covercouch | Per-document ACL engine for CouchDB | Authorization library

In my company, we use IBM Domino for more than a decade. We use it to build offline applications with replication support. It works well but we need to use the IBM Notes client to allow this feature and it doesn't work on mobile devices (except Windows laptop, of course).

I'm looking for other solutions to build offline-first and multi-support (web) applications. I think that CouchDB + PouchDB is the best solution. But to replace Domino, I have to replace the authorization feature.

Domino has many levels of rights in database ACL (Manager, Designer, Author, Writer, Reader,...). And for each document, we can add a reader and an author field which limit who can write and read document.

For example, we use Domino with our CRM, employee can read (and write) his customers and the customers of the employee who are lower him in the company hierarchy. He can also view customers in its geographical areas (no write).

To do this in Domino, we calculate (each night) a reader and an author field in every customer document. How can I achieve something like this in CouchDB? Is it possible?

I read about many possibilities:

• Partial sync with show or filter functions (CouchDB / PouchDB partial syncs with limited rights)
• One database per user. (How split database in my case?)
• Use a proxy application like covercouch to manage ACL (https://github.com/ermouth/covercouch)
• Develop my own proxy where in can implement filter functions to match my needs?

What is the best solution to solve my issue above?