Skip to content

updated to add access function role #909

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: release/3.3
Choose a base branch
from
Open

updated to add access function role #909

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5c48799
updated to add access function role
iamfortune Aug 12, 2025
984298f
remove automatically
iamfortune Aug 12, 2025
a83218e
updated to comply with style guide
iamfortune Aug 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion modules/ROOT/pages/_partials/sync-api/sync-function-api-access.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,10 @@ You can invoke this function multiple times from within your Sync Function.
TIP: Prefix the `username` argument value with `role:` to apply this function to a role rather than a user.
This grants access to the specified channel(s) for all users assigned that role.

The effects of all access calls by all active documents are effectively combined in a union, so if _any_ document grants a user access to a channel, that user has access to the channel.
The effects of all access calls by all active documents are effectively combined in a union, so if any document grants a user access to a channel, that user has access to the channel.

The `access()` function grants access to users or roles that do not yet exist.
When you create new users or define roles later, the previous granted access permissions apply to them.

NOTE: The sync function `access()` call does not support the wildcard ('***') for granting access to all channels.
To grant a user access to all channels, use the REST API channel grant endpoint.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you have a link to documentation about this endpoint?

Copy link
Contributor Author

@iamfortune iamfortune Aug 12, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, I didn't find one, spoke to a SGW eng (Tor), he's not sure of the links too, i found this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, not sure if that's quite right. Are we sure that an endpoint with that functionality exists? That there is a way to grant a user access to all channels in one go?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a slight semantic distinction, this isn't an endpoint so we don't have an API reference for this. This is part of a set of javascript call that Sync Gateway provides. We don't have better documentation for this function, it probably never existed, but this is an attempt to clarify the behavior for users.

The statement as written is correct.

As far as the general concepts. Channel grants via a sync function are referred to as dynamic channel grants. They do not support granting access to all channels, however the following line refers to granting all channels:

NOTE: The sync function access() call does not support the wildcard ('***') for granting access to all channels.
To grant a user access to all channels, use the REST API channel grant endpoint.

That endpoint is https://docs.couchbase.com/sync-gateway/current/rest-api/rest_api_admin.html#tag/Database-Security/operation/put_db-_user-name

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@torcolvin , to clarify, then, is it incorrect to say that a user could "grant a user access to all channels"? Do we need to word this better?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This statement is correct to grant a user access to all channels as part of the REST API channel grant endpoint. The page that this PR is addressing is not talking about that endpoint in general, but the behavior of the functions available in the sync function.

I do feel that perhaps I am not understanding the question.

Expand Down