Don't run autoValue or defaultValue when field will be denied

[tylercrompton]

Consider the following example:

const postSchema = new SimpleSchema({
  title: {
    type: String
  },
  content: {
    type: String
  },
  createdAt: {
    type: Date,
    autoValue: function () {
      return new Date();
    },
    denyUpdate: true
  }
});

const Posts = new Mongo.Collection('posts');
Posts.attachSchema(postSchema);

const postId = Posts.insert({title: 'Hello', content: 'World'});
Posts.update({_id: postId}, {content: 'Earth'});

The last line causes an error that vaguely says the the createdAt property is invalid, which leads one to believe that the issue relates to the type, value, or something similar--not the implicit addition of the property. I spent about an hour trying to figure out why my data wasn't passing validation.

One workaround is to construct the autoValue method as follows:

function () {
  if (this.isInsert) {
    return new Date();
  }
}

However, if I wanted to do it that way, I might as well just throw an error when the property was explicitly defined outside of an insertion operation, which obviously defeats the purpose of this package.

Personally, I wouldn't expect autoValue to be called during an update operation when denyUpdate is set to true. I can't conceive of any reasonable use cases in which such behavior would be desirable.

[achirkof]

Hi @tylercrompton ! I have same problem. And also spent an hour trying to understand what's wrong.

[aldeed]

Since this is an add-on package, we can't prevent autoValue from running. The workaround of checking isInsert is the right way to do it, but it doesn't solve the issue for defaultValue. I will leave this open in case anyone can figure out an elegant solution, but this is one of the reasons that I don't personally use or recommend using denyInsert or denyUpdate. There are better ways to handle security.

[crapthings]

@aldeed

if dont write allow deny rule in methods

is it good to do insert update remove by checking permission inside before hook ?

[aldeed]

@crapthings You could use before hooks or a package like https://github.com/reactioncommerce/meteor-security.