Wednesday, 7 August 2013

Is it possible to determine if a Meteor method was called by the server

Is it possible to determine if a Meteor method was called by the server

I have some Meteor methods and I want to secure them so that only certain
users can call them from the client. However these methods are also used
by the server. I am passed the userid in this.userid so I can check if the
user is logged in and if they are allowed to make the call, no problem.
But when I also need to call the method from the server side how do I
determine that it was a server call so I can allow the method execution.
Checking that there is no this.userid to determine if its a server call
allows un-authenticated users to call the method as well. I am looking for
a way to determine if the method was called by the server so I can allow
it and still prevent un-authenticate users from calling the method.
Meteor.methods({
makeCoffee: function (time) {
check(arg1, Number);
if(calledByServer || (Meteor.user() && Meteor.user().profile.usertype
=== 'coffee dude')){
//Makin' Coffee
}
else
throw new Meteor.Error(404, "Can't find my pants");
return "Coffee will be made at " + time;
}

No comments:

Post a Comment