CouchDB _users Database Validation and Admin Role Constraints

CouchDB utilizes the _users system database to manage user documents, requiring a type field set to user and a roles array to define permissions.

In standard configurations, the _users database validation function ensures that the document name matches the caller and that the roles field is a valid array. However, there is uncertainty regarding the default enforcement of role assignments during the creation of new user documents by authenticated non-admin users.

When integrating testing environments without production credentials, it is necessary to determine if the default validation prevents a non-privileged user from assigning specific roles to their own document or others.

• Does the default _users validation function prevent an authenticated non-admin user from adding the _admin role to a new user document?
• What is the recommended approach for implementing a custom validation function to strictly restrict role assignments to server administrators?