From 590fa1669c4cf79b796ccc3f798f429c29afd7c8 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Fri, 25 Jan 2013 14:18:17 -0500
Subject: [PATCH] add server-only write paths

---
 src/server/index.coffee |  1 +
 src/server/store.coffee | 17 +++++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 src/server/store.coffee

diff --git a/src/server/index.coffee b/src/server/index.coffee
index 333ab60b3b..1d8e478074 100644
--- a/src/server/index.coffee
+++ b/src/server/index.coffee
@@ -29,6 +29,7 @@ derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI, safe:true}
   listen: server
+require('./store')(store) #setup custom accessControl
 
 ONE_YEAR = 1000 * 60 * 60 * 24 * 365
 root = path.dirname path.dirname __dirname
diff --git a/src/server/store.coffee b/src/server/store.coffee
new file mode 100644
index 0000000000..69d8567e70
--- /dev/null
+++ b/src/server/store.coffee
@@ -0,0 +1,17 @@
+###
+Setup read / write access
+@param store
+###
+module.exports = (store) ->
+
+  store.writeAccess "*", "users.*.balance", -> # captures, value, next ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    next = arguments[arguments.length - 1]
+    isServer = not @req.socket
+    next(isServer)
+
+  store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    next = arguments[arguments.length - 1]
+    isServer = not @req.socket
+    next(isServer)
\ No newline at end of file