title: Ability to update collections on front-end in Meteor
body: <p>I'm struggling to get my head around the ability to edit <em>any</em> collection that's available to the front-end, and how to prevent it - and if this is a feature only available to Mongol.</p>
  
  <p>Mongol states:</p>
  
  <blockquote>
    <p>… because Mongol is a debugOnly package, it does not compile to production code.</p>
  </blockquote>
  
  <p>Which is great, but as I'm new to Meteor I'm not sure if Mongol is just an interface in this scenario, or if the ability to <code>update</code> is something always available to the front-end (and Mongol is just making it easier).</p>
  
  <p>My scenario is that I have a form submission page that grabs the profile of an associated <code>Meteor.user</code> to display their name along with the form:</p>
  
  <p><strong>HTML</strong></p>
  
  <pre><code>&lt;template name="form"&gt;
    &lt;h2&gt;Submission for: {{ user.profile.name }}&lt;/h2&gt;
    &lt;form id="brief"&gt;
      …
    &lt;/form&gt;
  &lt;/template&gt;
  </code></pre>
  
  <p><strong>Route</strong></p>
  
  <pre><code>Router.route('/form/:_id', {
  
    loadingTemplate: 'loading',
  
    waitOn: function () {
      return Meteor.subscribe('forms', this.params._id);
    },
  
    action: function () {
      this.render('form', {
        data: {
          _id: this.params._id,
          form: function() {
            return Forms.findOne({});
          },
          user: function() {
            return Meteor.users.findOne({});
          }
        }
      });
    }
  
  });
  </code></pre>
  
  <p><strong>Publication</strong></p>
  
  <pre><code>Meteor.publishComposite('forms', function(formId) {
    return {
      find: function() {
        return Forms.find({_id: formId});
      },
      children: [
        {
          find: function(form) {
            return Meteor.users.find({_id: form.userId}, {fields: {profile:1}});
          }
        }
      ]
    };
  });
  </code></pre>
  
  <p>This works perfectly - however using the Mongol console I can <code>update</code>, <code>duplicate</code> and <code>remove</code> the user. Naturally in a production environment I wouldn't want this to be possible - is this something only available because Mongol is there, or could a determined user achieve the same thing without Mongol?</p>
  
  <p>If they <em>can</em>, how do I prevent/work with it?</p>
  
  <p><strong>Edit:</strong> It's also elaborated on here: <a href="https://github.com/msavin/Mongol/blob/master/documentation/SECURITY.md" rel="nofollow">https://github.com/msavin/Mongol/blob/master/documentation/SECURITY.md</a></p>
  
  <p>Given how they refer to 'special methods' I'm assuming that's what allows this to happen, and that the ability to directly update the fields isn't ordinarily available to the front-end. If anyone's able to confirm that would be ace!</p>