Allow/deny rules for `run`

[Slava]

trafficstars

Currently the RPC end-point /mytable/run doesn't check any permissions.

[rclai]

Did this get done? Where is the code?

[Slava]

The ticket is still open. So the answer is "no".

[rclai]

Oh it was just weird seeing the Feature complete milestone. Made it seem like it was complete. But have you worked on it?

[Slava]

"feature-complete" means a stage of a project where all core features are implemented but the project might be lacking documentation, or some release engineering work pending.

[sircharleswatson]

What would be the best way to prevent client side edits? I'm playing with Rethink in consideration for using it on a project and was wondering how the security stuff is at the moment.

(Edit: We're really excited to potentially use Rethink)

[ramezrafla]

@Slava, If we wanted to implement allow / deny, would we do it inside: https://github.com/Slava/meteor-rethinkdb/blob/master/rethink.js:

methods[self._prefix + 'run'] = function (builtQuery, generatedKeys) {