OK, after realizing that I had been working with a stale cookie all day, I was able to make the server-side rest login work.
By default Meteor uses localStorage to store session information and only falls back to cookies when localStorage is not available.
The current loginToken can be retrieved via Meteor._localStorage.getItem('Meteor.loginToken')
In my test application I simply set a cookie called meteor_login_token to the value of the Meteor.loginToken
In my rest function I can then use that token to get the userId
WebApp.connectHandlers.use('/api/json/hello', (req, res, next) => {
const json = {
loginToken: null,
hashedToken: null,
userId: null,
}
console.log(`request method ${req.method}`, req.cookies);
json.loginToken = req.cookies?.meteor_login_token;
// the following code has been copied from accounts-base
// get the user
if (Meteor.users) {
// check to make sure, we've the loginToken,
if (json.loginToken) {
json.hashedToken = Accounts._hashLoginToken(json.loginToken)
var query = { 'services.resume.loginTokens.hashedToken': json.hashedToken }
var options = { fields: { _id: 1 } }
var user = Meteor.users.findOne(query, options);
if (user) {
json.userId = user._id
} else {
json.message = `/api/json/hello no user for ${json.loginToken}`;
}
} else {
json.message = `/api/json/hello meteor-login-token undefined`;
}
} else {
json.message = `/api/json/hello Meteor.users does not exist`;
}
res.writeHead(200);
res.end(`Hello world from: ${Meteor.release}` + EJSON.stringify(json, { indent: 4 }));
});