3 ms·

That's the purpose of the sync-gateway(in couchdb's case), it handles authorisation of actions against couchdb.

• andrewstuart2 12y ago
  Just because I'm authorized to create a record doesn't mean it's a valid record. Take my new order example. If all business rules, including payment authorization and payment record keeping, are handled client side, I can easily say that a valid payment has been made when it hasn't.
  • ollysb 12y ago
    I can see how there's a class of applications that would need the level of verification you're talking about(payment authorization being a good example). Many apps don't need that level of verification though, an app like trello for instance only needs to authorize actions against an entire resource, not values within a resource.
    • mercurial 12y ago
      On the other hand, if your app has no business rules, one would assume that your server-side application is going to be extremely thin.