Hello everyone, I'm facing an issue with the Meteor accounts API again. I am trying to allow only logged-in users to modify their own list without impacting other users' lists. Here is the code I have:
Meteor.subscribe('Categories');
Meteor.autosubscribe(function() {
Meteor.subscribe("listdetails",
Session.get('current_list'));
});
'keyup #add-category': function (e,t){
if (e.which === 13)
{
var catVal = String(e.target.value || "");
if (catVal)
{
lists.insert({Category:catVal,owner:this.userId});
Session.set('adding_category', false);
}
}
},
The server-side:
Meteor.startup(function () {
Meteor.publish("Categories", function() {
return lists.find({owner:Meteor.userId},{fields:{Category:1}});
});
Meteor.publish("listdetails", function(category_id){
return lists.find({_id:category_id});
});
});
Both client and server sides:
lists = new Meteor.Collection("Lists");
function adminUser(userId) {
var adminUser = Meteor.users.findOne({username:"admin"});
return (userId && adminUser && userId === adminUser._id);
}
lists.allow({
insert: function (userId, doc) {
// the user must be logged in, and the document must be owned by the user
return (adminUser(userId) || userId && doc.owner === userId);
},
update: function(userId, docs, fields, modifier){
return adminUser(userId) || _.all(docs, function(doc) {
return doc.owner === userId;
});
},
remove: function (userId, docs){
return adminUser(userId) || _.all(docs, function(doc) {
return doc.owner === userId;
});
},
fetch: ['owner']
});
You can see that when logged in as an admin or not logged in at all, the screens look similar (not the desired result). Also, note that "this.userId" is undefined which is strange, hence why I used Meteor.userId.