4 ms·

This is really cool, especially with companies now providing CouchDB hosting. The article says that writes can be validated so only authorised users may write.

• jchrisa 16y ago
  Read access is on a per-database basis. So if you have a work group only Joe, Anne, and Robert should access, you can give them a database, with their own copy of the app running in it. We don't do per-document read-control because it becomes to complex to manage in real world situations.
• TomasSedovic 16y ago
  A jchrisa pointed out, you can't get more granular than per-database read restriction using just CouchDB. However, you can put the database behind a proxy and use lists and shows (that get passed the user info) to restrict the read access.
  • limmeau 16y ago
    Great to see that feature... I only played with CouchDB in 0.7-days before shows and lists, and found it too everything-is-public for my needs. Let's suppose I want to build a centralized messaging application where users send each other private messages (and let's say per-user couches aren't available). Users may only see messages directed to them. Messages are contained in documents, one document per message (sounds like a reasonable granularity). For the JavaScript front-end, I'd like to ask the server for a list of messages for the current user, and later on, for the contents of one particular message. The list of messages for one user sounds like a simple map-reduce view. In order to only show messages targeted to the current user, my guess is that I should add a list function to the same design document to remove other users' items from the view result. To fetch a message by ID, I'd install a show function which either returns the original message as JSON text or an invalid access message, depending on the current user. Is that how you'd use shows and lists?
    • jchrisa 16y ago
      If you want to allow the users to take the db offline, you will still be happiest giving each user or group their own database. Databases are just a file on the server, and CouchDB has been deployed with millions of databases on a single server. So the one database per user model is totally viable.
    • TomasSedovic 16y ago
      Yes that would work. You could go a bit further, though: Set your view to emit keys this way: [user,message_id] you can query the view using: msgview?startkey=[user]&endkey=[user,{}] which will give you all the messages for the given user, or msgview?startkey=[user,message_id]&limit=1 for a specific message. Then your list doesn't have to go through all the messages for all the users -- just the ones that the view returned -- and only check that their user info is correct (i.e. nobody's calling the list using an inapropriate view). With this scheme you could have the same list + view return a specific message as well. Oh, and definitely go check CouchDB 1.0 -- it's changed quite a bit since 0.7. You can get a hosted version to play with at http://www.couch.io/get http://www.couch.io/get.
      • limmeau 16y ago
        Thank you!