title: CouchDb read authentication using lists
body: <p>I am looking into porting a website in CouchDB and it looks very interesting.</p>
  
  <p>However, a big problem is that CouchDB does not seem to support read authentication; all documents within a database are accessable by all readers. </p>
  
  <p>It is suggested <a href="https://stackoverflow.com/questions/2765165/couchdb-read-authentication">elsewhere</a> to use different databases for different reader-groups or to implement reader authentication in another (middle) tier, neither of which is an option for this project where the access is determined by complex, per document ACLs.</p>
  
  <p>I was thinking to implement the authentication in <em>lists</em> and to restrict all access to the CouchDb to these lists. This restriction could be enforced by the simple mod_rewrite clauses in the Apache used as reverse-proxy. The lists would simple fetch the row and check the userCtx against the document's ACL. Something like:</p>
  
  <pre><code>function(head, req) {
    var row;
    while (row = getRow()) {
       if (row.value.ACL[req.userCtx.name])
         send(row.value);
       else
         throw({unauthorized : "You are not allowed to access this resource"});
  }
  </code></pre>
  
  <p>Since I have no experience with CouchDB, and I haven't read about this approach anywhere, I'd like to know whether this approach could work.</p>
  
  <p>Is this a way to implement read access or am I abusing lists for the wrong purpose? Should I not expect such a simple solution is possible with CouchDB?</p>