{"action":"closed","issue":{"url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/203","labels_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/203/labels{/name}","comments_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/203/comments","events_url":"https://api.github.com/repos/jagi/meteor-astronomy/issues/203/events","html_url":"https://github.com/jagi/meteor-astronomy/issues/203","id":118717694,"number":203,"title":"Does a Model take into account its Collection.allow?","user":{"login":"adriano-di-giovanni","id":3408372,"avatar_url":"https://avatars.githubusercontent.com/u/3408372?v=3","gravatar_id":"","url":"https://api.github.com/users/adriano-di-giovanni","html_url":"https://github.com/adriano-di-giovanni","followers_url":"https://api.github.com/users/adriano-di-giovanni/followers","following_url":"https://api.github.com/users/adriano-di-giovanni/following{/other_user}","gists_url":"https://api.github.com/users/adriano-di-giovanni/gists{/gist_id}","starred_url":"https://api.github.com/users/adriano-di-giovanni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adriano-di-giovanni/subscriptions","organizations_url":"https://api.github.com/users/adriano-di-giovanni/orgs","repos_url":"https://api.github.com/users/adriano-di-giovanni/repos","events_url":"https://api.github.com/users/adriano-di-giovanni/events{/privacy}","received_events_url":"https://api.github.com/users/adriano-di-giovanni/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/jagi/meteor-astronomy/labels/bug","name":"bug","color":"c80000"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-24T22:30:11Z","updated_at":"2015-11-25T15:34:19Z","closed_at":"2015-11-25T15:34:19Z","body":"I have a local collection\r\n\r\n```javascript\r\nBalanceCollection = new Mongo.Collection(null);\r\n\r\nBalanceCollection.allow({\r\n  insert: function () {\r\n    return true;\r\n  },\r\n  update: function () {\r\n    return true;\r\n  },\r\n  remove: function () {\r\n    return true;\r\n  },\r\n});\r\n```\r\n\r\nand an Astronomy model\r\n\r\n```javascript\r\nBalanceModel = Astro.Class({\r\n  name: 'Balance',\r\n  collection: BalanceCollection,\r\n  transform: null,\r\n  fields: {\r\n    issuerId: {\r\n      type: 'string',\r\n      validator: Validators.required(),\r\n    },\r\n    holderId: {\r\n      type: 'string',\r\n      validator: Validators.required(),\r\n    },\r\n    balance: {\r\n      type: 'number',\r\n      'default': 0,\r\n      validator: Validators.and([\r\n        Validators.required(),\r\n        Validators.gte(0),\r\n      ]),\r\n    },\r\n  },\r\n});\r\n```\r\n\r\nI also have a Tracker\r\n\r\n```javascript\r\nif (Meteor.isClient) {\r\n  Tracker.autorun(function () {\r\n    let userId = Meteor.userId();\r\n    let voucherArray = VoucherCollection.find({ issuerId: userId }).fetch();\r\n    _(voucherArray).each(function (voucher) {\r\n      let selector = {\r\n        issuerId: voucher.issuerId,\r\n        holderId: voucher.holderId,\r\n      };\r\n      let modifier = {\r\n        $inc: {\r\n          balance: voucher.value,\r\n        },\r\n      };\r\n      BalanceModel.upsert(selector, modifier);\r\n    });\r\n  });  \r\n}\r\n```\r\n\r\nDespite the fact that BalanceCollection allows any operation, I get the client error `Not permitted. Untrusted code may only update documents by ID`.\r\n\r\nEverything works if I replace `BalanceModel.upsert(selector, modifier)` with `BalanceCollection.upsert(selector, modifier)`.\r\n\r\nMy question is: does a Model take into account its Collection allow?\r\n\r\nThanks in advance,\r\nAdriano"}}