Commit 8-2: Added basic permission to check the posts's owner. Removed insecure.

.meteor/packages

@@ -12,4 +12,3 @@ sacha:spin
 ian:accounts-ui-bootstrap-3
 accounts-password
 audit-argument-checks
-insecure

.meteor/versions

@@ -21,7 +21,6 @@ htmljs@1.0.4
 http@1.1.0
 ian:accounts-ui-bootstrap-3@1.2.79
 id-map@1.0.3
-insecure@1.0.3
 iron:controller@1.0.8
 iron:core@1.0.8
 iron:dynamic-template@1.0.8

lib/collections/posts.js

@@ -12,7 +12,16 @@ Posts = new Mongo.Collection('posts');
 
 // Removed Posts.allow : we no longer trigger inserts from client.
 
-// This is in lib/ instead of server/ for latency compensation (?).
+Posts.allow({
+  update: function (userId, post) {
+    return ownsDocument(userId, post);
+  },
+  remove: function (userId, post) {
+    return ownsDocument(userId, post);
+  }
+});
+
+// This is in lib/ instead of server/ for latency compensation.
 Meteor.methods({
   postInsert: function(postAttributes) {
     "use strict";

lib/permissions.js

@@ -0,0 +1,13 @@
+/**
+ * @file
+ *
+ *
+ * User: marand
+ * Date: 02/09/15
+ * Time: 08:58
+ */
+
+// Global, so no "var".
+ownsDocument = function (userId, doc) {
+  return doc && doc.userId === userId;
+}