Privilige elevation in a computed field

Help
,
2

There are no special Roles for computed fields, whatever privileges exist in the current context when reading the document will apply when executing the computed field.

call predicates for Functions have the same parameters as the Function itself, so you should be able to have elevated privileges assigned to the Function while being very specific about who can use the Function.

Does that help?

// FSL

@role(FormulaFnRole)
function formula1(doc) { /*...*/ }
@role(FormulaFnRole)
function formula2(doc) { /*...*/ }
// ...
@role(FormulaFnRole)
function formulaN(doc) { /*...*/ }

role FormulaFnRole {
  privileges CollectionA { /*...*/ }
  privileges CollectionB { /*...*/ }
  privileges CollectionC { /*...*/ }
  // ...
}

role UserLoggedIn {
  membership User

  privileges formula1 {
    call {
      predicate (doc => {
        let me = Query.identity()
        // Can  create logic that depends on the caller's identity and
        // the content of the doc passing into the function.
      })
    }
  }

  // add `call` privileges for other formulas
}