AOP in Meteor

There are multiple ways for entering the Meteor application

• • • Meteor Methods RPC
    • Meteor Subscribe
    • Meteor WebApp
    • Customisation of meteor via Express/Restivus etc.

Here I will be discussing a common problem that we face.

1. 1. 1. Authorisation for each RPC and Subscribe.
      2. Whitelist of system is default in Meteor.
      3. Developer may miss on the Authorisation.
      4. Code review is tougher to scan in multiple files for authorisation.

The cross cutting concerns across the application calls for a single point of authentication as well as authorisation. This can also be extended for:

1. 1. 1. Logging.
      2. Performance monitoring.
      3. Request sanitisation etc.

Extend Meteor Methods and Publish Framework

security.js

    let authMethodConfig = {  
      'addEmployee' : ['director']
    }
    let authPublishConfig = {  
     'getEmployee' : ['director']
    }

    // get the user and check his role and permissions for RPC
    function authCheckMethod(methodName, user) {  
      let role = user ? user.role : 'guest'
      if(!(_.contains(authMethodConfig[methodName], role))){
        throw new Meteor.Error("unauthorized", "The user is not authorized");
      }
    }

    // get the user and check his role and permissions then allow him subscribe
    function authCheckPublish(publishName, userId) {  
      let user = Meteor.users.findOne({_id:userId}, {role: 1})
      let role = user ? user.role : 'guest'
      if(!(_.contains(authPublishCongig[publishName], role))){
        throw new Meteor.Error("unauthorized", "The user is not authorized");
      }
    }

    let oldMeteorMethods = Meteor.methods  
    Meteor.methods = function(methods) {  
      _.each(methods, function(func, name) {
        let newfunc = function(...args) {
          let user = Meteor.user()
          authCheckMethod(name,user)
          return func.apply(this, arguments)
        }
        let obj = {}
        obj[name] = newfunc
        oldMeteorMethods(obj)
      })
    }

    let oldMeteorPublish = Meteor.publish  
    Meteor.publish = function(name, handler, options) {  
      let newHandler = function(...args) {
        let userId = this.userId
        let self = this
        authCheckPublish(name,userId)
        return handler.apply(this, arguments)
      }
      oldMeteorPublish(name, newHandler, options)
    }

With the above code, we have introduced an additional layer of security and each method or publish information is blacklisted by default, unless we specify which role has access.

The above security.js should be part of Meteor startup folder (or one of the earliest loaded files).