We’re pleased to announce the release of Couchbase Mobile 3, which includes many enhancements to the Couchbase Lite and Sync Gateway products for mobile and edge computing solutions. In this major release, we continue to make great strides in the area of edge computing by expanding our edge device platform support with the introduction of the C API for Couchbase Lite. The new C API will facilitate the use of Couchbase Lite on a broad range of embedded platforms.

In addition, we are introducing significant architectural enhancements that will make it simpler to configure and administer the platform. We’ve modularized the Sync Gateway configuration, made it “cluster-aware” and now provide a secure RESTful API endpoint to simplify runtime administration. This is in addition to a number of security-related updates. That’s just the tip of the iceberg!

We’ve introduced a ton of significant features that are discussed in this post. To learn about the bug fixes and minor enhancements, check out our Sync Gateway and Couchbase Lite platform-specific release notes.

Get Started!

Here’s how you can start evaluating the new features in Couchbase Lite and Sync Gateway 3.0:

Couchbase Lite

C API Platform Support

A few years ago, we released a C API for Couchbase Lite as an engineering labs project. We were overwhelmed by the level of interest and impressed by the range of use cases. We are happy to announce that we will now be officially supporting the C API for Couchbase Lite. In the process of productizing the C API, we added support for Enterprise-grade features like database encryption, ensured feature parity with other Couchbase Lite platforms, cleaned up the API, optimized the underlying implementation and much more.

Developers benefit in several ways:

  • Developers can build IoT apps in C that can run on embedded platforms with a relatively small memory and compute resource footprint compared to a standard desktop or smart mobile device.
  • C is a lingua franca of programming languages. So it is easy to build language bindings on top of C API using Foreign Function Interface (FFI), which means that developers can now build embedded applications using Couchbase Lite using a broad range of programming languages such Dart, Python, JS, Rust, Go etc.
  • The C API is truly cross-platform, supporting a broad range of operating systems for mobile, desktop and custom embedded hardware. You can now build cross-platform applications that run on a variety of hardware.

Learn more in the Couchbase Lite C API documentation.

Client-side Field Level Encryption

The new C API also supports client side field level encryption. Using the new client-side encryption capability, Couchbase Lite C clients can encrypt fields in documents prior to replicating data over the wire to Couchbase Server. Only clients with access to the correct encryption keys can decrypt and read the protected data. The client-side encryption is compatible with the Couchbase server SDK field-level encryption format.

These new encryption benefits include:

  • True end-to-end encryption support guarantees that sensitive data is never leaked to actors that do not have credentials or privileges to access the data  
  • Applications can encrypt/decrypt sensitive fields in documents using any encryption framework

Learn more in the Couchbase Lite Field Encryption documentation.

SQL++/ N1QL Query Language for Mobile

Couchbase Lite supports a QueryBuilder interface that allows apps to query the Couchbase Lite database using a fluent API with SQL semantics. In 3.0, we are expanding the Query API to support N1QL formatted query strings, particularly for C API use. N1QL for Mobile is a Couchbase implementation of an emerging SQL-for-JSON query language specification called SQL++. Developers can now submit string-based queries in a familiar, SQL syntax format. This is in addition to the QueryBuilder API that continues to be supported.

Value Proposition:

  • App developers can reuse the same SQL++/N1QL queries across Couchbase Server and Couchbase Lite, thereby reducing the effort required to develop, test and optimize the queries. Read about some of the Couchbase Lite and Server N1QL differences.
  • This single string-based API vastly simplifies the development of bridging plugins via the QueryBuilder API for cross-platform or hybrid technologies such as Ionic and React Native.

Read more about the Couchbase Lite query string implementation in the documentation.

Kotlin Support in Android

We recognize that Kotlin is growing in popularity as the preferred language of choice for developing Android apps. Prior to 3.0, Android app developers took advantage of the fact that Kotlin is fully interoperable with Java and could hence use the Android Java SDK for Couchbase Lite within Kotlin apps. The new release of Couchbase Lite for Android offers a fully-supported, out-of-the-box idiomatic API for Kotlin that will enable seamless integration with Android apps developed in Kotlin without the need for custom extensions.

Value Proposition:

  • Developers have been asking for it and we listened! Kotlin developers can now adopt common Kotlin patterns within their Android mobile app.

Read more in the Couchbase Mobile Kotlin documentation.

Auto-Purge Device Data on Channel Access Revocation

Channels are the fundamental mechanism for enforcement of access control using Sync Gateway. They guarantee that only users with access to a specific channel can access documents in that channel. With the new channel access revocation feature in 3.0, when a user loses access to a channel and consequently loses access to documents in the channel, Couchbase Lite clients will automatically purge all local documents on the device that belong to the revoked channel. This would be the case as long as the user does not have access to the document via some other channel. This is important for enforcement of data governance and data retention policies.

Auto-purging makes policy management easier:

  • The sync technology enhancements simplifies the implementation of complex workflows related to the enforcement of data governance and data retention policies.
  • For example, here is an example of such a workflow:
    •  A sales associate, “Bob”, in charge of “Region_East” is temporarily granted access to a “Region_West” channel. Channels include region-specific lead documents.
    •  When a new associate is hired for the west region, Bob is revoked access to the “region_west” channel. 
    • All previously synced documents must be removed from Bob’s device.

Read more about auto-purging in the Couchbase Lite replication documentation.

Sync Gateway

Centralized Persistent Modular Configuration

In this release, we are introducing core architectural enhancements that will make simple for administrators to configure and manage a Sync Gateway. We are moving away from the monolithic JSON configuration file to a more modular, cluster-aware approach to configuring Sync Gateway nodes in a cluster. Users will now only have to specify basic startup configuration that will bootstrap a Sync Gateway node and connect it to a Couchbase Server cluster.

Subsequently, users can configure cluster-wide Sync Gateway databases, access control policies, inter-Sync Gateway replications etc., via the admin REST endpoint. Configuration updates can be made in a modular fashion through the same REST endpoint. The cluster-aware nature of the configuration implies that changes made against one Sync Gateway node are automatically propagated to all or a user-defined subset of Sync Gateway nodes in the cluster. 

Value Proposition:

  • Ad Hoc database config changes made via REST API are persisted in corresponding server buckets and are not lost during sync gateway restarts – from either crashes or deliberate restarts.
  • Centralized database config updates for large clusters simplifies manageability and administration. Database changes made to a node are automatically applied to all nodes in a cluster or  can be scoped to a subset of nodes. 
  • The ability to securely administer the Sync Gateway cluster using the admin REST endpoint enables programmatic control and simplifies remote administration in cloud deployments without relying on options like SSH-tunneling.
  • Maintaining a monolithic file is difficult especially if the configuration is complex. Multiple sync gateway databases may be defined in a single config file. This has potentially undesirable consequences in multi-tenant applications where database changes made for one tenant would require a restart of the node impacting all tenants. 

To simplify the migration process, existing JSON configurations will be automatically migrated on upgrade. While users are encouraged to use the new persistent config based approach, users can continue with the legacy way of Sync Gateway configuration by setting the disable_persistent_config flag. Then when users are ready, they can migrate to the new approach. 

Learn more in the Sync Gateway 3.0 configuration documentation.

Secure Remote Administration

A major enhancement in this release, that goes hand-in-hand with the introduction of the centralized persistent config administration, is the secure administration of a cluster through the Sync Gateway admin REST API. New in 3.0, the admin API enforces authentication and role based access control by default. The admin user must be configured on the Couchbase Server as a RBAC user with suitable sync gateway roles. Consequently, only authorized users are allowed access to the Sync Gateway admin endpoint.

The benefits of secure remote administration includes:

  • Sync Gateways can be securely administered without the need for network infrastructure-based access control mechanisms (SSH tunneling or firewall rules). Remote administration is particularly important in distributed cloud deployments. Backend server applications such as identity servers require programmatic access to the admin REST API for configuring sync gateway users. 
  • Different applications have different purposes and different users. Starting in Sync Gateway 3.0, only users with a specific Sync Gateway role will be able to administer the Sync Gateway through the admin REST endpoint.
  • Future releases of Couchbase Server will include support for finer grained Sync Gateway roles that would allow more granular control over the admin functionality. So stay tuned!

Read more in the Sync Gateway 3.0 REST API access documentation.

TLS Encryption Enabled by Default

Starting in version 3.0, TLS is enabled by default on Sync Gateway for Couchbase Server communication, ensuring that all server-side communication is encrypted by default. This implies that Couchbase Server access over using non-TLS scheme such as “couchbase://” or “http://” will not be permitted by default. While we strongly recommend always having TLS enabled, we recognize that users may want to disable it for development and testing environments. So users have the option of opting-out of this feature.

Value Proposition:

  • With this new default behavior, we are enforcing and encouraging security best practices.

Read more about Enforcing TLS in the Sync Gateway security documentation.

User Defined Extended Attributes(XAttrs) for Access Control Metadata

Today, access grant information such as channels and roles are typically embedded within the document body as a dedicated property. With this release, users have the additional option to specify access grants in user-defined Extended Attributes(XATTRs) outside of the document body. The document XAttr is accessible from within the sync function and can be used to make dynamic data routing and access grant decisions as usual.

The separation of access grant metadata from document body offers several benefits:

  • Embedding access grant metadata within the document body implies that changes to access grants associated with a document will result in a corresponding update to the document body. The document update in turn will trigger a document replication to the clients. Access grant changes are irrelevant to clients resulting in “noise”. More importantly, if the channel list is large, then the document replications could result in significant bandwidth usage.
  • Embedding channel access grants within the document body will make that information accessible to all users who are syncing that document. This may raise certain privacy concerns. For example, if channel names correspond to user IDs, then a user replicating a document would have knowledge of other users who have access to the document.
  • The data model of existing documents do not have to be modified to retrofit access grant data with a dedicated property. Existing processes and applications do not have to be modified to use Sync Gateway for data sync.

There are instances where deriving the channel or access grant information based on contents of the document body is the best option, that option will continue to be supported.

Read more about XAttr access control in the documentation.

Auto-Purge Cluster Data on Channel Access Revocation 

Sync Gateway clusters can replicate data with each other using inter-Sync Gateway replication technology. During replication, if a user loses access to a channel and consequently loses access to documents in the replicating channel, the Sync Gateway on the active cluster on which the replication is initiated can be configured to auto-purge the documents in the revoked channel. 

This is an opt-in feature.

Value Proposition:

  • The sync technology enhancements will simplify the implementation of complex workflows related to the enforcement of data governance and data retention policies.

Here is an example of a workflow:

    •  A cruise ship is syncing voyage specific data from the cloud backend systems. Channels include voyage specific documents.
    • At the completion of voyage, the ship is revoked access to voyage channel
    • All voyage related documents on the ship must be purged. 

Read more in the replication purge documentation.

Resources

But that’s not all! There are a number of other enhancements that are discussed in product-specific release notes. Here are direct links to a few helpful resources. You can learn more on our Couchbase Lite and Sync Gateway What’s New pages linked below.

If you have questions or feedback, the Couchbase Developer Forums is a great way to engage with us. Please leave a comment below or feel free to reach out to me via Twitter or email me

Author

Posted by Priya Rajagopal, Senior Director, Product Management

Priya Rajagopal is a Senior Director of Product Management at Couchbase responsible for developer platforms for the cloud and the edge. She has been professionally developing software for over 20 years in several technical and product leadership positions, with 10+ years focused on mobile technologies. As a TISPAN IPTV standards delegate, she was a key contributor to the IPTV standards specifications. She has 22 patents in the areas of networking and platform security.

All Posts

Leave a reply