I have a simple flow in my app where a user can invite another user to their entity. This collection is Private, and seems to be pulling data properly. The way I'm doing the adding in custom business logic is as follows:



{

$addToSet: {

'_acl.r': user._id,

'_acl.w': user._id

}

}



This works, and if I do a query from the API console, I can see the user is properly added.



"_acl": {

"creator": "537fac5d36c22ce06500592e",

"r": [

"53939c78e4c028b94402ee4b"

],

"w": [

"53939c78e4c028b94402ee4b"

]

}



When I make the call to get all entities from the client (from the logged in user added to the _acl), nothing comes back. I know when you add to ACL from the client you need to resave - is this similar for the backend? Not sure what I'm doing wrong here.

Re-fetching and re-saving the client seems to do the trick, but why should I have to do that? Is there a method to "save" the entity from BL? Seems weird.



This seems to be a fairly large issue for us doing _acl stuff on the server.



EDIT: To propagate the changes to the _acl, I needed to make a PUT request from the server for the entity.

Can I get an official response on this? This seems like a fundamental flaw in the design of the backend? I know we're dealing with raw mongo data here, but is there a better way to do this? Nothing documented about this behavior.

Hi Dave,



ACLs take UserIDs in string format, but the data returned from a mongo _id field (such as user._id) is in the BSON ObjectID format. To properly populate the acl, you should call user._id.toString() in your BL code so it should look like:



```

{

$addToSet: {

'_acl.r': user._id.toString(),

'_acl.w': user._id.toString()

}

}

```



Let me know if this works for you and if you need anything else.