How do I make a phone app in meteor that stores different data per person, but never asks a user to login?

Question

I really like the idea of writing an IOS/android app in meteor - but I'm not sure how to achieve what I want with the security model. Every app I want to do has the same requirement.

What I want - every user of an app implicitly logged in (ie no login screen ever) and there's a data storage specific to them. ie - it's completely impossible that data for user b is sent to user a - even if they inspected the data packets it wouldn't be there - but if the same user for instance opened the app on an iphone and then on and ipad, that data would be synced across.

Esssentially, a user is denoted by some ambient thing - eg current apple id - and almost has their own separate database, that only they can access - with real security.

Is this possible and easy in meteor?

Answer 1

Definitely possible and quite easy yes. The trick is to generate a random ID on the client that is stored in their browser/web-view. I haven't tested this on mobile, but according to MDN the web-view components on Android/iOS support localStorage .

Server:

Meteor.publish('user-data', (id) => {
  UserData.find({user: id});
});

Client:

let id = localStorage.getItem('id');
if (!id) {
  // generate a random ID
  const array = new Uint32Array(1);
  window.crypto.getRandomValues(array);
  id = array[0];
  localStorage.setItem('id', id);
}
Meteor.subscribe('user-data', id);

PS : I realize that this does not address "if the same user for instance opened the app on an iphone and then on and ipad, that data would be synced across.". For that you'd have to replace the ID you use with something that can be retrieved from the device itself. There might be cordova plugin for that. For Android, this one seems promising.