I’m building a CMS and depending on the user role
they will be able to edit/update/delete/create different areas but filtered by their role
as in, one user with role: 'basic role'
can’t delete what the user with role: 'superuser'
can.
What I have at the moment is this:
Collection.allow({
insert: function(userId, collection) {
return Meteor.users.findOne({_id: userId, profile: {role: 'admin'}});
},
update: function(userId, collection, fields, modifier) {
return Meteor.users.findOne({_id: userId, profile: {role: 'admin'}});
},
remove: function(userId, collection) {
return Meteor.users.findOne({_id: userId, profile: {role: 'admin'}});
}
});
QUESTION
Is this the right way to validate users roles? Are there better ways? What is the best practices for this?
Thanks!