       catch e
     user
 
+  allowOwner: (userId, doc) -> @isOwnerOrAdmin(doc, userId)
+
+  setUpCollectionAllow: (collection) ->
+    allowOwner = @allowOwner.bind(@)
+    collection.allow
+      insert: (userId, doc) -> userId?
+      update: allowOwner
+      remove: allowOwner
+
 # Set up role publications.
 
 if Meteor.isServer

          if options.userSelector
            selector = options.userSelector(userId: userId, user: user, username: username)
          else
            selector = {author: username}
          collection.find(selector)

    # Add the logged in user as the author when a doc is created in the collection.
    collection.before.insert (userId, doc) ->
      doc.author = Meteor.users.findOne(userId)?.username
  
  isOwner: (doc, user) ->
    user = @_resolveUser(user)
    doc.author == user.username

  authorize: (doc, user, predicate) ->
    user = @_resolveUser(user)
    if predicate
      result = predicate(doc, user)
    else
      result = @isOwner(doc, user) || @isAdmin(user)
    unless result
      throw new Meteor.Error(403, 'Access denied')

  isAdmin: (user) ->

AccountsUtil =

  AUTHOR_FIELD: 'author'

  addCollectionAuthorization: (collection, options) ->
    options = _.extend({
    }, options)
    AUTHOR_FIELD = @AUTHOR_FIELD
    if Meteor.isServer
      name = Collections.getName(collection)
      # Only publish documents belonging to the logged in user.
