CouchDB database structure

Viewed 68

We're creating a Capacitor app for fishing vessels for logging catches etc. We're contemplating using PouchDB/PouchDB-authentication with a CouchDB peruser configuration on the remote server. I've only worked with sql databases before, never document-based. I've read all the docs, but I'm still having a hard time wrapping my head around document-based and planning the database structure.

Core requirements:

  • For each vessel, there will be a small number of users (<9) which should have separate login credentials.
  • For each vessel, fishing trips will be added as they occur. Each trip will consist of multiple catch messages which can be easily stored as json.
  • There's no need to read data from multiple vessels at once. There are other mechanisms attending to that. (Not controlled by us).

What we need to know/decide:

  • Peruser setup. Can the users onboard a specific vessel share that vessel's data even if they have separate databases? If not, can we make peruser to be "per vessel" and keep the vessel's users in a document? I guess the users then would have to share the vessel's credentials among them, and not have personal credentials. It might be a viable option, however not ideal.
  • Authentication. I'm not to happy about storing the admin credentials in users' devices, it isn't safe. I'm thinking about creating a second "admin-light" user and reducing it's access rights with a design document, i.e. only allowing the creation of new users (vessels). It might also be an option that we create each vessel credentials on our own, then we wouldn't have to store any admin credentials on user devices at all.
  • For simplicity, we would very much like to avoid having a proxy script between http and CouchDB. But if it can't be avoided for this use case, then I can't see any reason why we should use document-based at all? In such case I'd rather do an sql solution instead.

Thoughts from experienced document-based database devs are very welcome!

1 Answers

Reguarding Auth, Yeah when initially looking at pouchDB and couchDB docs seeing the admin and password in the URLs can be a bit disconcerting. I looked into some of the other methods for Auth under in the couchdb docs and had some success

https://docs.couchdb.org/en/stable/api/server/authn.html

For me I decided to go with JWTs because I could set the expiration and manage thetokens myself. I am also able to remove the credentials from the URL because they are passed down through JWT 'Authorization' Cookie. JWT Auth can also be used with PouchDB.

Regarding the users and user access to databases, Ive been doing research into the _security doc for databases and the design_doc's validate_doc_update function. During updates this function gets run and is passed the User Context Object as well as the _security doc for the database. You can write your own logic to either allow the update to happen or not. Basically writing if statements to check the roles of the user or if they are a part of the members, this is the most simple case.

If I'm understanding couchdb correctly, the _security doc is still a regular document. Meaning you can add more to it than just the required "admin" and "members" keys. Not sure if doing this is a recommended solution to more fine grained permissions or access but it seems like a flexible way to get what you need.

Related