Allow/deny reminder
Most developers have moved on from the allow and deny pattern, but as a reminder, Meteor has discouraged the use of allow and deny rules for some time due to the ease of misconfiguring them, usually due to unintended oversight. (See some interesting details in this thread!) While in this case, they actually malfunctioned under certain conditions, it’s worth emphasizing that we still discourage their use. The use of Meteor methods with specific, well-defined purposes which handle the updates themselves is a better approach.