Adding Security

{
  "log": ["HTTP", "Auth"],
  "databases": {
    "todo": {
      "server": "walrus:",
      "users": {
        "user1": {"password": "pass", "admin_channels": ["user1"]},
        "user2": {"password": "pass", "admin_channels": ["user2"]},
        "mod": {"password": "pass", "admin_roles": ["moderator"]},
        "admin": {"password": "pass", "admin_roles": ["admin"]}
      },
      "roles": {
        "moderator": {},
        "admin": {}
      }
    }
  }
}

// This code can be found in AppDelegate.swift
// in the startReplication(withUsername:andPassword:) method
pusher = database.createPushReplication(kSyncGatewayUrl)
pusher.continuous = true
NotificationCenter.default.addObserver(self, selector: #selector(replicationProgress(notification:)),
    name: NSNotification.Name.cblReplicationChange, object: pusher)

puller = database.createPullReplication(kSyncGatewayUrl)
puller.continuous = true
NotificationCenter.default.addObserver(self, selector: #selector(replicationProgress(notification:)),
                                        name: NSNotification.Name.cblReplicationChange, object: puller)

if kLoginFlowEnabled {
    let authenticator = CBLAuthenticator.basicAuthenticator(withName: username, password: password!)
    pusher.authenticator = authenticator
    puller.authenticator = authenticator
}

pusher.start()
puller.start()

// This code can be found in CoreApp.cs
// in the StartReplication(string, string) method
var authenticator = default(IAuthenticator);
if(username != null  password != null) {
    authenticator = AuthenticatorFactory.CreateBasicAuthenticator(username, password);
}

var db = AppWideManager.GetDatabase(username);
var pusher = db.CreatePushReplication(SyncGatewayUrl);
pusher.Continuous = true;
pusher.Authenticator = authenticator;


var puller = db.CreatePullReplication(SyncGatewayUrl);
puller.Continuous = true;
puller.Authenticator = authenticator;

pusher.Start();
puller.Start();

_pusher = pusher;
_puller = puller;

URL url = null;
try {
    url = new URL(mSyncGatewayUrl);
} catch (MalformedURLException e) {
    e.printStackTrace();
}

pusher = database.createPushReplication(url);
pusher.setContinuous(true);

puller = database.createPullReplication(url);
puller.setContinuous(true);

if (mLoginFlowEnabled) {
    Authenticator authenticator = AuthenticatorFactory.createBasicAuthenticator(username, password);
    pusher.setAuthenticator(authenticator);
    puller.setAuthenticator(authenticator);
}

pusher.start();
puller.start();

function(doc, oldDoc){
  /* Type validation */
  if (isCreate()) {
    // Don't allow creating a document without a type.
    validateNotEmpty(type, doc.type);
  } else if (isUpdate()) {
    // Don't allow changing the type of any document.
    validateReadOnly(type, doc.type, oldDoc.type);
  }

  if (getType() == "task-list") {
    /* Write access */
    /* Validation */
    /* Routing */
    /* Read Access */
  }

  function getType() {
    return (isDelete() ? oldDoc.type : doc.type);
  }

  function isCreate() {
    // Checking false for the Admin UI to work
    return ((oldDoc == false) || (oldDoc == null || oldDoc._deleted)  !isDelete());
  }

  function isUpdate() {
    return (!isCreate()  !isDelete());
  }

  function isDelete() {
    return (doc._deleted == true);
  }

  function validateNotEmpty(key, value) {
    if (!value) {
      throw({forbidden: key +  is not provided.});
    }
  }

  function validateReadOnly(name, value, oldValue) {
    if (value != oldValue) {
      throw({forbidden: name +  "is read-only."});
    }
  }

  // Checks whether the provided value starts with the specified prefix
  function hasPrefix(value, prefix) {
    if (value  prefix) {
      return value.substring(0, prefix.length) == prefix
    } else {
      return false
    }
  }
}

/* Write Access */
var owner = doc._deleted ? oldDoc.owner : doc.owner;
try {
  // Moderators can create/update lists for other users.
  requireRole(moderator);
} catch (e) {
  // Users can create/update lists for themselves.
  requireUser(owner);
}

/* Validation */
if (!isDelete()) {
  // Validate required fields.
  validateNotEmpty(name, doc.name);
  validateNotEmpty(owner, doc.owner);

  if (isCreate()) {
    // Validate that the _id is prefixed by owner.
    if (!hasPrefix(doc._id, doc.owner + .)) {
        throw({forbidden: task-list id must be prefixed by list owner});
    }
  } else {
    // Don’t allow task-list ownership to be changed.
    validateReadOnly(owner, doc.owner, oldDoc.owner);
  }
}

/* Routing */
// Add doc to task-list's channel.
channel(task-list. + doc._id);
channel(moderators);

/* Read Access */
// Grant task-list owner access to the task-list, its tasks, and its users.
access(owner, task-list. + doc._id);
access(owner, task-list. + doc._id + .users);
access(role:moderator, task-list. + doc._id);