流星角色包-userIsInRole始终返回false

Question

I want to have a filter on routing level, checking if the user is in a specific role.

this.route('gamePage', {
    path: '/game/:slug/',
    onBeforeAction: teamFilter,
    waitOn: function() { return […]; },
    data: function() { return Games.findOne({slug: this.params.slug}); }
});

Here is my filter:

var teamFilter = function(pause) {
    if (Meteor.user()) {
        Meteor.call('checkPermission', this.params.slug, Meteor.userId(), function(error, result) {
            if (error) {
                throwError(error.reason, error.details);
                return null;
            }
            console.log(result); // returns always false
            if (!result) {
                this.render('noAccess');
                pause();
            }
        });
    }
}

In my collection:

checkPermission: function(gameSlug, userId) {
        if (serverVar) { // only executed on the server
            var game = Games.findOne({slug: gameSlug});
            if (game) {
                if (!Roles.userIsInRole(userId, game._id, ['administrator', 'team'])) {
                    return false;
                } else {
                    return true;
                }
            }
        }
    }

My first problem is that Roles.userIsInRole(userId, game._id, ['administrator', 'team'] always returns false. At first, I had this code in my router.js , but then I thought that it does not work because of a missing publication/subscription, so I ensured that the code runs only on the server. I checked the database and the user is in the role.

My second problem is that I get an exception ( Exception in delivering result of invoking 'checkPermission': http://localhost:3000/lib/router.js?77b3b67967715e480a1ce463f3447ec61898e7d5:14:28 ) at this point: this.render('noAccess'); and I don't know why.

I already read this: meteor Roles.userIsInRole() always returning false but it didn't solve my problem.

Any help would be greatly appreciated.

Answer 1

In teamFilter hook you call Meteor.method checkPermission which works asynchronously and OnBeforeAction expects synchronous execution ( no callbacks ). That is why you always receive false.

Another thing is that you are using Roles.userIsInRole incorrectly:

Should be:

Roles.userIsInRole(this.userId, ['view-secrets','admin'], group)

In this case I would check roles on client side:

Roles.userIsInRole(userId, ['administrator', 'team'])

Probably you are worried about security with this solution. I don't think you should. What is the most important is data and data is protected by publish function which should check the roles.

Please note that all templates are accessible to client.

Answer 2

You can add roles to the user only on server for that you can user Meteor.call({}); check here method from client to call method on server's main.js and you can check after this method call if the role is added in users collection using meteor mongo and db.users.find({}).pretty() and see if the roles array is added the user of that usedId then you can use Roles.userIsInRole() function anywhere on client to check loggedin users role.