Proof that no one uses Allow/Deny

[trajano]

@sashko

The recommendation is to use ValidatedMethod and you can use a mixin to ensure login: GitHub - meteor/validated-method: Meteor methods with better scoping, argument checking, and good defaults. · GitHub

OK, just modified my boilerplate code to use ValidatedMethod. Reminds me of JEE programming where we hide direct database access and wrap everything in a DAO. Well that’s what I am more familiar with to begin with so I think that’s fine if I am wearing my security conscious hat, rather than let’s-get-the-bloody-product-out-the-door-first hat.

I looked at the guide on how it is implemented, sort of left a bit of a bad taste in my mouth though. Even the way the secret server code was implemented in the guide didn’t really seem right. So after a few iterations, I came up with something else. (I only show the example of one method, but the concept is the same for other methods)

import { Mongo } from 'meteor/mongo'
import { ValidatedMethod } from 'meteor/mdg:validated-method'
import { LoggedInMixin } from 'meteor/tunifight:loggedin-mixin'
import { SimpleSchema } from 'meteor/aldeed:simple-schema'

class TasksCollection extends Mongo.Collection {
  constructor () {
    super('tasks')
    this.insertTaskMethod = 
      new ValidatedMethod({
        name: 'tasks.insert',
        mixins: [LoggedInMixin],
        checkLoggedInError: {
          error: 'notLoggedin'
        },
        validate: new SimpleSchema({
          text: {
            type: String,
            optional: false
          }
        }).validator(),
        run: (params) => {
          super.insert(params)
        }
      })
  }
  get insertTask () {
    return this.insertTaskMethod
  }
}
export const Tasks = new TasksCollection()

When invoking, I used

Tasks.insertTask.call(this.entry, (err) => {
  if (err) {
    this.error = err
  }
  this.state.go('^.list')
})

For @Urigo This pattern should be closer to what you would need in socially.

@sashko the one thing that is annoying in the pattern is the need for .call, becauseI can’t seem to get away with return new ValidatedMethod({..}).call to just get the call function, I wonder if there’s a way around it, maybe Function.prototype.apply() or something.

Also for those who are thinking of using the same pattern I have above, if you use insert, update, delete … you won’t be able to easily change the run function on the server side like the following example of secret sever code

Tasks.insertTask.run = (params) => {
  Tasks.insert({
    text: params.text,
    createdOn: new Date()
  })
}