Only admin can read _changes on clustered _users

COUCHDB-2452 1/5
Export function for updating auth docs

The process of writing documents to the authentication DB varies
depending whether the authentication DB is on the admin or the
clustered interface. Authentication handlers should therefore
abstract the details away and provide a generic update_doc
function.

This commit adds an update_auth_doc function to the chttpd auth
cache which proxies to fabric:update_doc/3.

COUCHDB-2452 2/5
Strip non-public fields from _users all_docs on 5984

A _users DB on the admin interface will strip non-public fields
from documents in the _all_docs view when include_docs=true.

This commit creates the same behaviour when the _users DB is on
the clustered interface by using the appropriate callback in
couch_mrview_http.

COUCHDB-2452 3/5
Only admins access _users _all_docs on 5984

When couch_httpd_auth/users_db_public is set to false and the
_users DB is on the admin interface (5986) only admins can read
the _all_docs view.

This commit creates the same behaviour on the clustered interface
(5984) when chttpd_auth/users_db_public is set to false.

Note: This duplicates code in
couch_db:maybe_add_sys_db_callbacks/2 and couch_mrview_http:all_docs/3.

COUCHDB-2452 4/5
Only admins access _users design documents

The check for admin when opening a design document in the
authentication DB was previously being carried out in a callback
function called when the document was read from the shard. In
order to allow admins to access the design document via the
clustered interface it is necessary to either modify the
chttpd/fabric plumbing so that the user context can be passed
through for all design document calls, or alternatively move the
check to the http layer where we already have the user context.

Due to the number of places we would need to modify fabric to
allow the option to be passed through the latter approach is
taken.

This commit checks for admin in the http layer for requests
which access design documents in the authentication DB.

The couch internals part of that work can be found in related
commit:

    couchdb-couch/6266b95415f8c8d8cde49a8ce221e9d31ebf18b8

COUCHDB-2452 5/5