lib/security/CollectionAcl.js
function(user, permission, env) {
    if (permission === 'get') {
      return this.hasPermission(user, 'find', env)
    }
    if (permission === 'patch') {
      return this.hasPermission(user, 'update', env)
    }
    if (permission === 'post') {
      // XXX: is this safe?
      if (_.isArray(env.req.body)) {
        return this.hasPermission(user, 'insert', env)
      } else {
        return this.hasPermission(user, 'insertObject', env)
      }
    }
    if (permission === 'delete') {
      return this.hasPermission(user, 'remove', env)
    }
    if (permission === 'head') {
      return this.hasPermission(user, 'find', env)
    }
    if (permission === 'options') {
      return true // XXX I think this is right
    }
    if (permission === 'put') {
      return this.hasPermission(user, 'save', env)
    }

    return _o('./EndpointAcl').prototype.hasPermission.call(this, user, permission, env)

  }
function(user, permission, env) {
    if (permission === 'get') {
      return this.hasPermission(user, 'find', env)
    }
    if (permission === 'patch') {
      return this.hasPermission(user, 'update', env)
    }
    if (permission === 'post') {
      // XXX: is this safe?
      if (_.isArray(env.req.body)) {
        return this.hasPermission(user, 'insert', env)
      } else {
        return this.hasPermission(user, 'insertObject', env)
      }
    }
    if (permission === 'delete') {
      return this.hasPermission(user, 'remove', env)
    }
    if (permission === 'head') {
      return this.hasPermission(user, 'find', env)
    }
    if (permission === 'options') {
      return true // XXX I think this is right
    }
    if (permission === 'put') {
      return this.hasPermission(user, 'save', env)
    }

    return _o('./EndpointAcl').prototype.hasPermission.call(this, user, permission, env)

  }
***************************************************************************
@method hasPermission
@description hasPermission description
@param {xxx} user -- xxx
@param {xxx} permission -- xxx
@param {xxx} env -- xxx
@returns {xxx} -- xxx