk.tiscali.com>
User-Agent: Mutt/1.5.20 (2009-06-14)

On Tue, Feb 09, 2010 at 10:00:53AM +0000, Brian Candler wrote:
> Even going back to Admin Party it doesn't work:
> 
> $ curl -X POST -d '{"map":"function(doc) {}"}' http://127.0.0.1:5984/briantest/_temp_view
> {"error":"unauthorized","reason":"You are not authorized to access this db."}
> 
> However I'm a bit perplexed as to why view_errors.js in the test suite is
> still passing.

I can see now. I had a non-empty _readers list, and for some reason this was
preventing even system-level-admin or admin party mode from accessing
_temp_view. Removing this resource made it work.

$ curl http://127.0.0.1:5984/briantest/_readers
{"names":["brian","brianadmin"],"roles":[]}

$ curl http://127.0.0.1:5984/briantest/_admins
{"names":["brianadmin"],"roles":[]}

$ curl -d '{}' -X PUT http://127.0.0.1:5984/briantest/_readers
{"ok":true}

$ curl -X POST -d '{"map":"function(doc) { emit(JSON.stringify(123,null)); }"}' http://127.0.0.1:5984/briantest/_temp_view
{"total_rows":0,"offset":0,"rows":[]}