Limit Collection For User

[mvryan]

Hi I was wondering if there is some way I can limit what elements of a collection each user can see like the built in Meteor.publish function allows?
Can I pass a cursor to Restivus.addCollection()?

[kahmali]

Right now, the only way to limit or alter what's returned is to completely override the collection endpoint:

Restivus.addCollection Meteor.users
  endpoints:
    get:
      action: ->
        # Do all your work here as you would in a regular (non-collection) endpoint
    getAll:
      action: ->
        # Do all your work here as you would in a regular (non-collection) endpoint

If you're going to go through all the work of passing me a filtered cursor, as you suggested, all you would need to do is to just call cursor.fetch() to return those documents (well, I guess Restivus could at least wrap them in the JSend-formatted response). I think there may be a chance to abstract things away a bit more via the endpoint options. I just need to give it a little thought. Of course, I'll gladly accept any suggestions.

One thing that I intend to do, regardless, is to add hooks to all the endpoints to allow you to modify the response data immediately before it's returned. That would certainly be more convenient than having to manually override the get and getAll endpoints, but still less so than providing some filtering options on collections endpoints. I also need to add this.collection to the collection endpoint context so that it's accessible in those hooks and any override methods.

I'm in the process of adding automated testing, which is long overdue. Once I have a decent test suite setup I'll make this feature my top priority. I expect the initial test suite to be complete this weekend, so I should be able to get this feature published by next weekend. At the absolute least I will add the onResponse endpoint hooks, but I'm sure we can do something cleaner for the collections.

[dandv]

add hooks to all the endpoints to allow you to modify the response data immediately before it's returned

This. A transform-style hook. It would work with findOne as well as find, and maintains the Meteor/Mongo Collection convention.

[kahmali]

You're right, that would be perfect. It's funny, I was just reading the Meteor Docs on Mongo Collections in an unrelated matter, and when I came across the transform option I thought, "Why didn't I already think to allow users to configure this on collection endpoints?" This just shot up to the top of my list since it's so easy, and it's a critical issue for collection support. Thanks for suggesting this! It's just what I needed.

I'll update this once I decide how to add it to the API, in case you want to give some feedback on that. It may just be an extra option on the get and getAll collection endpoints.

[achirkof]

@mvryan @kahmali Hello!
Did you find the solution how to filter returned documents only for current user?
Code like

Api.addCollection('books', {
    routeOptions: {
      authRequired: true
    },
    endpoints: {
      getAll: {
        action: function() {
            return Books.find({writtenBy: this.userId});
        }
      }
    }
  });

doesn't work for me

[vinhhungle]

This works for me. But I'm not quite sure if it is the correct way.

getAll: {
        action: function() {
            return { status: 'success', data: Photos.find({ userId: this.userId }).fetch() }
        }
},