import { Meteor } from 'meteor/meteor';
import { ValidatedMethod } from 'meteor/mdg:validated-method';
import SimpleSchema from 'simpl-schema';
import rateLimit from '/imports/lib/rate-limit';
import Documents from './documents';

export const upsertDocument = new ValidatedMethod({
  name: 'documents.upsert',
  validate: new SimpleSchema({
    _id: { type: String, optional: true },
    title: { type: String, optional: true },
    body: { type: String, optional: true },
  }).validator(),
  run(document) {
    if (!this.userId) {
      throw new Meteor.Error('documents.upsert.notLoggedIn',
        'Must be logged in to upsert documents.');
    }

    const data = document;
    data.createdAt = new Date();
    data.userId = this.userId;

    return Documents.upsert({ _id: document._id }, { $set: data });
  },
});

export const removeDocument = new ValidatedMethod({
  name: 'documents.remove',
  validate: new SimpleSchema({
    _id: { type: String },
  }).validator(),
  run({ _id }) {
    if (!this.userId) {
      throw new Meteor.Error('documents.remove.notLoggedIn',
        'Must be logged in to remove documents.');
    }

    const document = Documents.findOne(_id);

    if (document.userId !== this.userId) {
      throw new Meteor.Error('documents.remove.accessDenied',
        'You don\'t have permission to remove this document.');
    }

    Documents.remove(_id);
  },
});

rateLimit({
  methods: [
    upsertDocument,
    removeDocument,
  ],
  limit: 5,
  timeRange: 1000,
});

@@ -638,32 +638,224 @@
 ents.');%0A    %7D%0A%0A
+    if (document._id && document.userId !== this.userId) %7B%0A      throw new Meteor.Error('documents.upsert.accessDenied',%0A        'You don%5C't have permission to update this document.');%0A    %7D%0A%0A
     const data =
@@ -865,16 +865,44 @@
 cument;%0A
+%0A
+    if (!document._id) %7B%0A  
     data
@@ -926,24 +926,26 @@
 Date();%0A    
+ 
+ 
 data.userId 
@@ -958,16 +958,22 @@
 .userId;
+%0A    %7D
 %0A%0A    re

Update upsertDocument method