Search code examples
mongodbfirebaseangular-fullstackyo

Editing the user document in mongodb


Is is bad practice to allow editing of the user document beyond changing the password. I noticed that on yo's angular-fullstack there is no function to update a user. Also on firebase the user is registered with the authentication stuff but user info (name, telephone, address...) needs to be stored elsewhere.

In other words, is there a reason to have the users document only responsible for authentication and then to have another document for non-authenticating fields?

I am not asking for opinions please. Only factual issues with storing authenticating fields and non-authenticating fields in the same document.


Solution

  • When prototyping an application, I wouldn't say you are gonna find any benefits in separating this data in the beginning. However, as an application grows, there could be a few reasons to separate out identity information.

    Separation of concern

    Authentication is a specific use case, it could make sense to store it separately, this could facilitate changes to the authentication mechanism in case the authentication logic needs to be delegated to an external identity provider.

    This is true for any domain tough, different services might be handling different user related information. Those services can/may want to be responsible for storing and authoring that data. Not all the services need to know all properties of the user, hence each service stores the data it's responsible for.

    Security & Policy

    Putting sensitive user information into a separate collection will give the database administrator more fine grained control as to who can access that specific collection. Or it could be used as the ground work to move the authentication to a separate server all together if security polices would require it.

    You asked for a non-opinionated answer, however the topic you are alluding to relates to separation of concern and micro services architecture. These domains can be very opinionated so by all means don't consider my answer as a complete one.

    Read up on micro services architecture here:
    http://martinfowler.com/articles/microservices.html