Question

Let’s say I have two types of docs with one referencing the other, e.g. “orders” and “order_replies” the later one having a field “ref” which contains an ID of an order document.

For my validate_doc_update function I want a user only to be able to change an order_reply document if he is the author of the original order.

How can I get the “author” field from the order with the ID newDoc.ref within the function?

Here’s a part of my validation function so far:

if(userCtx.roles.indexOf('employee') >= 0) {
  // [...] other doc types
  if (newDoc.type == 'order_reply') {
    //newDoc.ref.author is not the proper approach
    require((userCtx.name == newDoc.ref.author), "this is not your order reply!");
  }
}

Answer 1

Put the author’s ID in the order’s ID. For example:

• The order: { "_id": "order/jack/1", ... }
• An order’s reply: { "ref": "order/jack/1", ... }

So you can check with:

if (userCtx.roles.indexOf('employee') !== -1) {
  if (newDoc.type === 'order_reply') {
    require(userCtx.name === newDoc.ref.split('/', 3)[1], "this is not your order reply!");
  }
}

If you have multiple authors, use "order/author1/author2/.../authorN/ordernum" as _id of the order and check with:

var parts = newDoc.ref.split('/'),
    authors = parts.slice(1, -1);
require(authors.indexOf(userCtx.name) !== -1, "this is not your order reply!");

UPDATE: Due to bug COUCHDB-1229, use of “/” in doc._id may cause problems. Depending on your use-case, it may be better to use another separator, e.g. “:”.