Meteor.call() method - Meteor.js

Question

1. When to use Meteor.call() method only for client or server side request. Please advise
2. In my app Meteor.users() displays all the users in the console. How to disable this.

Answer 1

1. You should use Meteor.call() on the client side to call a server-side method. Meteor has awesome documentation about methods .

2. If Meteor.users() is returning all users on the client side, then the server is publishing all the users documents. Have you removed the meteor autopublish package ( meteor remove autopublish ) after installation?

Answer 2

1. Meteor.call()

Meteor.call() is typically used to call server-side methods from the client-side. However, you can also use Meteor.call() on the server-side to call another server-side function, though this is not recommended.

So there are two ways to use Meteor.call()

• Client to Server call (good practice)
• Server to Server call (not good practice, but it works)

Here is what the Meteor docs say, in a pinch:

This Method is callable from the client and server using Meteor.call. Note that you should only use a Method in the case where some code needs to be callable from the client; if you just want to modularize code that is only going to be called from the server, use a regular JavaScript function, not a Method.

2. Publications and Subscriptions

To make sure that your data is secure, you need to remove the autopublish and insecure packages. This will disable automatic publications of your collections, and also disallow free write access to your database from the client.

Now, in order to make sure that you are only publishing as much part of a collection as you need to, you need to set up your publications (or examine them, if they are already set up).

Publications: This is what provides your database collections from server to client.

It would look something like this, look for it in your api or server folders inside your project:

Meteor.publish('allUsers', function() {
  if (!this.userId) {
    return this.ready();
  }
  return Meteor.users.find({});
});

Notice that, in the above example, we have not provided any filter parameter in MongoDB call, so this publication will return a cursor having all users from your database.

Meteor.publish('currentUser', function() {
  if (!this.userId) {
    return this.ready();
  }
  return Meteor.users.find({
    _id: this.userId
  });
});

Now in this publication, we have provided the user _id field as a filter. So this will return a cursor for Meteor.users() having only the current user object as the available item.

Subscriptions: To access your publications, you need to correspondingly call a subscription on your client-side code, like this:

Meteor.subscribe('currentUser');

Make sure that you have not subscribed to allUsers simultaneously -- because multiple subscriptions will provide a union set of both subscriptions. So that way, you will have currentUser + allUsers = allUsers in your client-side mini-mongo. We don't want that.

After you have checked the above, you can use Meteor.users() in your client-side code (or your console) and find that it will only contain the user data of your current logged-in user.

See the official documentation for more details on Publications and Subscriptions .