roleperms.js

import { Meteor } from 'meteor/meteor';
import { Mongo } from 'meteor/mongo';
import { check } from 'meteor/check';
import { _ } from 'meteor/underscore';

export const GroupsCollection = new Mongo.Collection('groups');

export const roleperms = {
	isUserInGroup(userId, group) {
		check(userId, String);
		check(group, String);
		const user = Meteor.users.findOne(userId);
		if (!user) {
			console.error('UserId %s not found', userId);
			return false; // technically the userId was invalid...
		}
		return (user.groups && _.contains(user.groups, group));
	},
	// @todo what happens if the permission passed has wildcards?
	doesUserHavePermission(userId, permission) {
		check(userId, String);
		check(permission, String);
		const user = Meteor.users.findOne(userId);
		if (!user) {
			console.error('UserId %s not found', userId);
			return false; // technically the userId was invalid...
		}
		// check user permissions
		if (user.permissions) {
			for (let i = 0; i < user.permissions.length; i++) {
				if (user.permissions[i].match(permission)) {
					return true;
				}
			}
		}
		// check each of the user's groups permissions
		if (user.groups) {
			for (let i = 0; i < user.groups.length; i++) {
				const groupName = user.groups[i];
				const group = GroupsCollection.findOne({ name: groupName });

				for (let j = 0; j < group.permissions.length; j++) {
					if (group.permissions[j].match(permission)) {
						return true;
					}
				}
			}
		}
		return false;
	},

	addPermissionToUser(permission, userId) {
		check(permission, String);
		check(userId, String);
		Meteor.users.update({ _id: userId }, { $addToSet: { permission: permission } });
	},
	addPermissionToGroup(permission, group) {
		check(permission, String);
		check(group, String);
		GroupsCollection.update({ name: group }, { $addToSet: { permission: permission } });
	},
	removePermissionFromUser(permission, userId) {
		check(permission, String);
		check(userId, String);
		Meteor.users.update({ _id: userId }, { $pull: { permission: permission } });
	},
	removePermissionFromGroup(permission, group) {
		check(permission, String);
		check(group, String);
		GroupsCollection.update({ name: group }, { $pull: { permission: permission } });
	},
};


let a_user = {
	_id: 'bbca5d6a-2156-41c4-89da-0329e8c99a4f',  // Meteor.userId()

	username: 'cool_kid_13', // unique name

	emails: [
		// each email address can only belong to one user.

		{ address: 'cool@example.com', verified: true },
		{ address: 'another@different.com', verified: false },
	],
	createdAt: 'Wed Aug 21 2013 15:16:52 GMT-0700 (PDT)',
	profile: {
		// The profile is writable by the user by default.

		name: 'Joe Schmoe',

	},
	groups: [
		'admin', 'asker',
	],
	permissions: [
		'admin.teams.*',
		'admin.tags.*',
		'admin.users.*',
		'admin.rules.*',
		'admin.manual.*',
		'admin.teams.*',
		'admin.canned.*',
	],
};

const groups_collection = [
	{
		_id: 'idadsfadsf',
		name: '',
		permissions: [
			'admin.teams.*',
			'admin.tags.*',
			'admin.users.*',
			'admin.rules.*',
			'admin.manual.*',
			'admin.teams.*',
			'admin.canned.*',
		],
	},
];