4

I'd like to get some advice on how to structure the user data for my CouchDB application.

Here's what we're building: We are creating a suite of applications (mostly leveraging the video api of html5) that train people on different skills. We're going to start with a few simple video lectures coupled with interactive activities. We'd like to save individual user's progress, and in the near future we'd like to create some mini-courses that users take in small and large groups. Multiple users would participate in the same activity either live (like google docs), or over some long duration (like a wiki).

My concern is with private user data. Ultimately it would be the simplest, for us and the user, for them to sign up with their email address and a password. But, in CouchDB's _user database read access to the data is essentially public, and I'd rather not make all my user's email addresses public. How to make those email addresses private is my biggest concern. In addition it would be nice if we could have all user data be private unless the user chooses to make it public.

I have thought of a few options, and read through this article and many others on the wiki: http://wiki.apache.org/couchdb/PerDocumentAuthorization

I'm really not leaning toward anything yet, and would love some advice.

David Wolever
  • 148,955
  • 89
  • 346
  • 502
Costa Michailidis
  • 7,691
  • 15
  • 72
  • 124

1 Answers1

2

In the soon-to-be-released CouchDB-1.2.0, documents in the _users database can only be read by the respective authenticated user and administrators.

Marcello Nuccio
  • 3,901
  • 2
  • 28
  • 28
  • Truth?! So if I'm logged in as a specific user, I can't read other user's data? – Costa Michailidis Mar 26 '12 at 18:59
  • Just tested that out, works really really well. Users can GET POST and (probably) DELETE their own _user doc, but can't even read anyone else's. When they GET someone else's doc they get "missing" in the response. The only hint that other users even exist is the doc_count on the _user db. Thanks so much Marcello! – Costa Michailidis Mar 27 '12 at 16:20