       deleted: Match.Optional Boolean
       private: Match.Optional Boolean
       minimized: Match.Optional Boolean
-    unless canPost group, parent
+    user = Meteor.user()
+    unless canPost group, parent, user
       throw new Meteor.Error 'messageNew.unauthorized',
         "Insufficient permissions to post new message in group '#{group}' under parent '#{parent}'"
     root = findMessageRoot parent
-    checkPrivacy message.private, root
+    checkPrivacy message.private, root, user
     unless message.private?
       ## If root says private only, default is to be private.
       ## Otherwise, match parent.

if Meteor.isServer
  rootMessages().forEach _submessagesChanged

checkPrivacy = (privacy, root) ->
  return unless privacy?
  root = findMessageRoot root  ## can pass message or message ID
  return unless root?
  unless canSuper root.group
    switch privacy
      when true
        unless root.threadPrivacy? and 'private' in root.threadPrivacy

  else
    false

@canPost = (group, parent, user = Meteor.user()) ->
  ## parent actually ignored
  #Meteor.userId()? and
  user? and
  groupRoleCheck group, 'post', user

@canEdit = (msg) ->
  ## Can edit message if an "author" (the creator or edited in the past),
