Derby.js (Racer) access control

Question

I'm new in Derby.js environment, and as far as I see Racer is exposing all the data on client side.

So, basically anybody could manipulate any data stored on server? Am I correct? Is there any way to manage access control?

Answer 1

There is plugin for Racer - racer-access

Use it like this:

var racerAccess = require('racer-access');
derby.use(racerAccess);
store.allow('change', 'users', function (some usefull arguments) {
    return true || false;
});

Answer 2

At now racer-access is deprecated. You can use share-access.

Answer 3

It seems share-access is now deprecated in favor of sharedb-access.

Here's a related discussion on the Derby mailing list "racer-access deprecated".