如何测试依赖于用户ID的Collection.allow（）函数？

Question

鉴于以下收集和访问控制定义

class TasksCollection extends Mongo.Collection {
  insert (task, callback) {
    const doc = _.extend({}, task, {
      createdOn: new Date(),
      owner: this.userId
    })
    super.insert(doc, callback)
  }
}

export const Tasks = new TasksCollection('tasks')

// Simple checks to ensure that the user is logged in before making changes.
Tasks.allow({
  insert: (userId, doc) =>=> !!userId,
  update: (userId, doc, fields, modifier) => !!userId,
  remove: (userId, doc) => !!userId
})

你将如何测试以确保它使用Mocha / Chai / Sinon？这就是我的尝试。

import { Meteor } from 'meteor/meteor'
import { resetDatabase } from 'meteor/xolvio:cleaner';
import { assert, expect } from 'chai'
import { Tasks } from '/imports/api/tasks'
import sinon from 'sinon'

describe('collection test', () => {
  beforeEach(() => {
    resetDatabase()
  })
  it('can see a collection', () => {
    assert(Tasks, 'unable to see sample collection')
  })
  it('can query an empty collection', () => {
    expect(Tasks.find({}).fetch()).to.be.empty
  })
  it('fails to add to a collection when the user is not logged in', (done) => {
    expect(Tasks.find({}).fetch()).to.be.empty
    Tasks.insert({
      text: 'hello world'
    }, (error) => {
      console.log('expected', error) // this is also a 404
      assert(error)
      done()
    })
  })

  describe('logged in', () => {
    let sandbox
    beforeEach(() => {
      sandbox = sinon.sandbox.create()
      sandbox.stub(Meteor, 'userId').returns(42)
    })
    afterEach(() => {
      sandbox.restore()
    })
    it('can add to a collection', (done) => {
      expect(Tasks.find({}).fetch()).to.be.empty
      Tasks.insert({
        text: 'hello world'
      }, (error, _id) => {
        console.log(error)
        assert(!error)
        const results = Tasks.find({}).fetch()
        expect(results).to.have.lengthOf(1)
        expect(results[0].defaultValue).to.equal(42)
        expect(results[0]._id).to.equal(_id)
        expect(results[0].createdOn).to.not.be.undefined
        done()
      })
    })
  })
})

更新：但是在调用服务器时出现404错误。

insecure包已被删除。

更新：我现在只在客户端上进行测试，因为授权只能通过客户电话进行。