title: CouchDB Authorization Logic?
body: <p>I did read <a href="http://guide.couchdb.org/draft/security.html" rel="nofollow noreferrer">http://guide.couchdb.org/draft/security.html</a> and </p>
  
  <p>and the previous question
  <a href="https://stackoverflow.com/questions/4055450/couchdb-authorization-on-a-per-database-basis">CouchDB Authorization on a Per-Database Basis</a>
  and
  <a href="http://wiki.apache.org/couchdb/Security_Features_Overview" rel="nofollow noreferrer">http://wiki.apache.org/couchdb/Security_Features_Overview</a></p>
  
  <p>I am currently using Apache CouchDB 1.2.0 and via futon the adding an admin result in 
  adding a user at _users for example</p>
  
  <pre><code>_id
  org.couchdb.user:stackoverflow
   _rev 
  1-b9f223532b662d4ac52d14082d81e6a5
  
  name
  stackoverflow
  
  password
  null
  
  roles
  [ ]
  
  type
  user
  </code></pre>
  
  <p>So the first question is why the admin is added as type user and not admin is puzzling. This users are admin as they can do anything in any database and the role is empty BUT I did protect the _users document with</p>
  
  <pre><code>["admin"]
  </code></pre>
  
  <p>roles as the only members and only admins can access this (even if their role in the _users document is empty). </p>
  
  <p>This protection does not allow new "normal" users to be created so the futon "signup" command will return Signup error: You are not authorized to access this db.</p>
  
  <p>I think this setup is the only logical one. Why would you want anyone to be able to create a user on your database ??</p>
  
  <p>Even if you specify read access in a db to be only for one admin every admin can access it</p>
  
  <pre><code>(
  
   " admins" : {
     "names" : ["guru"],
     "roles" : ["boss"]
    },
    "readers" : {
      "names" : ["guru"],
     "roles" : ["boss"]
    }
  }
  </code></pre>
  
  <p>the above case has no impact on the newly created stackoverflow admin as per above example.</p>
  
  <p>So my assumption is that admins created via futon can do everything and anything regardless. The only confusing logical part is the _users documents where they have no special type (they are users) nor a special role. </p>
  
  <p>So back to the concrete question:
   - when adding an admin via futon why is it not marked as admin inside the _users document and how does CouchDB from that document determine that it is a wide system admin?
  - if you want to create a normal user WITHOUT allowing them to signup (via futon or direct HTTP Request) you have to protect the _users document. Yet how would you go to create yourself a user to read/write on his own database ? 
  - As the user (per CouchDB Docs) will have the read/write rights on a DB but not the possibility to create design documents how can he really use it efficiently as views will be needed for anyone developing using the DB?</p>
  
  <p>It should be possible to have a normal, simply multi hosting without jeopardizing security as there is a shared CouchDB offering at <a href="http://www.iriscouch.com/" rel="nofollow noreferrer">http://www.iriscouch.com/</a> so I just don't understand how logically you would structure a simple service where a user has his own database and can do <em>anything</em> but just on this database. As the admin role is anyway "user" how would you distinguish them from a non admin in the _users table ?</p>