templates/sync-function/authorization-module.js
function authorize(doc, oldDoc, docDefinition) {
    var authorizedChannels = getRequiredAuthorizations(doc, oldDoc, docDefinition.channels);
    var authorizedRoles = getRequiredAuthorizations(doc, oldDoc, docDefinition.authorizedRoles);
    var authorizedUsers = getRequiredAuthorizations(doc, oldDoc, docDefinition.authorizedUsers);

    var channelMatch = false;
    if (authorizedChannels) {
      try {
        requireAccess(authorizedChannels);
        channelMatch = true;
      } catch (ex) {
        // The user has none of the authorized channels
        if (!authorizedRoles && !authorizedUsers) {
          // ... and the document definition does not specify any authorized roles or users
          throw ex;
        }
      }
    }

    var roleMatch = false;
    if (authorizedRoles) {
      try {
        requireRole(authorizedRoles);
        roleMatch = true;
      } catch (ex) {
        // The user belongs to none of the authorized roles
        if (!authorizedChannels && !authorizedUsers) {
          // ... and the document definition does not specify any authorized channels or users
          throw ex;
        }
      }
    }

    var userMatch = false;
    if (authorizedUsers) {
      try {
        requireUser(authorizedUsers);
        userMatch = true;
      } catch (ex) {
        // The user does not match any of the authorized usernames
        if (!authorizedChannels && !authorizedRoles) {
          // ... and the document definition does not specify any authorized channels or roles
          throw ex;
        }
      }
    }

    if (!authorizedChannels && !authorizedRoles && !authorizedUsers) {
      // The document type does not define any channels, roles or users that apply to this particular write operation type, so fall back to
      // Sync Gateway's default behaviour for an empty channel list: 403 Forbidden for requests via the public API and either 200 OK or 201
      // Created for requests via the admin API. That way, the admin API will always be able to create, replace or remove documents,
      // regardless of their authorized channels, roles or users, as intended.
      requireAccess([ ]);
    } else if (!channelMatch && !roleMatch && !userMatch) {
      // None of the authorization methods (e.g. channels, roles, users) succeeded
      var errorMessage = 'missing channel access';
      var error = new Error(errorMessage);
      error.forbidden = errorMessage;

      throw error;
    }

    return {
      channels: authorizedChannels,
      roles: authorizedRoles,
      users: authorizedUsers
    };
  }
function authorize(doc, oldDoc, docDefinition) {
    var authorizedChannels = getRequiredAuthorizations(doc, oldDoc, docDefinition.channels);
    var authorizedRoles = getRequiredAuthorizations(doc, oldDoc, docDefinition.authorizedRoles);
    var authorizedUsers = getRequiredAuthorizations(doc, oldDoc, docDefinition.authorizedUsers);

    var channelMatch = false;
    if (authorizedChannels) {
      try {
        requireAccess(authorizedChannels);
        channelMatch = true;
      } catch (ex) {
        // The user has none of the authorized channels
        if (!authorizedRoles && !authorizedUsers) {
          // ... and the document definition does not specify any authorized roles or users
          throw ex;
        }
      }
    }

    var roleMatch = false;
    if (authorizedRoles) {
      try {
        requireRole(authorizedRoles);
        roleMatch = true;
      } catch (ex) {
        // The user belongs to none of the authorized roles
        if (!authorizedChannels && !authorizedUsers) {
          // ... and the document definition does not specify any authorized channels or users
          throw ex;
        }
      }
    }

    var userMatch = false;
    if (authorizedUsers) {
      try {
        requireUser(authorizedUsers);
        userMatch = true;
      } catch (ex) {
        // The user does not match any of the authorized usernames
        if (!authorizedChannels && !authorizedRoles) {
          // ... and the document definition does not specify any authorized channels or roles
          throw ex;
        }
      }
    }

    if (!authorizedChannels && !authorizedRoles && !authorizedUsers) {
      // The document type does not define any channels, roles or users that apply to this particular write operation type, so fall back to
      // Sync Gateway's default behaviour for an empty channel list: 403 Forbidden for requests via the public API and either 200 OK or 201
      // Created for requests via the admin API. That way, the admin API will always be able to create, replace or remove documents,
      // regardless of their authorized channels, roles or users, as intended.
      requireAccess([ ]);
    } else if (!channelMatch && !roleMatch && !userMatch) {
      // None of the authorization methods (e.g. channels, roles, users) succeeded
      var errorMessage = 'missing channel access';
      var error = new Error(errorMessage);
      error.forbidden = errorMessage;

      throw error;
    }

    return {
      channels: authorizedChannels,
      roles: authorizedRoles,
      users: authorizedUsers
    };
  }
Ensures the user is authorized to create/replace/delete this document