From 45b662a1ddb46a0f17fab7b2383c82aa1e1620ef Mon Sep 17 00:00:00 2001 From: Maxime Quandalle Date: Tue, 8 Sep 2015 20:19:42 +0200 Subject: Centralize all mutations at the model level This commit uses a new package that I need to document. It tries to solve the long-standing debate in the Meteor community about allow/deny rules versus methods (RPC). This approach gives us both the centralized security rules of allow/deny and the white-list of allowed mutations similarly to Meteor methods. The idea to have static mutation descriptions is also inspired by Facebook's Relay/GraphQL. This will allow the development of a REST API using the high-level methods instead of the MongoDB queries to do the mapping between the HTTP requests and our collections. --- collections/unsavedEdits.js | 34 ---------------------------------- 1 file changed, 34 deletions(-) delete mode 100644 collections/unsavedEdits.js (limited to 'collections/unsavedEdits.js') diff --git a/collections/unsavedEdits.js b/collections/unsavedEdits.js deleted file mode 100644 index 87a70e22..00000000 --- a/collections/unsavedEdits.js +++ /dev/null @@ -1,34 +0,0 @@ -// This collection shouldn't be manipulated directly by instead throw the -// `UnsavedEdits` API on the client. -UnsavedEditCollection = new Mongo.Collection('unsaved-edits'); - -UnsavedEditCollection.attachSchema(new SimpleSchema({ - fieldName: { - type: String, - }, - docId: { - type: String, - }, - value: { - type: String, - }, - userId: { - type: String, - }, -})); - -if (Meteor.isServer) { - function isAuthor(userId, doc, fieldNames = []) { - return userId === doc.userId && fieldNames.indexOf('userId') === -1; - } - UnsavedEditCollection.allow({ - insert: isAuthor, - update: isAuthor, - remove: isAuthor, - fetch: ['userId'], - }); -} - -UnsavedEditCollection.before.insert((userId, doc) => { - doc.userId = userId; -}); -- cgit v1.2.3-1-g7c22