CODEWITHSUNDEEP
javascriptmeteor
Matteo Saporiti
Matteo Saporiti

Reputation: 164

Meteor.user() alternatives

I am writing an application which needs to display some user information. Because Meteor.user() is not immediately available I wrapped every user information with an handlerbar helper

Handlebars.registerHelper('isLoggingIn', function() {
    return Meteor.loggingIn();
})

This worked for me until I needed to create an admin page and custom content for every user/user role. Waiting for Meteor.user() to be available or showing general information first while waiting for the roles to load are options I would like to avoid.

I then tried an alternative way and published the currentUser with a new Collection.

Meteor.publish('currentUser', function() {
    var sub = this;
    var handle = Meteor.users.find({_id: this.userId}).observe({
        added: function (user) {
            sub.added('currentUser', user._id, user);
        }
    });
    sub.ready();
    sub.onStop(function() { handle.stop(); });
});

and

CurrentUser = new Meteor.Collection('currentUser');

In this way I can access the logged in user with CurrentUser.findOne(), and it's available at the same time as the other collections.

What I fear is that this alternative is not as secure and problem free as the common Meteor.user(), and I was wondering if my method is correct and if there are better ways to obtain the same result (user detail information immediately available) without reinventing the wheel.

Upvotes: 2

Views: 369

Answers (1)

Tarang
Tarang

Reputation: 75945

Just a note you can use {{loggingIn}}, {{#if loggingIn}}.. without writing your own helper.

The option to publish the user who is logged in with a custom publish function adds an unnecessary complexity.

When it comes to security you have to assume if its from the client side, in any scenario it is untrustworthy. This means you publish relevant data for the role, etc only when they are logged in to that user.

On the server the data is immediately available as soon as the user logs in, all you have to do is publish only the data for that users role. On the client it may take some time to adjust to this, which is why you can use placeholder until the subscriptions are complete.

What might be a better option would be to use either a helper that checks for when subscriptions are completed and displays a 'loading message'. Or use a router such as iron-router (github.com/EventedMind/iron-router) that can let you wait for a subcription to complete for a particular page.

This way you can use Meteor.user(), {{#currentUser}} and roles in way you intend.

One thing to keep in mind, is if you want to check if the user is logged in, not to use:

if(Meteor.user())

but instead

if(Meteor.user() && Meteor.user().profile && Meteor.user().profile.name)

(You will have to insert a name property in your profile, though). While logging in the user gets more and more data. I've noticed if you wait for the profile field, then the user is 'ready'. It seems initially the profile field is empty (still loggin in), but it would return true if you used if(Meteor.user())

Upvotes: 2

Related Questions