match derbyAuth errback on invalidated session

src/server/store.coffee

@@ -1,3 +1,5 @@
+derbyAuth = require('derby-auth/store')
+
 ###
 Setup read / write access
 @param store
@@ -14,14 +16,18 @@ module.exports.customAccessControl = (store) ->
 userAccess = (store) ->
 
   store.readPathAccess "users.*", -> # captures, accept, err ->
+    err = arguments[arguments.length - 1]
+    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.sessionInvalidated(@)
+
     accept = arguments[arguments.length - 2]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     uid = arguments[0]
     accept (uid is @session.userId) or @session.req?._isServer
 
   store.writeAccess "*", "users.*", -> # captures, value, accept, err ->
+    err = arguments[arguments.length - 1]
+    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.sessionInvalidated(@)
+
     accept = arguments[arguments.length-2]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
     captures = arguments[0].split('.')
     uid = captures.shift()
     attrPath = captures.join('.') # new array shifted left, after shift() was run
@@ -37,14 +43,16 @@ userAccess = (store) ->
     accept(false)
 
   store.writeAccess "*", "users.*.balance", (id, newBalance, accept, err) ->
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.sessionInvalidated(@)
+
     oldBalance = @session.req?._racerModel?.get("users.#{id}.balance") || 0
     purchasingSomethingOnClient = newBalance < oldBalance
     accept(purchasingSomethingOnClient or @session.req?._isServer)
 
   store.writeAccess "*", "users.*.flags.ads", -> # captures, value, accept, err ->
-    accept = arguments[arguments.length - 1]
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
+    err = arguments[arguments.length - 1]
+    return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.sessionInvalidated(@)
+
     accept(@session.req?._isServer)
 
 
@@ -53,14 +61,14 @@ userAccess = (store) ->
   Get user with API token
 ###
 REST = (store) ->
-  store.query.expose "users", "withIdAndToken", (id, apiToken) ->
-    @where("id").equals(id)
-      .where('apiToken').equals(apiToken)
-      .limit(1)
+  store.query.expose "users", "withIdAndToken", (uid, token) ->
+    @byId(uid)
+      .where('apiToken').equals(token)
+      .one
 
-  store.queryAccess "users", "withIdAndToken", (id, apiToken, accept, err) ->
-    return accept(true) unless @session?.userId # https://github.com/codeparty/racer/issues/37
-    accept(true) # only user has id & token
+  store.queryAccess "users", "withIdAndToken", (uid, token, accept, err) ->
+    return accept(true) if uid && token
+    accept(false) # only user has id & token
 
 
 ###
@@ -90,4 +98,4 @@ partySystem = (store) ->
 
   store.writeAccess "*", "parties.*", ->
     accept = arguments[arguments.length-2]
-    accept(true)
+    accept(true)