title: Cannot set correct edit permissions in Meteor.methods
body: <p>I'm trying to set permissions for add, edit and delete through my Meteor methods.
  I'm working on a calendar that users can add events to and there events are visible to all, but an event can only be updated or removed by the event owner. </p>
  
  <p>So far I have it to where only the logged in users can insert items and when it's inserted a <code>createdBy:currentUserId</code> value is assigned, but after an item is inserted I want it to be setup to where only the user that created the event can update or remove it. This should come from the <code>createdBy</code> value that is stored when the item is created</p>
  
  <p>I've read through the documentation but still can't get this to work. In my methods I have been setting a var with <code>var currentUserId = Meteor.userId();</code> and I have been trying to restrict edits and deletes through the method with <code>if({createdBy: currentUserId}) {allow edit and delete here}</code></p>
  
  <p>Everything I have tried so far does not prevent other users from deleting or editing other users events.</p>
  
  <p>I'm only posting the code that's relevant to edit as i'm assuming edit and delete will be almost identical. I am very new to Meteor, so any and all help is appreciated!</p>
  
  <p>UPDATE! I'm trying to switch my <code>createdBy</code> into my method like @Yann recommended, but it will not allow the user ID to be placed and just returns an error of <code>createdBy</code> is required . The code I'm trying is</p>
  
  <pre><code>Meteor.methods({
    addEvent( event ) {
      var currentUserId = Meteor.userId();
      var createdBy = currentUserId;
      check( event, {
  
        title: String,
        start: String,
        end: String,
        type: String,
        guests: Number
      });
  
      try {
        return Events.insert( event, {
          $set: createdBy
        });
      } catch ( exception ) {
        throw new Meteor.Error( '500', `${ exception }` );
      }
    }
  });
  </code></pre>
  
  <p>END OF UPDATE</p>
  
  <p>The add edit modal code </p>
  
  <pre><code>Template.addEditEventModal.events({
    'submit form' ( event, template ) {
      event.preventDefault();
      var currentUserId = Meteor.userId();
  
  
      let eventModal = Session.get( 'eventModal' ),
          submitType = eventModal.type === 'edit' ? 'editEvent' : 'addEvent',
          eventItem  = {
             createdBy: currentUserId,
            title: template.find( '[name="title"]' ).value,
            start: template.find( '[name="start"]' ).value,
            end: template.find( '[name="end"]' ).value,
            type: template.find( '[name="type"] option:selected' ).value,
            guests: parseInt( template.find( '[name="guests"]' ).value, 10 )
          };
  
      if ( submitType === 'editEvent' ) {
        eventItem._id   = eventModal.event;
      }
  
      Meteor.call( submitType, eventItem, ( error ) =&gt; {
        if ( error ) {
          Bert.alert( error.reason, 'danger' );
        } else {
          Bert.alert( `Event ${ eventModal.type }ed!`, 'success' );
          closeModal();
        }
      });
    },
     'click .delete-event' ( event, template ) {
      let eventModal = Session.get( 'eventModal' );
      if ( confirm( 'Are you sure? This is permanent.' ) ) {
        Meteor.call( 'removeEvent', eventModal.event, ( error ) =&gt; {
          if ( error ) {
            Bert.alert( error.reason, 'danger' );
          } else {
            Bert.alert( 'Event deleted!', 'success' );
            closeModal();
          }
        });
      }
    }
  });
  </code></pre>
  
  <p>The update method</p>
  
  <pre><code>Meteor.methods({
  
    editEvent( event ) {
  
      check( event, {
        _id: String,
        createdBy: String,
        title: Match.Optional( String ),
        start: String,
        end: String,
        type: Match.Optional( String ),
        guests: Match.Optional( Number )
      });
      var currentUserId = Meteor.userId();
    if({createdBy: currentUserId}){
      try {
        return Events.update( event._id, {
          $set: event
        });
      } catch ( exception ) {
        throw new Meteor.Error( '500', `${ exception }` );
      }
    }
  }
  });
  </code></pre>