Placement of Code in Plugin for hooking `save_post`

I’m not sure if

if( !current_user_can( 'edit_post', $post_id ) ) return;

really works. Maybe the current user isn’t set up there and you’ll have to work around it by passing the user ID in a hidden field, then retrieving it using

$user = get_user_by( 'id', esc_attr( $_POST['user_id'] ) );
wp_set_current_user( $user->user_id );
if ( ! current_user_can( 'edit_post', $post_id )
    wp_die( 'Not allowed' );