Document access for a particular user is done in the Sync Function. It's a function written in JavaScript that resides in the configuration file of Sync Gateway.
The methods available in the Sync Function are:
channel(channelname)
: Route a document to a channel.
access(username, channelname)
: Grant a username access to a channel (possibility to grant a role to a channel too, and as a result all users with that role get access to the channel).
role(username, rolename)
: Assign a user with a role.
requireAccess(channelname)
: Throws an error if the user in the context doesn't already have access to the channel.
requireUser(username)
: Throws an error if the user in the context isn't the username.
requireRole(rolename)
: Throws and error if the the user in the context doesn't have the role rolename.
throw({forbidden: "error message"})
: Throw an exception for custom validation.
Here's an example of a config file with inline comments:
{
"log": ["REST", "CRUD"],
"users": {
"foo1": {"password": "letmein", "admin_roles": ["admin"]},
"foo2": {"password": "letmein"}
},
"databases": {
"quizz": {
"sync": `function(doc, oldDoc) {
// The owner field shouldn't change during updates
if (doc.owner != oldDoc.owner) {
throw({forbidden: "Can't change the owner field on existing documents"});
}
switch(doc.type) {
case "list":
// only users with admin role can create/update list documents
requireRole("admin");
break;
case "todo":
// only the owner of a todo document can create/update it
require(doc.owner);
break;
}
}`
}
}
}
Note: The Sync Function should be pure which means that given an input (a document revision), the output should remain the same regardless of time (i.e. you can't make database/http requests for example). Also, it's not possible to modify the revision in the sync function.
See the docs on the Sync Function for more detail and this tutorial for a more in-depth example.