accessControl.coffee

ALLOWED_COLLECTIONS = [
  'auths'       # Private user data
]  

store.allow 'create', 'auths', (docId, newDoc, session) ->
  console.log '[Auths] CREATE'
  undefined

store.allow 'all', 'auths.*', (docId, relPath, opData, docBeingUpdated, session) ->
  console.log '[Auths] CHANGE'
  return undefined if session.userId in store.ADMINS
  if docBeingUpdated and docId isnt session.userId
    'Unauthorized auth change'
  else
    undefined

store.allow 'del', 'auths', (docId, docToRemove, session) ->
  console.log '[Auths] DELETE'
  'Unauthorized auth delete'

store.allow 'all', '**', (docId, relPath, opData, docBeingUpdated, connectSession) ->
  'Unauthorized action' unless opData.collection in ALLOWED_COLLECTIONS