nl_tokens: Ensures the user is authorized to create / replace / delete this document
pl_tokens: function authorize ( doc , oldDoc , docDefinition ) { var authorizedChannels = getRequiredAuthorizations ( doc , oldDoc , docDefinition . channels ) ; var authorizedRoles = getRequiredAuthorizations ( doc , oldDoc , docDefinition . authorizedRoles ) ; var authorizedUsers = getRequiredAuthorizations ( doc , oldDoc , docDefinition . authorizedUsers ) ; var channelMatch = false ; if ( authorizedChannels ) { try { requireAccess ( authorizedChannels ) ; channelMatch = true ; } catch ( ex ) { // The user has none of the authorized channels if ( ! authorizedRoles && ! authorizedUsers ) { // ... and the document definition does not specify any authorized roles or users throw ex ; } } } var roleMatch = false ; if ( authorizedRoles ) { <mask> { requireRole ( authorizedRoles ) ; roleMatch = true ; } catch ( ex ) { // The user belongs to none of the authorized roles if ( ! authorizedChannels && ! authorizedUsers ) { // ... and the document definition does not specify any authorized channels or users throw ex ; } } } var userMatch = false ; if ( authorizedUsers ) { try { requireUser ( authorizedUsers ) ; userMatch = true ; } catch ( ex ) { // The user does not match any of the authorized usernames if ( ! authorizedChannels && ! authorizedRoles ) { // ... and the document definition does not specify any authorized channels or roles throw ex ; } } } if ( ! authorizedChannels && ! authorizedRoles && ! authorizedUsers ) { // The document type does not define any channels, roles or users that apply to this particular write operation type, so fall back to // Sync Gateway's default behaviour for an empty channel list: 403 Forbidden for requests via the public API and either 200 OK or 201 // Created for requests via the admin API. That way, the admin API will always be able to create, replace or remove documents, // regardless of their authorized channels, roles or users, as intended. requireAccess ( [ ] ) ; } else if ( ! channelMatch && ! roleMatch && ! userMatch ) { // None of the authorization methods (e.g. channels, roles, users) succeeded var errorMessage = 'missing channel access' ; var error = new Error ( errorMessage ) ; error . forbidden = errorMessage ; throw error ; } return { channels : authorizedChannels , roles : authorizedRoles , users : authorizedUsers } ; }