Centralize all mutations at the model level

This commit uses a new package that I need to document. It tries to
solve the long-standing debate in the Meteor community about
allow/deny rules versus methods (RPC).

This approach gives us both the centralized security rules of
allow/deny and the white-list of allowed mutations similarly to Meteor
methods. The idea to have static mutation descriptions is also
inspired by Facebook's Relay/GraphQL.

This will allow the development of a REST API using the high-level
methods instead of the MongoDB queries to do the mapping between the
HTTP requests and our collections.

11 files changed, 77 insertions, 234 deletions

diff --git a/client/components/boards/boardArchive.js b/client/components/boards/boardArchive.js
index 9d7ca7f2..35f795f3 100644
--- a/client/components/boards/boardArchive.js
+++ b/client/components/boards/boardArchive.js
@@ -22,13 +22,9 @@ BlazeComponent.extendComponent({
   events() {
     return [{
       'click .js-restore-board'() {
-        const boardId = this.currentData()._id;
-        Boards.update(boardId, {
-          $set: {
-            archived: false,
-          },
-        });
-        Utils.goBoardId(boardId);
+        const board = this.currentData();
+        board.restore();
+        Utils.goBoardId(board._id);
       },
     }];
   },
diff --git a/client/components/boards/boardHeader.js b/client/components/boards/boardHeader.js
index f259b2a6..19b463ed 100644
--- a/client/components/boards/boardHeader.js
+++ b/client/components/boards/boardHeader.js
@@ -7,8 +7,8 @@ Template.boardMenuPopup.events({
   'click .js-change-board-color': Popup.open('boardChangeColor'),
   'click .js-change-language': Popup.open('changeLanguage'),
   'click .js-archive-board ': Popup.afterConfirm('archiveBoard', () => {
-    const boardId = Session.get('currentBoard');
-    Boards.update(boardId, { $set: { archived: true }});
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    currentBoard.archive();
     // XXX We should have some kind of notification on top of the page to
     // confirm that the board was successfully archived.
     FlowRouter.go('home');
@@ -17,13 +17,9 @@ Template.boardMenuPopup.events({
 
 Template.boardChangeTitlePopup.events({
   submit(evt, tpl) {
-    const title = tpl.$('.js-board-name').val().trim();
-    if (title) {
-      Boards.update(this._id, {
-        $set: {
-          title,
-        },
-      });
+    const newTitle = tpl.$('.js-board-name').val().trim();
+    if (newTitle) {
+      this.rename(newTitle);
       Popup.close();
     }
     evt.preventDefault();
@@ -95,12 +91,9 @@ BlazeComponent.extendComponent({
   events() {
     return [{
       'click .js-select-background'(evt) {
-        const currentBoardId = Session.get('currentBoard');
-        Boards.update(currentBoardId, {
-          $set: {
-            color: this.currentData().toString(),
-          },
-        });
+        const currentBoard = Boards.findOne(Session.get('currentBoard'));
+        const newColor = this.currentData().toString();
+        currentBoard.setColor(newColor);
         evt.preventDefault();
       },
     }];
@@ -168,11 +161,9 @@ BlazeComponent.extendComponent({
   },
 
   selectBoardVisibility() {
-    Boards.update(Session.get('currentBoard'), {
-      $set: {
-        permission: this.currentData(),
-      },
-    });
+    const currentBoard = Boards.findOne(Session.get('currentBoard'));
+    const visibility = this.currentData();
+    currentBoard.setVisibility(visibility);
     Popup.close();
   },
 
diff --git a/client/components/cards/attachments.js b/client/components/cards/attachments.js
index ba56aa1a..5b81f115 100644
--- a/client/components/cards/attachments.js
+++ b/client/components/cards/attachments.js
@@ -15,10 +15,10 @@ Template.attachmentsGalery.events({
     // XXX Not implemented!
   },
   'click .js-add-cover'() {
-    Cards.update(this.cardId, { $set: { coverId: this._id } });
+    Cards.findOne(this.cardId).setCover(this._id);
   },
   'click .js-remove-cover'() {
-    Cards.update(this.cardId, { $unset: { coverId: '' } });
+    Cards.findOne(this.cardId).unsetCover();
   },
 });
 
diff --git a/client/components/cards/cardDetails.js b/client/components/cards/cardDetails.js
index 69e0cfdd..a493d938 100644
--- a/client/components/cards/cardDetails.js
+++ b/client/components/cards/cardDetails.js
@@ -55,12 +55,6 @@ BlazeComponent.extendComponent({
     this.componentParent().showOverlay.set(false);
   },
 
-  updateCard(modifier) {
-    Cards.update(this.data()._id, {
-      $set: modifier,
-    });
-  },
-
   events() {
     const events = {
       [`${CSSEvents.animationend} .js-card-details`]() {
@@ -76,13 +70,13 @@ BlazeComponent.extendComponent({
       'submit .js-card-description'(evt) {
         evt.preventDefault();
         const description = this.currentComponent().getValue();
-        this.updateCard({ description });
+        this.data().setDescription(description);
       },
       'submit .js-card-details-title'(evt) {
         evt.preventDefault();
         const title = this.currentComponent().getValue();
         if ($.trim(title)) {
-          this.updateCard({ title });
+          this.data().setTitle(title);
         }
       },
       'click .js-member': Popup.open('cardMember'),
@@ -135,14 +129,9 @@ Template.cardDetailsActionsPopup.events({
   'click .js-labels': Popup.open('cardLabels'),
   'click .js-attachments': Popup.open('cardAttachments'),
   'click .js-move-card': Popup.open('moveCard'),
-  // 'click .js-copy': Popup.open(),
   'click .js-archive'(evt) {
     evt.preventDefault();
-    Cards.update(this._id, {
-      $set: {
-        archived: true,
-      },
-    });
+    this.archive();
     Popup.close();
   },
   'click .js-more': Popup.open('cardMore'),
@@ -152,13 +141,9 @@ Template.moveCardPopup.events({
   'click .js-select-list'() {
     // XXX We should *not* get the currentCard from the global state, but
     // instead from a “component” state.
-    const cardId = Session.get('currentCard');
+    const card = Cards.findOne(Session.get('currentCard'));
     const newListId = this._id;
-    Cards.update(cardId, {
-      $set: {
-        listId: newListId,
-      },
-    });
+    card.move(newListId);
     Popup.close();
   },
 });
diff --git a/client/components/cards/labels.js b/client/components/cards/labels.js
index 2da3b80b..d2ee0140 100644
--- a/client/components/cards/labels.js
+++ b/client/components/cards/labels.js
@@ -45,19 +45,9 @@ Template.createLabelPopup.helpers({
 
 Template.cardLabelsPopup.events({
   'click .js-select-label'(evt) {
-    const cardId = Template.parentData(2).data._id;
+    const card = Cards.findOne(Session.get('currentCard'));
     const labelId = this._id;
-    let operation;
-    if (Cards.find({ _id: cardId, labelIds: labelId}).count() === 0)
-      operation = '$addToSet';
-    else
-      operation = '$pull';
-
-    Cards.update(cardId, {
-      [operation]: {
-        labelIds: labelId,
-      },
-    });
+    card.toggleLabel(labelId);
     evt.preventDefault();
   },
   'click .js-edit-label': Popup.open('editLabel'),
@@ -79,20 +69,10 @@ Template.formLabel.events({
 Template.createLabelPopup.events({
   // Create the new label
   'submit .create-label'(evt, tpl) {
+    const board = Boards.findOne(Session.get('currentBoard'));
     const name = tpl.$('#labelName').val().trim();
-    const boardId = Session.get('currentBoard');
     const color = Blaze.getData(tpl.find('.fa-check')).color;
-
-    Boards.update(boardId, {
-      $push: {
-        labels: {
-          name,
-          color,
-          _id: Random.id(6),
-        },
-      },
-    });
-
+    board.addLabel(name, color);
     Popup.back();
     evt.preventDefault();
   },
@@ -100,31 +80,16 @@ Template.createLabelPopup.events({
 
 Template.editLabelPopup.events({
   'click .js-delete-label': Popup.afterConfirm('deleteLabel', function() {
-    const boardId = Session.get('currentBoard');
-    Boards.update(boardId, {
-      $pull: {
-        labels: {
-          _id: this._id,
-        },
-      },
-    });
-
+    const board = Boards.findOne(Session.get('currentBoard'));
+    board.removeLabel(this._id);
     Popup.back(2);
   }),
   'submit .edit-label'(evt, tpl) {
     evt.preventDefault();
+    const board = Boards.findOne(Session.get('currentBoard'));
     const name = tpl.$('#labelName').val().trim();
-    const boardId = Session.get('currentBoard');
-    const getLabel = Utils.getLabelIndex(boardId, this._id);
     const color = Blaze.getData(tpl.find('.fa-check')).color;
-
-    Boards.update(boardId, {
-      $set: {
-        [getLabel.key('name')]: name,
-        [getLabel.key('color')]: color,
-      },
-    });
-
+    board.editLabel(this._id, name, color);
     Popup.back();
   },
 });
diff --git a/client/components/lists/list.js b/client/components/lists/list.js
index cdf30fc2..af9bef98 100644
--- a/client/components/lists/list.js
+++ b/client/components/lists/list.js
@@ -73,23 +73,13 @@ BlazeComponent.extendComponent({
         $cards.sortable('cancel');
 
         if (MultiSelection.isActive()) {
-          Cards.find(MultiSelection.getMongoSelector()).forEach((c, i) => {
-            Cards.update(c._id, {
-              $set: {
-                listId,
-                sort: sortIndex.base + i * sortIndex.increment,
-              },
-            });
+          Cards.find(MultiSelection.getMongoSelector()).forEach((card, i) => {
+            card.move(listId, sortIndex.base + i * sortIndex.increment);
           });
         } else {
           const cardDomElement = ui.item.get(0);
-          const cardId = Blaze.getData(cardDomElement)._id;
-          Cards.update(cardId, {
-            $set: {
-              listId,
-              sort: sortIndex.base,
-            },
-          });
+          const card = Blaze.getData(cardDomElement);
+          card.move(listId, sortIndex.base);
         }
         boardComponent.setIsDragging(false);
       },
@@ -107,16 +97,15 @@ BlazeComponent.extendComponent({
           accept: '.js-member,.js-label',
           drop(event, ui) {
             const cardId = Blaze.getData(this)._id;
-            let addToSet;
+            const card = Cards.findOne(cardId);
 
             if (ui.draggable.hasClass('js-member')) {
               const memberId = Blaze.getData(ui.draggable.get(0)).userId;
-              addToSet = { members: memberId };
+              card.assignMember(memberId);
             } else {
               const labelId = Blaze.getData(ui.draggable.get(0))._id;
-              addToSet = { labelIds: labelId };
+              card.addLabel(labelId);
             }
-            Cards.update(cardId, { $addToSet: addToSet });
           },
         });
       });
diff --git a/client/components/lists/listHeader.js b/client/components/lists/listHeader.js
index 9431b461..d4891fec 100644
--- a/client/components/lists/listHeader.js
+++ b/client/components/lists/listHeader.js
@@ -5,14 +5,10 @@ BlazeComponent.extendComponent({
 
   editTitle(evt) {
     evt.preventDefault();
-    const form = this.componentChildren('inlinedForm')[0];
-    const newTitle = form.getValue();
+    const newTitle = this.componentChildren('inlinedForm')[0].getValue();
+    const list = this.currentData();
     if ($.trim(newTitle)) {
-      Lists.update(this.currentData()._id, {
-        $set: {
-          title: newTitle,
-        },
-      });
+      list.rename(newTitle);
     }
   },
 
@@ -33,45 +29,30 @@ Template.listActionPopup.events({
   },
   'click .js-list-subscribe'() {},
   'click .js-select-cards'() {
-    const cardIds = Cards.find(
-      {listId: this._id},
-      {fields: { _id: 1 }}
-    ).map((card) => card._id);
+    const cardIds = this.allCards().map((card) => card._id);
     MultiSelection.add(cardIds);
     Popup.close();
   },
   'click .js-move-cards': Popup.open('listMoveCards'),
   'click .js-archive-cards': Popup.afterConfirm('listArchiveCards', () => {
-    Cards.find({listId: this._id}).forEach((card) => {
-      Cards.update(card._id, {
-        $set: {
-          archived: true,
-        },
-      });
+    this.allCards().forEach((card) => {
+      card.archive();
     });
     Popup.close();
   }),
   'click .js-close-list'(evt) {
     evt.preventDefault();
-    Lists.update(this._id, {
-      $set: {
-        archived: true,
-      },
-    });
+    this.archive();
     Popup.close();
   },
 });
 
 Template.listMoveCardsPopup.events({
   'click .js-select-list'() {
-    const fromList = Template.parentData(2).data._id;
+    const fromList = Template.parentData(2).data;
     const toList = this._id;
-    Cards.find({ listId: fromList }).forEach((card) => {
-      Cards.update(card._id, {
-        $set: {
-          listId: toList,
-        },
-      });
+    fromList.allCards().forEach((card) => {
+      card.move(toList);
     });
     Popup.close();
   },
diff --git a/client/components/sidebar/sidebar.js b/client/components/sidebar/sidebar.js
index eff0ef52..8c58c37e 100644
--- a/client/components/sidebar/sidebar.js
+++ b/client/components/sidebar/sidebar.js
@@ -109,14 +109,6 @@ EscapeActions.register('sidebarView',
   () => { return Sidebar && Sidebar.getView() !== defaultView; }
 );
 
-function getMemberIndex(board, searchId) {
-  for (let i = 0; i < board.members.length; i++) {
-    if (board.members[i].userId === searchId)
-      return i;
-  }
-  throw new Meteor.Error('Member not found');
-}
-
 Template.memberPopup.helpers({
   user() {
     return Users.findOne(this.userId);
@@ -135,13 +127,8 @@ Template.memberPopup.events({
   'click .js-change-role': Popup.open('changePermissions'),
   'click .js-remove-member': Popup.afterConfirm('removeMember', function() {
     const currentBoard = Boards.findOne(Session.get('currentBoard'));
-    const memberIndex = getMemberIndex(currentBoard, this.userId);
-
-    Boards.update(currentBoard._id, {
-      $set: {
-        [`members.${memberIndex}.isActive`]: false,
-      },
-    });
+    const memberId = this.userId;
+    currentBoard.removeMember(memberId);
     Popup.close();
   }),
   'click .js-leave-member'() {
@@ -209,26 +196,7 @@ Template.addMemberPopup.events({
   'click .js-select-member'() {
     const userId = this._id;
     const currentBoard = Boards.findOne(Session.get('currentBoard'));
-    const currentMembersIds = _.pluck(currentBoard.members, 'userId');
-    if (currentMembersIds.indexOf(userId) === -1) {
-      Boards.update(currentBoard._id, {
-        $push: {
-          members: {
-            userId,
-            isAdmin: false,
-            isActive: true,
-          },
-        },
-      });
-    } else {
-      const memberIndex = getMemberIndex(currentBoard, userId);
-
-      Boards.update(currentBoard._id, {
-        $set: {
-          [`members.${memberIndex}.isActive`]: true,
-        },
-      });
-    }
+    currentBoard.addMember(userId);
     Popup.close();
   },
 });
@@ -240,14 +208,9 @@ Template.addMemberPopup.onRendered(function() {
 Template.changePermissionsPopup.events({
   'click .js-set-admin, click .js-set-normal'(event) {
     const currentBoard = Boards.findOne(Session.get('currentBoard'));
-    const memberIndex = getMemberIndex(currentBoard, this.userId);
+    const memberId = this.userId;
     const isAdmin = $(event.currentTarget).hasClass('js-set-admin');
-
-    Boards.update(currentBoard._id, {
-      $set: {
-        [`members.${memberIndex}.isAdmin`]: isAdmin,
-      },
-    });
+    currentBoard.setMemberPermission(memberId, isAdmin);
     Popup.back(1);
   },
 });
diff --git a/client/components/sidebar/sidebarArchives.js b/client/components/sidebar/sidebarArchives.js
index f2597c3c..52d42edb 100644
--- a/client/components/sidebar/sidebarArchives.js
+++ b/client/components/sidebar/sidebarArchives.js
@@ -29,8 +29,8 @@ BlazeComponent.extendComponent({
   events() {
     return [{
       'click .js-restore-card'() {
-        const cardId = this.currentData()._id;
-        Cards.update(cardId, {$set: {archived: false}});
+        const card = this.currentData();
+        card.restore();
       },
       'click .js-delete-card': Popup.afterConfirm('cardDelete', function() {
         const cardId = this._id;
@@ -38,8 +38,8 @@ BlazeComponent.extendComponent({
         Popup.close();
       }),
       'click .js-restore-list'() {
-        const listId = this.currentData()._id;
-        Lists.update(listId, {$set: {archived: false}});
+        const list = this.currentData();
+        list.restore();
       },
     }];
   },
diff --git a/client/components/sidebar/sidebarFilters.js b/client/components/sidebar/sidebarFilters.js
index 335cc7d6..babd2f1e 100644
--- a/client/components/sidebar/sidebarFilters.js
+++ b/client/components/sidebar/sidebarFilters.js
@@ -30,9 +30,9 @@ BlazeComponent.extendComponent({
   },
 }).register('filterSidebar');
 
-function updateSelectedCards(query) {
+function mutateSelectedCards(mutationName, ...args) {
   Cards.find(MultiSelection.getMongoSelector()).forEach((card) => {
-    Cards.update(card._id, query);
+    card[mutationName](...args);
   });
 }
 
@@ -67,47 +67,34 @@ BlazeComponent.extendComponent({
       'click .js-toggle-label-multiselection'(evt) {
         const labelId = this.currentData()._id;
         const mappedSelection = this.mapSelection('label', labelId);
-        let operation;
-        if (_.every(mappedSelection))
-          operation = '$pull';
-        else if (_.every(mappedSelection, (bool) => !bool))
-          operation = '$addToSet';
-        else {
+
+        if (_.every(mappedSelection)) {
+          mutateSelectedCards('addLabel', labelId);
+        } else if (_.every(mappedSelection, (bool) => !bool)) {
+          mutateSelectedCards('removeLabel', labelId);
+        } else {
           const popup = Popup.open('disambiguateMultiLabel');
           // XXX We need to have a better integration between the popup and the
           // UI components systems.
           return popup.call(this.currentData(), evt);
         }
-
-        updateSelectedCards({
-          [operation]: {
-            labelIds: labelId,
-          },
-        });
       },
       'click .js-toggle-member-multiselection'(evt) {
         const memberId = this.currentData()._id;
         const mappedSelection = this.mapSelection('member', memberId);
-        let operation;
-        if (_.every(mappedSelection))
-          operation = '$pull';
-        else if (_.every(mappedSelection, (bool) => !bool))
-          operation = '$addToSet';
-        else {
+        if (_.every(mappedSelection)) {
+          mutateSelectedCards('assignMember', memberId);
+        } else if (_.every(mappedSelection, (bool) => !bool)) {
+          mutateSelectedCards('unassignMember', memberId);
+        } else {
           const popup = Popup.open('disambiguateMultiMember');
           // XXX We need to have a better integration between the popup and the
           // UI components systems.
           return popup.call(this.currentData(), evt);
         }
-
-        updateSelectedCards({
-          [operation]: {
-            members: memberId,
-          },
-        });
       },
       'click .js-archive-selection'() {
-        updateSelectedCards({$set: {archived: true}});
+        mutateSelectedCards('archive');
       },
     }];
   },
@@ -115,22 +102,22 @@ BlazeComponent.extendComponent({
 
 Template.disambiguateMultiLabelPopup.events({
   'click .js-remove-label'() {
-    updateSelectedCards({$pull: {labelIds: this._id}});
+    mutateSelectedCards('removeLabel', this._id);
     Popup.close();
   },
   'click .js-add-label'() {
-    updateSelectedCards({$addToSet: {labelIds: this._id}});
+    mutateSelectedCards('addLabel', this._id);
     Popup.close();
   },
 });
 
 Template.disambiguateMultiMemberPopup.events({
   'click .js-unassign-member'() {
-    updateSelectedCards({$pull: {members: this._id}});
+    mutateSelectedCards('assignMember', this._id);
     Popup.close();
   },
   'click .js-assign-member'() {
-    updateSelectedCards({$addToSet: {members: this._id}});
+    mutateSelectedCards('unassignMember', this._id);
     Popup.close();
   },
 });
diff --git a/client/components/users/userAvatar.js b/client/components/users/userAvatar.js
index 04add0a6..1f1da251 100644
--- a/client/components/users/userAvatar.js
+++ b/client/components/users/userAvatar.js
@@ -82,11 +82,7 @@ BlazeComponent.extendComponent({
   },
 
   setAvatar(avatarUrl) {
-    Meteor.users.update(Meteor.userId(), {
-      $set: {
-        'profile.avatarUrl': avatarUrl,
-      },
-    });
+    Meteor.user().setAvatarUrl(avatarUrl);
   },
 
   setError(error) {
@@ -151,19 +147,9 @@ Template.cardMembersPopup.helpers({
 
 Template.cardMembersPopup.events({
   'click .js-select-member'(evt) {
-    const cardId = Template.parentData(2).data._id;
+    const card = Cards.findOne(Session.get('currentCard'));
     const memberId = this.userId;
-    let operation;
-    if (Cards.find({ _id: cardId, members: memberId}).count() === 0)
-      operation = '$addToSet';
-    else
-      operation = '$pull';
-
-    Cards.update(cardId, {
-      [operation]: {
-        members: memberId,
-      },
-    });
+    card.toggleMember(memberId);
     evt.preventDefault();
   },
 });
@@ -176,7 +162,7 @@ Template.cardMemberPopup.helpers({
 
 Template.cardMemberPopup.events({
   'click .js-remove-member'() {
-    Cards.update(this.cardId, {$pull: {members: this.userId}});
+    Cards.findOne(this.cardId).unassignMember(this.userId);
     Popup.close();
   },
   'click .js-edit-profile': Popup.open('editProfile'),