reactioncommerce/meteor-security

Way to go about updating from a collection hook

gabriel-dehan opened this issue · 2 comments

Hello there, I am currently using Astronomy events (would be the same with collection2-hooks though) to handle my relations.

I have a collection Posts like that : { _id: string, user_id: string, content: string, comments_ids: array }
And a Comments collection : { _id: string, user_id: string, content: string }

In my Comments collection I have an afterInsert hook that updates the Posts#comments_ids. The issue here is that I have the following permissions:

// ...
 Collections.Posts.permit(['update']).ifLoggedIn().ifCurrentUserOwnsRessource().allowInClientCode();
 Collections.Comments.permit(['update']).ifLoggedIn().ifCurrentUserOwnsRessource().allowInClientCode();

Which works well except in this peculiar case because when the comment is inserted, it triggers the Posts update which doesn't have the same user_id thus ifCurrentUserOwnsRessource() fails and I can't update my post.

Any clue on how to solve this issue ?

Thanks a lot

PS: Basicaly got the same issue with my cascading removes, etc...

Can you post some example code of how you would do the posts update and what the event handler looks like? It sounds like the hook is probably running in client code, but it would make more sense to me for it to run on the server.

Closing due to no response for more detail