hyper63 / hyper63/hyper-adapter-couchdb
Don't allow listing indexes via the `retrieveDocument` API
- Dominant language
- JavaScript
- Stars
- 3
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
We would need to:
- [ ] Prevent new documents from having the `_id` `_index`, either by rejecting those documents, or mapping the string `_index` to another internally managed string. Affected apis: `createDocument` `bulkDocuments`
- [ ] when a `retrieveDocument` request arrives, either reject the lookup for `_index` or map the string similar to aforementioned mapping
- [ ] **IF** the mapping approach is taken, the document's `_id` would need to be reverse mapped back to the string `_index` on any retrievals. Affected apis: `retrieveDocument`, `listDocuments`, `queryDocuments`
- [ ] add a test case for each
The easier of the two is just to reject any documents with an `_id` set to `_index`, but is arguably leaking impl details to the consumer.
## Background
Related Issue: https://github.com/hyper63/hyper/issues/486
So something I discovered today that probably should not be allowed?
If I have a hyper data service, I can retrieve all of the indexes that exist on the database by calling `GET /data/default/_index`. This gets handled by the "get document by id" route, which calls `retrieveDocument` on the adapter.
Ultimately the CouchDB adapter does:
```js
asyncFetch(`${config.origin}/${db}/${id}`,...)
```
with `_index`as the id.
Of course, there isn't a document with _id _index, BUT that does map to the route on the CouchDB API that lists all of the indexes for the DB: https://docs.couchdb.org/en/stable/api/database/find.html#get--db-_index. And since the data port says anything can be returned from the `retrieveDocument` API, hyper simply returns that response and you get something like:
```json
{
"total_rows": 1,
"indexes": [
{
"ddoc": null,
"name": "_all_docs",
"type": "special",
"def": {
"fields": [
{
"_id": "asc"
}
]
}
}
]
}
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.