Insert using Autoform with insecure deletion

Question

I use Collection2 and Autoform in my Meteor project, made things a lot easier!

However, when I delete insecure, it no longer inserts (send auto-form button). I was expecting this!

However, I searched, and I cannot find a standard way to make this work? I have a schema defined in the lib folder and my Autoform as a quick form in a template. I know that I need to either enable the client-side insertion (which I would prefer not to do), or transfer it to the server (perhaps using the method?)

Any suggestions would be much appreciated! I am looking for a standard way to implement it.

Answer 1

Found my own answer after a long dig. The allowed rules for inserting, updating, and deleting are created:

Posts = new Mongo.Collection('posts'); //SECURITY - Allow Callbacks for posting Posts.allow({ insert: function(userId, doc) { // only allow posting if you are logged in return !! userId; }, update: function(userId, doc) { // only allow updating if you are logged in return !! userId; }, remove: function(userID, doc) { //only allow deleting if you are owner return doc.submittedById === Meteor.userId(); } }); //Schema then defined as usual 

Just a note, submittedById is the field in my collection that stores userId. If you called it something else, change it!

Hope this helps someone with a similar problem.