I'm having trouble adding custom user fields to a Meteor user object (Meteor.user). I'd like a user to have a "status" field, and I'd rather not nest it under "profile" (ie, profile.status), which I do know is r/w by default. (I've already removed autopublish.)

I've been able to publish the field to the client just fine via

Meteor.publish("directory", function () {
  return Meteor.users.find({}, {fields: {username: 1, status: 1}});
});

...but I can't get set permissions that allow a logged-in user to update their own status.

If I do

Meteor.users.allow({
  update: function (userId) {     
    return true; 
}});

in Models.js, a user can edit all the fields for every user. That's not cool.

I've tried doing variants such as

Meteor.users.allow({
  update: function (userId) {     
    return userId === Meteor.userId(); 
}});

and

Meteor.users.allow({
  update: function (userId) {     
    return userId === this.userId(); 
}});

and they just get me Access Denied errors in the console.

The documentation addresses this somewhat, but doesn't go into enough detail. What silly mistake am I making?

(This is similar to this SO question, but that question only addresses how to publish fields, not how to update them.)

I'm having trouble adding custom user fields to a Meteor user object (Meteor.user). I'd like a user to have a "status" field, and I'd rather not nest it under "profile" (ie, profile.status), which I do know is r/w by default. (I've already removed autopublish.)

I've been able to publish the field to the client just fine via

Meteor.publish("directory", function () {
  return Meteor.users.find({}, {fields: {username: 1, status: 1}});
});

...but I can't get set permissions that allow a logged-in user to update their own status.

If I do

Meteor.users.allow({
  update: function (userId) {     
    return true; 
}});

in Models.js, a user can edit all the fields for every user. That's not cool.

I've tried doing variants such as

Meteor.users.allow({
  update: function (userId) {     
    return userId === Meteor.userId(); 
}});

and

Meteor.users.allow({
  update: function (userId) {     
    return userId === this.userId(); 
}});

and they just get me Access Denied errors in the console.

The documentation addresses this somewhat, but doesn't go into enough detail. What silly mistake am I making?

(This is similar to this SO question, but that question only addresses how to publish fields, not how to update them.)

• javascript
• meteor

Share Follow edited May 23, 2017 at 11:59 CommunityBot 111 silver badge asked May 17, 2013 at 3:14 Brett NeeseBrett Neese 4722 silver badges88 bronze badges

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 5

This is how I got it to work.

In the server I publish the userData

Meteor.publish("userData", function () {
  return Meteor.users.find(
    {_id: this.userId},
    {fields: {'foo': 1, 'bar': 1}}
  );
});

and set the allow as follows

Meteor.users.allow({
  update: function (userId, user, fields, modifier) {
    // can only change your own documents
    if(user._id === userId)
    {
      Meteor.users.update({_id: userId}, modifier);
      return true;
    }
    else return false;
  }
});

in the client code, somewhere I update the user record, only if there is a user

if(Meteor.userId())
{
 Meteor.users.update({_id: Meteor.userId()},{$set:{foo: 'something', bar: 'other'}});
}

Try:

Meteor.users.allow({
  update: function (userId, user) {     
    return userId === user._id; 
  }
});

From the documentation for collection.allow:

update(userId, doc, fieldNames, modifier)

The user userId wants to update a document doc. (doc is the current version of the document from the database, without the proposed update.) Return true to permit the change.