add server-only write paths

src/server/index.coffee

@@ -29,6 +29,7 @@ derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI, safe:true}
   listen: server
+require('./store')(store) #setup custom accessControl
 
 ONE_YEAR = 1000 * 60 * 60 * 24 * 365
 root = path.dirname path.dirname __dirname

src/server/store.coffee

@@ -0,0 +1,17 @@
+###
+Setup read / write access
+@param store
+###
+module.exports = (store) ->
+
+  store.writeAccess "*", "users.*.balance", -> # captures, value, next ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    next = arguments[arguments.length - 1]
+    isServer = not @req.socket
+    next(isServer)
+
+  store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    next = arguments[arguments.length - 1]
+    isServer = not @req.socket
+    next(isServer)