|
This is more of a data modeling and permissions question, more dependent on the database choice rather than the framework I'd say. Since Meteor only supports Mongo right now, I'll use Mongo terms (collections & documents) Meteor gives you an accounts collection so you don't have to declare it yourself. But we do need to declare the Groups Collection Groups = new Mongo.Collection('groups');
Let's assume we want Users and Groups to have a many to many relation, so each User doc has an attribute `groups`. `groups` is an array of which each element is the unique id of a Group document. Similarly, Group documents have an attribute `members`, an array of which each element is a User document unique id.There is a third Collection needed, documents. Documents = new Mongo.Collection('documents');
Each document in the Documents Collection has an `owner` field that is the unique id of a Group document.To handle the security for inserting or updating the Documents Collection, you need to set 2 allow rules on the Collection to check if the document.owner is in the user.groups array. Documents.allow({
insert: function(userId, doc) {
// doc's owner must be one of logged in user's groups
return Meteor.user().groups.indexOf(doc.owner) > -1;
},
update: function(userId, doc, field, modifier) {
return Meteor.user().groups.indexOf(doc.owner) > -1;
}
}
As for reading the document, you do that when declaring your Publications. Easiest would be to publish all of them, but you could also pass in a groupId or array of groupIds if you wanted to have some restrictions. Meteor.publish("documents", function() {
return Documents.find();
};
|