I’m putting together a small doc mgmt solution based on node.js and mongodb. MongoDB can store metadata and files pretty easily, although I’ll need to use GridFS to break up larger documents, but beyond that everything I need is there.
I need to control user access to documents (meaning what they can do on a document-by-document basis) via the equivalent to an ACL. The most stringent limit is where a document isn’t even visibile in query results. Next level up is visibility that it’s there, but no ability to read; then read; then update; then delete. I’m looking for ideas on how to accomplish this.
The challenge is how I can limit visibility of search results in the first place so that users that aren’t authorized to see that a document is even present. I can check a user’s rights for a single document without issue. The overhead is negligible for a single document. The problem comes in if I have millions of documents. I need to limit search results with something that can be combined in the search with minimal overhead.
Is there anything natively in MongoDB like this (which is something available in Oracle and SQL Server)? Is there some approach that may not be built-in, but is available as an add-on or custom?
The one thing I thought of was using a bit field (bits positions representing groups) of enough size to perform or operations against a user’s group memberships (generated when they logon) and doing an or operation of their memberships against it, with bits set to 1 (or 0) when that group bit is excluded from seeing the object in a query result. I’m afraid of the overhead of this though given this would not be indexable, but ensuring the other conditions of the search are applied first.