Expose Meteor user context to Express endpoints

[trusktr]

@nachocodoner

import { WebApp } from 'meteor/webapp';
import { createAuthMiddleware } from 'meteor/accounts-express';

// Apply auth middleware to /api routes
WebApp.handlers.use('/api', createAuthMiddleware());

// Protected endpoint under /api
WebApp.handlers.use('/api/users', async (req, res) => {
  try {
    // User context is available
    console.log('Authenticated user ID:', Meteor.userId(), req.userId);
    console.log('Authenticated user:', await Meteor.userAsync());

    if (!Meteor.userId()) {
      res.status(401).json({ error: 'Unauthorized' });
      return;
    }

This is not working. I’m on 3.5-beta.10. Both Meteor.userId() and await Meteor.userAsync() return null, but I am definitely logged in (the regular app at the index route works fine, I see features available only when logged in).

EDIT: Ah, because accessing the endpoint via browser address bar does not use auth tokens. The new Meteor.fetch(url, {auth: true}) in Meteor 3.5 does the trick: I can fetch an endpoint from the client code using auth to download the DB.