perms for bittodo

perms.js

  {
    allow: ['add', 'query'], deny: [],
    rules: {
      add: {
        //allow the call of this method only if the argument is accepted by this function.
        call: function (value) {
          return (value.type === 'task' || value.type === '_task')
        },
      query: {
        //only allow calls matching this.
        //here, "safe" is a set of helpers that make implementing perms functions easy.
        call: function (value) {
          return (
            safe.contains(value, {path: ['content', 'type'], eq: 'task'}) ||
            safe.contains(value, {path: ['content', 'type'], eq: '_task'})
          )
        },
        //a filter would check the output of the stream.
        //this should already be ensured by the call check,
        //but if we filter twice, even safer.
        filter: function (value) {
          return (value.type === 'task' || value.type === '_task')
        }
      }
    }
  }