I would like to have some publications that only return the items a user has access to based on their role. I am using the alanning:roles package to handle the roles.
For instance, I have a publication like:
Meteor.publish('header_fields', function() {
console.log("header_fields: %j", this.userId);
if (Roles.userIsInRole(this.userId,['ADMIN','INSPECTOR'])) {
// Inspectors and Admins can see all header fields
return HeaderFields.find();
} else {
// Clients should only be able to see header fields for forms they have access to
var user = Meteor.users.find({_id: this.userId});
var formIds = [];
_.each(Forms.find({client_id: user.profile.client_id}).fetch(), function(form) {
this.push(form._id);
}, formIds);
return HeaderFields.find({form_id: {$in: formIds}});
}
});
The problem I am having is that, in all the examples I have seen, publications are defined in a .js file in the server folder, and thus run and get when the client first connects. However, the user isn't logged in when the client first connects initially. But, I don't know where to put these publications or how it should work.