MEAN Angular up-voting function throwing forbidden message - angularjs

Question

What im trying to do is create an app where users can post items and others can vote on the items similar to Reddit etc.
Problem i have is that when one user votes on an item posted by another user they get a forbidden message.
How i do i make it so that one user can modify the votes count of another users item.
This is the model for the Item
var ItemSchema = new Schema({
title: {
type: String,
default: 'NA',
required: 'Please fill Item title',
trim: true
},
link: {
type: String,
required: 'Please fill Item URL',
trim: true
},
details: {
type: String,
default: 'NA',
required: 'Please fill Item Details',
trim: true
},
votes: {
type: Number,
default: '0'
},
voters: [{
type: Schema.ObjectId,
ref: 'User'
}],
created: {
type: Date,
default: Date.now
},
user: {
type: Schema.ObjectId,
ref: 'User'
}
});
So one user should be able to increment the upvotes for another users Item.
Routes
// Items collection routes
app.route('/items').all(itemsPolicy.isAllowed)
.get(items.list)
.post(items.create);
app.route('/items/itemCount').all()
.get(items.countitems);
app.route('/items/itemCountToday').all()
.get(items.countitemsToday);
// Single item routes
app.route('/items/:itemId').all(itemsPolicy.isAllowed)
.get(items.read)
.put(items.update)
.delete(items.delete);
Upvote function
$scope.upVoteHome = function(item) {
item.votes++;
item.$update(function() {
//$location.path('items/' + item._id);
}, function(errorResponse) {
// rollback votes on fail also
$scope.error = errorResponse.data.message;
});
};
Button
<button ng-show="authentication.user" ng-click="upVoteHome(item)" type="button"
class="btn btn-danger vote-up-button"><i class="glyphicon glyphicon-arrow-up"></i> Hot</button>

Answer 1

add a 'put' permission in the routing policy
{
roles: ['user'],
allows: [{
resources: '/deals',
permissions: ['get', 'post', 'put']
}, {
resources: '/deals/:dealId',
permissions: ['get', 'put']
}]
}