4

Say I have 1K+ clients, each running its own local PouchDB instance with client-specific data. I want all these clients to sync their data with CouchDB server so that I can re-initialise client's application from scratch with its own data from past.

Each client, thus each PouchDB instance, contains client-specific data. I want all clients to sync their data to server, but when it comes to server-to-client sync, I want to send back only these db entries that are relevant for the given client.

What's the best strategy to do it?

PouchDB article about filtered replication says that

There's no shame in creating a DB per user

However 10 Things Developers Should Know about Couchbase says that

Try to use 5 or less buckets in Couchbase. Never more than 10.

The same seems to be confirmed by Multi-tenancy with Couchbase Server:

Couchbase Server supports up to 10 buckets and that number can be dialed up, however the overhead of creating too many buckets drastically limits the density you can achieve.

Unless I completetly misunderstood something, the bucket-per-user (bucket == database in CouchDB) is not an option to go.

Alternatively, I can add a user's unique ID to each DB entity and use server filtering function, but PouchDB documentation says that:

Replicating only the user's documents via filtering might seem simplest, but filtering isn't a substitute for proper authentication.

So what's the preferred approach? I'm new to PouchDB/CouchDB so there is a good chance I missed some concepts here.

omnomnom
  • 8,911
  • 4
  • 41
  • 50
  • In case it helps, I think my question at http://stackoverflow.com/questions/43555490/the-replicator-database-is-not-scalable-or-my-design-needs-tweaking touches upon a similar problem. – redgeoff Apr 25 '17 at 03:58

1 Answers1

0

I would suggest having filtered replication using a filter that checks the userCtxt object in the request to authenticate each user combined with writing validate functions that checks if the current user has the rights to update a document:

Filter example:

function(doc, req) {
    if (!req.userCtx.name) {
    throw("Unauthorized!");
  }
 .....
}

Validate Function example:

"validate_doc_update": "function (newDoc, oldDoc, userCtx) {
     if (newDoc.author != userCtx.name) { 
         throw({ 
             forbidden: 'Only' + userCtx.name + ' may edit this document'
         });
     }
}"

Source: http://podefr.tumblr.com/post/30895595277/securing-couchdb-in-3-steps

Haresh
  • 61
  • 8