title: Trouble with privileges when adding custom field to a Meteor user
body: <p>I'm having trouble adding custom user fields to a Meteor user object (<code>Meteor.user</code>). I'd like a user to have a "status" field, and I'd rather not nest it under "profile" (ie, profile.status), which I do know is r/w by default. (I've already removed <code>autopublish</code>.)</p>
  
  <p>I've been able to publish the field to the client just fine via </p>
  
  <pre><code>Meteor.publish("directory", function () {
    return Meteor.users.find({}, {fields: {username: 1, status: 1}});
  });
  </code></pre>
  
  <p>...but I can't get set permissions that allow a logged-in user to update their own <code>status</code>. </p>
  
  <p>If I do </p>
  
  <pre><code>Meteor.users.allow({
    update: function (userId) {     
      return true; 
  }});
  </code></pre>
  
  <p>in <code>Models.js,</code> a user can edit all the fields for <em>every</em> user. That's not cool.</p>
  
  <p>I've tried doing variants such as </p>
  
  <pre><code>Meteor.users.allow({
    update: function (userId) {     
      return userId === Meteor.userId(); 
  }});
  </code></pre>
  
  <p>and</p>
  
  <pre><code>Meteor.users.allow({
    update: function (userId) {     
      return userId === this.userId(); 
  }});
  </code></pre>
  
  <p>and they just get me Access Denied errors in the console. </p>
  
  <p>The <a href="http://docs.meteor.com/#meteor_users" rel="nofollow noreferrer">documentation addresses</a> this somewhat, but doesn't go into enough detail. What silly mistake am I making?</p>
  
  <p>(This is similar to <a href="https://stackoverflow.com/questions/13019529/how-to-add-fields-to-the-meteor-users-collection">this</a> SO question, but that question only addresses how to publish fields, not how to update them.)</p>