title: meteor allow rules
body: <p>I have a question on meteor's parties example.</p>
  
  <p>If I call this code:</p>
  
  <pre><code>Parties.allow({
  insert: function () {
      return true;
  },
  
  remove: function (){
      return true;    
  },
  
  update: function() {
      return true;    
  }
  
  });
  </code></pre>
  
  <p>everybody can do insert, remove and update.
  The code from the example is</p>
  
  <pre><code>Parties.allow({
   insert: function (userId, party) {
      return false; // no cowboy inserts -- use createPage method
   },
   update: function (userId, parties, fields, modifier) {
      return _.all(parties, function (party) {
      if (userId !== party.owner)
         return false; // not the owner
  
    var allowed = ["title", "description", "x", "y"];
    if (_.difference(fields, allowed).length)
      return false; // tried to write to forbidden field
  
    // A good improvement would be to validate the type of the new
    // value of the field (and if a string, the length.) In the
    // future Meteor will have a schema system to makes that easier.
       return true;
     });
   },
   remove: function (userId, parties) {
     return ! _.any(parties, function (party) {
       // deny if not the owner, or if other people are going
       return party.owner !== userId || attending(party) &gt; 0;
     });
   }
  });
  </code></pre>
  
  <p>So my question is where the variables useriD and party at this line for example</p>
  
  <pre><code> insert: function (userId, party) {
  </code></pre>
  
  <p>are defined?
  Are these the variables I call in the method </p>
  
  <pre><code> Meteor.call("createParty", variable1, variable2)
  </code></pre>
  
  <p>? But this wouldn't make sense because the client calls</p>
  
  <pre><code> Meteor.call('createParty', {
      title: title,
      description: description,
      x: coords.x,
      y: coords.y,
      public: public
    }
  </code></pre>
  
  <p>I hope somebody can explain the allow functions to me? Thanks!</p>