Authenticating Cloudant one db per user

I apologies in advance - for this question needs a bit of background, which is likely to be long winded:

I'm trying to build an app which works offline with PouchDb. PouchDb will sync with Cloudant.

Technologies used: Hapi, SQL, Vue, Cloudant, PouchDb

I have built a little hapi.js service to sign up / authenticate users. When an "account owner" signs up - they are added as a new user to a SQL database.

Using Cloudants API, I provision a new database (with a random name), and set security on the database so the new user has access.

I save the security (DB name, User name, and password) as metadata back to the user in the SQL database.

A very similar approach to here: https://www.bennadel.com/blog/3208-provisioning-cloudant-couchdb-databases-from-auth0-for-a-database-per-user-architecture-in-angular-2-4-1.htm (indeed, I based the above on this).

When the "account owner" logs in, the SQL DB is queried - the MetaData retrieved and sent down to the client side vue app. The PouchDB remote string is then populated with the Cloudant DB name, User name, and password.

eg:

const remoteDB = new PouchDB(`https://${name}:${pass}@0000-0000-bluemix.cloudant.com/${DBname}`);

This all works: PouchDB can talk to Cloudant - and data is going to and from without issue.

The "Account owner" is able to give read/write access to other people ("Staff") to their cloudantDB. When they add a new Staff Member, the Staff Member is added to the SQL DB. Using cloudants API, I create new security credentials for this user so that they can access the DB- (I do NOT create a new DB) and save them to the Staff Member in the SQL db as metadata...

The new staff member is sent an email - they set their username and password on the SQL db, and can log in. The Cloudant meta stuff is picked up... etc etc... PouchDB / Couchdb talks to each other - this also works.

Initially I was a bit concerned about sending this meta / credentials down to the client - I wanted to use a JWT or something... But then I saw this answer to another question:

https://stackoverflow.com/a/30417620/714950

So passing credentials down seems to be how its done in Pouch/Couch/Cloudant etc. I've got to be honest - I find the whole thing works like 'magic' - like its too good to be true, and that worries me a bit as I don't really understand it. I might be doing something terribly wrong.

Now for my question(s):

I'm passing these credentials down - is this safe? How would I reset / time out the username and password.

When they log out, I wipe the data from Pouch?

Can a user be 'logged in' and lose connection? Will pouch sync when they reconnect?

If pouch has NOT synced - and they log out (and I wipe Pouch) that would mean they would lose their data? so I guess I would need to persist the data in Pouch for when they log in again?

But what if they are using a shared computer? This data would be sat in Pouch DB waiting for someone to log in?

I'm also unsure how I validate the data... making sure that which gets saved to the DB is valid etc...

I suppose I'm just trying to get my head around this - I've been googling and reading everything I can, but it doesn't quite answer my questions.

Thanks

[** Just had a thought...

Thinking about it, I don't actually need to create the staff user within the SQL DB.

The Account Owner is set up - the DB is created in Cloudant, and credentials applied.

Not just had a thought: Theoretically, when a staff member is added - I only need to set them up inside Cloudant, and write their ID to the "Account Owner" as meta data so that they can be removed etc.

This way, a staff member could log in directly to the Cloudant DB.

However, I generate the security credentials using Cloudants API - so the staff member won't know what their username and password is. I don't want to send the username and password in an email.

Is there a way I can handle this? Am I able to specify a username and password when creating the security credentials? How do I handle things like password resets on cloudant?]

Thanks

Solution

I'm passing these credentials down - is this safe?

If your site is served out over HTTPS, then a bad actor would find it difficult to glean the Cloudant username & password in flight. Your client-side app needs to retain the credentials for your app to be "logged in" (for it to retain the right to sync with the server). I like to retain the data in a PouchDB document (e.g. _local/auth - local documents are not replicated so reside only on the device you create them on). You are right to be concerned, however, about having database credentials floating about on a client-side computer. Some folks decide that that is not acceptable and implement their own middle layer. If you don't need sync (that is data can be altered at both client and server side), you might use PouchDB as a buffer for unsynced data and push it to your own API when you're online. You can then control authentication, timeout and access to the database from your own server-side code.

How would I reset / time out the username and password.

You can "log out" by:

deleting your client-side state e.g. deleting the _local/auth document.
making the key/password have no permissions on the client side. Without _reader/_writer/_replicator rights, a Cloudant api key and password is useless

Alternatively you could transmit the username & password to the client which could use them against the Cloudant POST /_session endpoint which gives the web browser a time-limited cookie. Your app could then "forget" the credentials until it needs them again.

When they log out, I wipe the data from Pouch?

Yes.

Can a user be 'logged in' and lose connection? Will pouch sync when they reconnect?

If you write your client side app correctly, it could function perfectly well with its local PouchDB data, whether it has an internet connection or not. This is known as an Offline First approach. As long as your credentials are still valid, your app can sync when a connection is re-established.

If pouch has NOT synced - and they log out (and I wipe Pouch) that would mean they would lose their data?

Correct. If you have only one copy of some data and delete it, you lose data :)

But what if they are using a shared computer? This data would be sat in Pouch DB waiting for someone to log in?

Correct. On a shared computer, another user's data may be visible to the second user. Just as if I left my Facebook session logged in on a shared computer.