{"action":"opened","issue":{"url":"https://api.github.com/repos/aldeed/meteor-autoform/issues/1290","labels_url":"https://api.github.com/repos/aldeed/meteor-autoform/issues/1290/labels{/name}","comments_url":"https://api.github.com/repos/aldeed/meteor-autoform/issues/1290/comments","events_url":"https://api.github.com/repos/aldeed/meteor-autoform/issues/1290/events","html_url":"https://github.com/aldeed/meteor-autoform/issues/1290","id":116471307,"number":1290,"title":"Security with custom pub","user":{"login":"rafaelcorreiapoli","id":12840136,"avatar_url":"https://avatars.githubusercontent.com/u/12840136?v=3","gravatar_id":"","url":"https://api.github.com/users/rafaelcorreiapoli","html_url":"https://github.com/rafaelcorreiapoli","followers_url":"https://api.github.com/users/rafaelcorreiapoli/followers","following_url":"https://api.github.com/users/rafaelcorreiapoli/following{/other_user}","gists_url":"https://api.github.com/users/rafaelcorreiapoli/gists{/gist_id}","starred_url":"https://api.github.com/users/rafaelcorreiapoli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rafaelcorreiapoli/subscriptions","organizations_url":"https://api.github.com/users/rafaelcorreiapoli/orgs","repos_url":"https://api.github.com/users/rafaelcorreiapoli/repos","events_url":"https://api.github.com/users/rafaelcorreiapoli/events{/privacy}","received_events_url":"https://api.github.com/users/rafaelcorreiapoli/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-12T03:20:20Z","updated_at":"2015-11-12T03:20:20Z","closed_at":null,"body":"Hi! thanks for the awesome package! I have a question, I would like to know the best practice to protect my app, lets say I have this custom pub that is being used by one of my Tabular Tables\r\n```\r\nMeteor.publishComposite('tabular_CargosList', function(tableName, ids, fields) {\r\n  check(tableName, String);\r\n  check(ids, Array);\r\n  check(fields, Match.Optional(Object));\r\n  this.unblock();\r\n  return {\r\n    find() {\r\n      this.unblock();\r\n      if (!this.userId || !Roles.userIsInRole(this.userId, ['admin', 'god'])) {\r\n        return false;\r\n      }\r\n\r\n      return Cargos.find({_id: {$in: ids}}, {fields: fields});\r\n    },\r\n    children: [\r\n      {\r\n        find(cargo) {\r\n          this.unblock();\r\n          return Areas.find({_id: cargo.areaId}, { fields: { nome: 1}});\r\n        },\r\n      },\r\n      {\r\n        find(cargo) {\r\n          return Carreiras.find({_id: cargo.carreiraId}, {fields: {nome: 1}});\r\n        },\r\n      },\r\n    ],\r\n  };\r\n});\r\n```\r\n\r\n\r\nLet's say I have a field on the collection called \"secret\" and it must not be published to anyone\r\nThe logic to prevent people from subscribing to that secret field must be on the pub?\r\nWhat about the allowFields on the Tabular instance?\r\nI'm thinking that just by putting the logic inside allowFields, the pub will still be available to anyone who wants to see the secret field, by subscribing to it and passing the last parameter as {secret:1}\r\n\r\nCould you guys help me out ?\r\n\r\nThanks!"}}