[bug] Article edit/remove buttons ng-show logic uses user._id

[mleanos]

This line, in the Article edit view, is attempting to validate if the current User is the owner of the Article being edited. Since we're not storing the User's _id field on the client-side User object any longer, it cannot evaluate properly.

To reproduce this...

1. Login with a User that has created Article(s) (or create an Article after log in).
2. Go to an article that the user owns and you'll see that the edit & remove buttons are present
3. Do a hard refresh of the browser (Ctrl+F5), and you'll see the button are now gone

I know the decision to remove the _id field from the client-side User object was intentional, for security reasons. I'm unclear as to the exact implications of having the _id field; can someone shed light on that for me?

A simple, but hackish way of fixing this would be to compare the User's username field, with the Articles user.username field; which means we'd have to populate the latter on the Article object when we retrieve it from the database.

A better solution that comes to mind is to handle the validation in the controller, by retrieving the User's info from the back-end & then setting a property on the view model (vm) that specifies if they own the document. This option requires more changes than the simple solution I described above, but is probably better practice.
Something like this..

function isArticleOwner() {
  // we need to load the user from the backend somehow
  // maybe, with a resolve User in the client route config
  if (user._id.toString() === article.user._id.toString()) {
    return true;
  } else {
    return false;
  }
}

Any ideas?