Sails.js policy that enforces current user as creator of models

isNotColletion.js

module.exports = function(req, res, next) {
  // Make sure request is for a single entity, not for a collection of entities
  if (!req.params.id) {
    return res.forbidden('error.noPermission');
  }
  return next();
};

policies.js

module.exports.policies = {
  '*': true,
  'user': {
    // Prevent entire list of users from being loaded
    'find': 'isNotCollection'
  },
  'project': {
    // Only authenticated users can create projects and those
    // projects must be owned by the current user
    'create': ['isAuthenticated','useCurrentUser'],
    'destroy': ['isAuthenticated','isOwner'],
    'update': ['isAuthenticated','isOwner']
  }
};

useCurrentUser.js

module.exports = function(req, res, next) {
  // Make sure that the user specified is the current user
  if(req.query) {
    req.query.user = req.user.id;
  }
  return next();
};