The behavior of remove differs depending on whether it is called by trusted or untrusted code. Trusted code includes server code and method code. Untrusted code includes client-side code such as event handlers and a browser’s JavaScript console.
… Untrusted code can only remove a single document at a time, specified by its _id. The document is removed only after checking any applicable allow and deny rules. The number of removed documents will be returned to the callback.
In other words, on the client you can only remove by _id.
You could do that easily with a client-side call to a meteor method (warning: I’ve not put any safety checks in this code, so it will be run for anyone).
// In your client code:
Template.tasktemplate.events({
'click .deletecat'(event) {
event.preventDefault();
const appId = FlowRouter.getParam('Id');
const confirm = window.confirm('Delete this category and tasks?');
if (confirm) {
Meteor.call('removeCat', appId);
}
},
});
// In your server code
Meteor.methods({
removeCat(appId) {
Tasks.remove({ parentId: appId });
Categories.remove({ _id: appId });
},
});
If you want to read more on Meteor methods and how to validate and secure them, check out the Meteor Guide.