Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of jchris@gmail.com designates
 209.85.216.181 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:date
         :x-google-sender-auth:message-id:subject:from:to:content-type
         :content-transfer-encoding;
        b=hOjAmilSyTCL4uV235DsmwF1x0dJ5bBdVLhIUgyK4ZmBfX+rNXsvmw/DuFPq95JfG3
         zCxXg4GWuq71C+7NFWnEwLA+04L7SeFIZ9yKwx24Ep7J1fVp8Jy1rKjgyyJZrKjmJPlo
         /5mJlu340oL5P5LS0LC1colIi4JBYh0BDkkG4=
MIME-Version: 1.0
Sender: jchris@gmail.com
In-Reply-To: <8b1c89270909120747r4245de68v6cd543e1787c3ea8@mail.gmail.com>
References: <8b1c89270909120747r4245de68v6cd543e1787c3ea8@mail.gmail.com>
Date: Sat, 12 Sep 2009 22:16:47 -0700
Message-ID: <e282921e0909122216k6d122940nc0210f8a555ebe1d@mail.gmail.com>
Subject: Re: CouchDB Validation function and security API ..
From: Chris Anderson <jchris@apache.org>
To: user@couchdb.apache.org, dghosh@acm.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Sat, Sep 12, 2009 at 7:47 AM, Debasish Ghosh
<ghosh.debasish@gmail.com> wrote:
> Hi -
>
> The validation function validate_doc_update takes 3 parameters, newdoc,
> olddoc and userContext. I am trying to get my head into how the
> authentication and authorization stuff is related to this. The CouchDB bo=
ok
> has the following code snippet in 7.2.4 Authorship section ..
> function(newDoc, oldDoc, userCtx) {
> =A0if (newDoc.author) {
> =A0 =A0enforce(newDoc.author =3D=3D userCtx.author,
> =A0 =A0 =A0"You may only update documents with author " + userCtx.author)=
;
> =A0}
> }
>
> In my linux environment, when I run CouchDB validation functions with a
> user-id and password setup in local.ini under [admins], I get the followi=
ng
> as the contents of the third parameter of the validation function :-
>
> {"db" : "test", "name" : null, "roles" : []}
>
> In the above snippet from the book there appears to be a field
> userCtx.author. Just wondering how to get it here and why I am not seeing=
 it
> in my output.
>

heh, thanks for the catch.. It should read:

enforce(newDoc.author =3D=3D userCtx.name

> Also any pointer on the security, authentication and authorization part w=
ill
> be appreciated.
>

I'm not sure, but you should be getting more when you are properly
logged in -- this is worth investigating more. What do you get for
this?:

$ curl http://jchris:mysecretpassword@localhost:5984/_session
{"ok":true,"name":"jchris","roles":["_admin"]}


> Thanks in advance ..
> - Debasish
>


--=20
Chris Anderson
http://jchrisa.net
http://couch.io