user roles - CouchDB-wide read-only access rights

Question

I need to create a CouchDB user which can only read documents from any database but can't write any of them. As far as I'm concerned, it is not what is supported by default (user types are described here).

As the wiki says, access rights are given per database, so it seems what I am trying to do is not the best way to use CouchDB.

Anyway, it would be great to do that. Could you please give me some tips on how to implement that?

Answer 1

You will need to put a design doc in each database you want to enforce this rule. The design doc will have to have a 'validation function' that checks for something on the user that says whether they have write access or not.

Here is a chapter on validation functions form the official CouchDB book.

And even better, here is a validation function that only let admins modify a doc, and restrict regular users to read-only access. Here you can find an explanation of the function.