{"action":"created","issue":{"url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/230","labels_url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/230/labels{/name}","comments_url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/230/comments","events_url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/230/events","html_url":"https://github.com/pouchdb/express-pouchdb/issues/230","id":97725094,"number":230,"title":"Where would I put in a filter on all reads (GETs)?","user":{"login":"bguiz","id":1773785,"avatar_url":"https://avatars.githubusercontent.com/u/1773785?v=3","gravatar_id":"","url":"https://api.github.com/users/bguiz","html_url":"https://github.com/bguiz","followers_url":"https://api.github.com/users/bguiz/followers","following_url":"https://api.github.com/users/bguiz/following{/other_user}","gists_url":"https://api.github.com/users/bguiz/gists{/gist_id}","starred_url":"https://api.github.com/users/bguiz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bguiz/subscriptions","organizations_url":"https://api.github.com/users/bguiz/orgs","repos_url":"https://api.github.com/users/bguiz/repos","events_url":"https://api.github.com/users/bguiz/events{/privacy}","received_events_url":"https://api.github.com/users/bguiz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-28T14:49:12Z","updated_at":"2015-07-28T16:04:07Z","closed_at":null,"body":"I have reviewed the various couchdb authentication recipes on @nolanlawson 's `pouchdb-authentication` project. [This one](https://github.com/nolanlawson/pouchdb-authentication#some-people-can-read-some-docs-some-people-can-write-those-same-docs) seems the closest to what I need to do, but not quite:\r\n\r\nI need users to be able to write documents, and have only some other users be able to read the documents. Not based on roles, but based on custom logic. For example user A wants some of his documents to only be read by user B, and some of his other documents to only be read by users C and D. User A may later change his mind about who gets to read which documents.\r\n\r\nIn any case, this leads down a rabbit hole about per-document read authorisation:\r\n\r\n- recommend per-user databases (won't work for above scenario)\r\n- [per doc read access control logic (ACL)](http://wiki.apache.org/couchdb/PerDocumentAuthorization)\r\n- [why CouchDB is reluctant to enable a `validate_doc_read` even though a `validate_doc_update` is available](http://mail-archives.apache.org/mod_mbox/couchdb-dev/201010.mbox/%3CC4B01815-5A28-4E5F-975D-70344B7570EC@apache.org%3E)\r\n\r\nSo, it seems unlikely that this could be solved at a CouchDB level.\r\n\r\nHowever, my thoughts are that when using `express-pouchdb` in conjunction with [pouchdb-authentication](https://github.com/nolanlawson/pouchdb-authentication), I don't see anything preventing this from happening at an `express` level - it could fit in neatly as middleware attached to express routes.\r\n\r\nQuestions:\r\n\r\n- On a server using `express` with `express-pouchdb`, would it be possible to add a middleware on any `GET` operations on that exposes the database, e.g. `/db`?\r\n- If so, how would we go about obtaining the `userCtx`, in a format similar to `validate_doc_update`?"},"comment":{"url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/comments/125664219","html_url":"https://github.com/pouchdb/express-pouchdb/issues/230#issuecomment-125664219","issue_url":"https://api.github.com/repos/pouchdb/express-pouchdb/issues/230","id":125664219,"user":{"login":"nolanlawson","id":283842,"avatar_url":"https://avatars.githubusercontent.com/u/283842?v=3","gravatar_id":"","url":"https://api.github.com/users/nolanlawson","html_url":"https://github.com/nolanlawson","followers_url":"https://api.github.com/users/nolanlawson/followers","following_url":"https://api.github.com/users/nolanlawson/following{/other_user}","gists_url":"https://api.github.com/users/nolanlawson/gists{/gist_id}","starred_url":"https://api.github.com/users/nolanlawson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nolanlawson/subscriptions","organizations_url":"https://api.github.com/users/nolanlawson/orgs","repos_url":"https://api.github.com/users/nolanlawson/repos","events_url":"https://api.github.com/users/nolanlawson/events{/privacy}","received_events_url":"https://api.github.com/users/nolanlawson/received_events","type":"User","site_admin":false},"created_at":"2015-07-28T16:04:06Z","updated_at":"2015-07-28T16:04:06Z","body":"`pouchdb-authentication` is just a sugar API for doing AJAX requests against a CouchDB or PouchDB Server. If you want to implement a couch-per-user-esque functionality, you would definitely have to do it inside of express-pouchdb.\r\n\r\nHowever you may find that it's easier to use a general-purpose tool that works against either CouchDB or PouchDB Server, such as [this Python project](https://github.com/ocasta/CouchDB-Selfservice)."}}