Here you are combining permission check with update itself. While doable, it is probably better to split this so that. But it is true that groups themselves are not yet part of permissions framework so this can be for now.

See here an example: https://github.com/peerlibrary/peerlibrary/blob/master/server/lib/access.coffee#L94