{"action":"created","issue":{"url":"https://api.github.com/repos/colinskow/superlogin/issues/62","repository_url":"https://api.github.com/repos/colinskow/superlogin","labels_url":"https://api.github.com/repos/colinskow/superlogin/issues/62/labels{/name}","comments_url":"https://api.github.com/repos/colinskow/superlogin/issues/62/comments","events_url":"https://api.github.com/repos/colinskow/superlogin/issues/62/events","html_url":"https://github.com/colinskow/superlogin/issues/62","id":151629373,"number":62,"title":"Are privateDBs really private?","user":{"login":"SukantGujar","id":6153264,"avatar_url":"https://avatars.githubusercontent.com/u/6153264?v=3","gravatar_id":"","url":"https://api.github.com/users/SukantGujar","html_url":"https://github.com/SukantGujar","followers_url":"https://api.github.com/users/SukantGujar/followers","following_url":"https://api.github.com/users/SukantGujar/following{/other_user}","gists_url":"https://api.github.com/users/SukantGujar/gists{/gist_id}","starred_url":"https://api.github.com/users/SukantGujar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SukantGujar/subscriptions","organizations_url":"https://api.github.com/users/SukantGujar/orgs","repos_url":"https://api.github.com/users/SukantGujar/repos","events_url":"https://api.github.com/users/SukantGujar/events{/privacy}","received_events_url":"https://api.github.com/users/SukantGujar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-04-28T12:28:48Z","updated_at":"2016-04-30T08:52:38Z","closed_at":null,"body":"Hi,\r\n\r\nFrom the current documentation in the readme, and looking into the code, I think the privateDBs are not restricted to just the user_ids they are based on. E.g. If I am logged in as A so long as I know B's user_id (and private DB URL), I can read/write to it.\r\n\r\nConsidering the above assumption is right, how can I add a design doc with `validate_doc_update` function to disallow users whose id won't match with the DB name? If I can do that, then even if the userID is leaked, a different user won't be able to read/write into this user's DB even after guessing the DBURL. Although CouchDB is new to me, I don't think I can get DB Name within the `validate_doc_update` function. As an alternative, is there a way in which I can match the logged in user's ID with the DBUrl on the server (although I take it that once the client has the DB URL, all requests would directly hit the remote CouchDB, not go through the express app)?\r\n\r\nMy intention is to prevent any user other than the privateDB user from having any access to it.\r\n\r\nThanks in advance!"},"comment":{"url":"https://api.github.com/repos/colinskow/superlogin/issues/comments/215947531","html_url":"https://github.com/colinskow/superlogin/issues/62#issuecomment-215947531","issue_url":"https://api.github.com/repos/colinskow/superlogin/issues/62","id":215947531,"user":{"login":"colinskow","id":5303269,"avatar_url":"https://avatars.githubusercontent.com/u/5303269?v=3","gravatar_id":"","url":"https://api.github.com/users/colinskow","html_url":"https://github.com/colinskow","followers_url":"https://api.github.com/users/colinskow/followers","following_url":"https://api.github.com/users/colinskow/following{/other_user}","gists_url":"https://api.github.com/users/colinskow/gists{/gist_id}","starred_url":"https://api.github.com/users/colinskow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/colinskow/subscriptions","organizations_url":"https://api.github.com/users/colinskow/orgs","repos_url":"https://api.github.com/users/colinskow/repos","events_url":"https://api.github.com/users/colinskow/events{/privacy}","received_events_url":"https://api.github.com/users/colinskow/received_events","type":"User","site_admin":false},"created_at":"2016-04-30T08:52:38Z","updated_at":"2016-04-30T08:52:38Z","body":"I agree the README needs some clarity. I am going to leave this issue open to remind me."}}