MarkLogic Server 11.0 Product Documentation

Node.js Application Developer's Guide — Chapter 1

Basic Security Requirements

The user you specify when creating a DatabaseClient object must have appropriate URI privileges for the content accessed by the operations performed, such as permission to read or update documents in the target database.

The Node.js Client uses the MarkLogic REST Client API to communicate with MarkLogic Server, so it uses the same security model. In addition to proper URI privileges, the user must have one of the pre-defined roles listed below, or the equivalent privileges. The capabilities of each role in the table is subsumed in the roles below it.

Some operations require additional privileges, such as using a database other than the default database associated with the REST instance and using eval or invoke methods of DatabaseClient. These requirements are detailed below.

Controlling Document Access

Documents you create using the Node.js Client API default roles have a read permission for the rest-reader role and an update permission for the rest-writer role. By default, users with the rest-reader role can read all documents created as rest-reader and users with the rest-writer role can write all documents created as rest-writer. You can override this behavior using document permissions and/or custom roles.

To restrict access to particular users, create custom roles rather than assigning users to the default rest-* roles. For example, you can use a custom role to restrict users in one group from seeing documents created by another.

For details, see Controlling Access to Documents and Other Artifacts in the REST Application Developer's Guide.

Evaluating Requests Against a Different Database

When you connect to a MarkLogic Server instance by creating a DatabaseClient, the REST instance you connect to has a default content database associated with it. You can specify an alternative database when you create the DatabaseClient, but to perform operations against an alternative database requires the http://marklogic.com/xdmp/privileges/xdmp-eval-in privilege or equivalent.

To enable your application to use a different database:

1. Create a role with the xdmp:eval-inexecution privilege, in addition to appropriate mix of rest-* roles. (You can also add the privileges to an existing role.)
2. Assign the role from Step 1 to a user.
3. Create a DatabaseClient with the user from Step 2.

One simple way to achieve this is to inherit from one of the predefined rest-* roles and then addin the eval-in privileges.

For details about roles and privileges, see the Security Guide. To learn more about managing REST API instances, see Administering REST API Instances.

Evaluating or Invoking Server-Side Code

You can use the DatabaseClient.eval and DatabaseClient.invoke operations to evaluate arbitrary code on MarkLogic Server. These operations require special privileges instead of (or in addition to) the normal REST API roles like rest-reader and rest-writer.

For details, see Required Privileges.

MarkLogic Namespace

The Node.js Client API library exports a namespace that provides a database client factory method and access to builders such as queryBuilder (search), valuesBuilder (values queries), and patchBuilder (partial document updates).

To include the MarkLogic module in your code, use require() and bind the result to a variable. For example, you can include it by the name marklogic if you have installed in the module under your own Node.js project:

const ml = require('marklogic');

You can use any variable name, but the examples in this guide assume ml.

Parameter Passing Conventions

Node.js Client API functions that require many input parameter values accept these values as named properties of a call object. For example, you can specify a hostname, port, database name, and several other connection properties when calling the createDatabaseClient() method. Do so by encapsulating these values in a single object, such as the following:

ml.createDatabaseClient({host: 'some-host', port: 8003, ...});

Where a parameter value can have one or more values, the value of the property can be either a single value or an array of values. Some functions support either an array or a list. For example:

db.documents.write(docDescriptor)
db.documents.write([docDescriptor1, docDescriptor2, ...])
db.documents.write(docDescriptor1, docDescriptor2, ...)

Where a function has a parameter that is frequently used without other parameters, you can pass the parameter directly as a convenient alternative to encapsulating it in a call object. For example, DatabaseClient.documents.remove accepts either a call object that can have several properties, or a single URI string:

db.documents.remove('/my/doc.json')
db.documents.remove({uri: '/my/doc.json', txid: ...})

For details on a particular operation, see the Node.js API Reference.

Document Descriptor

A document descriptor is an object that encapsulates document content and metadata as named JavaScript object properties. Node.js Client API document operations such as DatabaseClient.documents.read and DatabaseClient.documents.write accept and return document descriptors.

A document descriptor usually includes at least the database URI and properties representing document content, document metadata, or both. For example, the following is a document descriptor for a document with URI /doc/example.json. Since the document is a JSON document, its contents can be expressed as a JavaScript object.

{ uri : 'example.json', content : {some : 'data'} }

Not all properties are always present. For example if you read just the contents of a document, there will be no metadata-related properties in the resulting document descriptor. Similarly, if you insert just content and the collections metadata property, the input descriptor will not include permissions or quality properties.

{ uri : 'example.json', 
  content : {some : 'data'}, 
  collections : ['my-collection']
}

The content property can be an object, string, Buffer, or ReadableStream.

See DocumentDescriptor in the Node.js API Reference for a complete list of property names.

Supported Result Handling Techniques

Most functions in the Node.js Client API support the following ways of processing results returned by MarkLogic Server:

• Callback: Call the result function, passing in a success and/or error callback function. Use this pattern when you don't need to synchronize results. For example:

  db.documents.read(...).result(function(response) {...})

• Promise: Call the result function and process the results through a Promise. Use Promises to chain interactions together, such as writing documents to the database, followed by a search. Your success callback is not invoked until all the requested data has been returned by MarkLogic Server. For example:

  db.documents.read(...).result().then(function(response) {...})...

  For details, see Promise Result Handling Pattern.

• Object Mode Streaming: Call the stream function and process the results through a Readable stream. Your code gets control each time a document or other discrete part is received in full. If you're reading a JSON document, it is converted to a JavaScript object before invoking your callback. For example:

  db.documents.read(...).stream().pipe(...)

  For details, see Stream Result Handling Pattern.

• Chunked Mode Streaming: Call the stream function with a 'chunked' argument and process the results through a Readable stream. Your code gets control each time a sufficient number of bytes are accumulated, and the input to your callback is a byte stream.

  db.documents.read(...).stream('chunked').pipe(...)

  For details, see Stream Result Handling Pattern.

When you use the classic callback or promise pattern, your code does not get control until all results are returned by MarkLogic. This is suitable for operations that do not return a large amount of data, such as a read operation that returns a small number of documents or a write. Streaming is better suited to handling large files or a large number documents because it allows you to process results incrementally.

Errors in the user code of a success callback are handled in the next error callback. Therefore, you should include a catch clause to handle such errors. For details, see Error Handling.

Promise Result Handling Pattern

Node.js Client API functions return an object with a result() method that returns a Promise object. A Promise is a JavaScript interface for interacting with the outcome of an asynchronous event. A Promise has then, catch, and finally methods. For details, see http://promisesaplus.com/. Promises can be chained together to synchronize multiple operations.

The success callback you pass to the Promise then method is not invoked until your interaction with MarkLogic completes and all results are received. The Promise pattern is well suited to synchronizing operations.

For example, you can use a sequence such as the following to insert documents into the database, query them after the insertion completes, and then work with the query results.

db.documents.write(...).result().then( 
  function(response) {
    // search the documents after insertion
    return db.documents.query(...).result();
  }).then( function(documents) {
    // work with the documents matched by the query
  });

For a more complete example, see Example: Using Promises With a Multi-Statement Transaction.

You should include a catch clause in your promise chain to handle errors raised in user code in your success callbacks. For details, see Error Handling.

The Node.js Client API also supports a stream pattern for processing results. A stream is better suited to handling very large amounts of data than a Promise. For details, see Stream Result Handling Pattern.

Stream Result Handling Pattern

Node.js Client API functions return an object with a stream method that returns a Readable stream on the results from MarkLogic. Streams enable you to process results incrementally. Consider using streaming if you're reading a large number of documents or if your documents are large.

Streams can provide better throughput at lower memory overhead than the Promises when you're working with large amounts of data because result data can be processed as it is received from MarkLogic Server.

Two stream modes are supported:

• Object Mode: Your code gets control each time a complete document or other discrete part is received. A Document Descriptor is the unit of interaction. For a JSON document, the content in the descriptor is converted into JavaScript object for ease of use. Object mode is the default streaming mode.
• Chunked mode: Your code gets control each time a certain number of bytes is received. An opaque byte stream is the unit of interaction. Enable chunked mode by passing the value 'chunked' to the stream method.

Object mode is best when you need to handle each portion of the result as a document or object. For example, if you persist a collection of domain objects in the database as JSON documents and then want to restore them as JavaScript objects in your application. Chunked mode is best for handling large amounts of data opaquely, such as reading a large binary file from the database and saving it out to file.

The following code snippet uses a stream in object mode to process multiple documents as they are fetched from the database. Each time a complete document is received, the stream on('data') callback is invoked with a document descriptor. When all documents are received, the on('end') callback is called.

db.documents.read(uri1, uri2, uriN).stream()
  .on('data', function(document) {
    // process one document
  }).on('end', function() {
    //wrap it up
  }).on('error', function(error) {
    // handle errors
  });

The following code snippet uses a stream in chunked mode to stream a large binary file from the database into a file using pipe.

const fs = require('fs');
const ostrm = fs.createWriteStream(outFilePath);

db.document.read(largeFileUri).stream('chunked').pipe(ostrm);

The Promise pattern is usually more convenient if you are not processing a large amount of data. For details, see Promise Result Handling Pattern.

Streaming Into the Database

Most Node.js methods that deal with potentially large input datasets support using a ReadableStream to pass in the data. For example , the content property of a document descriptor passed to DatabaseClient.documents.write can be an object, a string, a Buffer, or a Readable stream. If you're simply streaming data from a source such as a file, this interface is all you need.

For example, the following call uses a Readable stream to stream an image from a file into the database:

db.documents.write({
  uri: '/my/image.png',
  contentType: 'image/png',
  content: fs.createReadStream(pathToImage)
})

If you are assembling the stream on the fly, or otherwise need to have fine grained control, you can use the createWriteStream method of the documents and graphs interfaces. For example, if you use DatabaseClient.documents.createWriteStream instead of DatabaseClient.documents.write, you can control the calls to write so you can assemble the documents yourself, as shown below:

const ws = db.documents.createWriteStream({
  uri: '/my/data.json',
  contentType: 'application/json',
});
// Resulting doc contains {"key":"value"}
ws.write('"{key"', 'utf8');
ws.write(': "value"}', 'utf8');
ws.end();

You can use the writeable stream interface to load documents and semantic graphs. For details, see documents.createWriteStream and graphs.createWriteStream in the Node.js API Reference.

Performing Point-in-Time Operations

If you need to perform read-only operations spanning multiple requests that must all return results based on a consistent snapshot of the database, you can use the point-in-time query feature of the Node.js Client API. In this context, query means a read-only operation, such as a search or document read.

Most read-only operations accept an optional Timestamp object, created by calling DatabaseClient.createTimestamp. If no explicit timestamp value is set on the object, then the timestamp is set during execution of the read-only operation.

Alternatively, you can supply an explicit timestamp when creating a timestamp. This must be a timestamp generated by MarkLogic, not an arbitrary value you create. To learn more about point-in-time queries (reads) and timestamps, see Point-In-Time Queries in the Application Developer's Guide.

When you pass a Timestamp object whose timestamp is set to subsequent supporting operations, these operations see the same snapshot of the database.

For example, suppose you are incrementally fetching search results in a context in which the database is changing and consistency of results is important. If you pass a Timestamp object on the search, then the effective query timestamp is captured in the Timestamp object and you can pass the object in to subsequent searches.

const marklogic = require('marklogic');
const my = require('./my-connection.js');

const db = marklogic.createDatabaseClient(my.connInfo);
const qb = marklogic.queryBuilder;
let timestamp = db.createTimestamp();
// First search sets the timestamp value
db.documents.query(
  qb.where(qb.parsedFrom('cat AND dog')).slice(0,5),
  timestamp
).result().then( function(results) {
  console.log(JSON.stringify(results, null, 2));
});

// ...perform subsequent searches, re-using the same timestamp object

Another example use case is reading a large number of documents from the database by URI (or search query) in batches. If you need a consistent snapshot of the documents, use the point-in-time feature.

You can use this feature across different kinds of operations. For example you might get the initial timestamp from a search, and then use it to perform a SPARQL query at the same point-in-time.

This capability is supported on any operation that accepts a timestamp parameter, including the following:

• Document read: DatabaseClient.documents.read
• Document search: DatabaseClient.documents.query
• Values Query: DatabaseClient.values.read
• Semantic Search: DatabaseClient.graphs.sparql
• Semantic Update: DatabaseClient.graphs.sparqlUpdate
• Semantic Graph Access: DatabaseClient.graphs.read and DatabaseClient.graphs.list
• Rows Query: DatabaseClient.rows.query

For more details, see the Node.js Client API Reference.

Error Handling

When using the callback or promise pattern, errors in your success callback are handled in the next error callback. If you want to trap such errors, you should include a catch clause at the end of your promise chain (or after your result handler, in the case of the callback pattern). Simply wrapping a try-catch block around your call(s) will not trap such errors.

For example, in the case of the classic callback pattern, if you made a call to DatabaseClient.documents.write, you should end with a catch similar to the following. The onError function executes if the onSuccess callback throws an exception.

db.documents.write(...)
  .result(function onSuccess(response) {...})
  .catch(function onError(err) {...});

Similarly if you're chaining requests together using thePromise pattern, then you should terminate the chain with a similar handler:

db.documents.write(...).result()
  .then(function onSuccess1(response) {...})
  .then(function onSuccess2(response) {...})
  .catch(function onError(err) {...});

Connecting to MarkLogic with SSL

You can combine an ssl property with any of the authentication methods so that your database client object uses a secure connection to MarkLogic. For example:

ml.createDatabaseClient({
  user: 'me',
  password: 'mypassword',
  authType: 'digest',
  ssl: true})

Your App Server must be SSL-enabled. For details, see Configuring SSL on App Servers in the Security Guide.

The Node.js Client API must be able to verify that MarkLogic is sending a legitimate certificate when first establishing the connection. If the certificate is signed by an authority other than one of the established authorities like VeriSign, then you must include a certificate from the certification authority in your database client configuration. Use the ca property to specify a certificate authority. For example:

ml.createDatabaseClient({
  authType: 'certificate',
  ssl: true 
  ca: fs.readFileSync('ca.crt')
})

For more details, see Procedures for Obtaining a Signed Certificate in the Security Guide.

Using SAML Authentication

Your client application is responsible for acquiring a SAML assertions token from the SAML Identity Provider (IDP). You can then use the SAML assertions received from a SAML IDP as well as HTTP access to a MarkLogic cluster configured to verify SAML assertions from the IDP.

Your client application sends the SAML assertions to the MarkLogic enode to invoke MarkLogic operations that are authorized for the user until the SAML assertions expire.

The MarkLogic.createDatabaseClient function uses the property values shown in the table below to authenticate using SAML.

For example, after obtaining an authorization token (base64 encoded) from an IDP, the MarkLogic.createDatabaseClient function to create a client might look like the following.

const db = marklogic.createDatabaseClient({
            host: appserverHost,
            port: appserverPort,
            authType: 'SAML',
            token: authorizationToken,
        ... other configuration such as SSL ...
});

In addition, the database client object uses the setAuthToken function that takes a SAML assertions token. Requests made after the token is set use the new SAML assertions token.

Unlike the Java API, the Node.js API doesn't support a reauthorizer or renewer callback. In Node.js, calls run to completion instead of blocking. Consequently, your client application can change the SAML assertions token without affecting requests that are about to be sent to the server.

Using Certificate-Based Authentication

When using certificate-based authentication, your client application obtains a certificate signed by a certificate authority, along with the certificate's private key. The certificate contains a public key and other information required to establish a connection.

See the following topics for details:

• Obtaining a Client Certificate
• Configuring Your App Server
• Examples: Database Client Configuration

  You can only use certificate-based authentication with the Node.js Client API when you connect to MarkLogic using SSL. For details, see Connecting to MarkLogic with SSL.

const x509Config = ...; 
const cert = xdmp.x509CertificateGenerate(
    x509Config, null, {credentialId: xdmp.credentialId('ca-cred')});

ml.createDatabaseClient({
  authType: 'certificate',
  cert: fs.readFileSync('client.crt'),
  key: fs.readFileSync('clientpriv.pem'),
  ssl: true
})

ml.createDatabaseClient({
  authType: 'certificate',
  pfx: fs.readFileSync('credentials.pfx'),
  key: 'yourPassphrase',
  ssl: true
})

ml.createDatabaseClient({
  user: 'me',
  password: 'mypassword',
  authType: 'digest',
  cert: fs.readFileSync('client.crt'),
  key: fs.readFileSync('clientpriv.pem'),
  ssl: true
})

Using Kerberos Authentication

Use the following steps to configure your MarkLogic installation and client application environment for Kerberos authentication:

• Configuring MarkLogic to Use Kerberos
• Configuring Your Client Host for Kerberos
• Creating a Database Client That Uses Kerberos

ml.createDatabaseClient({authType: 'kerberos'});