Meteor.user() isn't ready in triggersEnter function when user clicks on bookmarked link

I want to turn off access to a bunch of admin routes if the user is not logged in or doesn’t have sufficient priveledges. I’ve got it working in most instances using a FlowRouter group and triggersEnter. However, I’m having a problem in the below code.

// Admin routes group
const adminRoutes = FlowRouter.group({
  prefix: '/admin',
  name: 'admin',
  triggersEnter: [(context, redirect) => {
    if (!Meteor.user() || Meteor.user().username !== 'admin') {
      redirect('/not-authorized');
    }
  }],
});

It works perfectly in all situations except when:

• The client refreshes, or
• The goes to the route by clicking a saved link (ie bookmark or email etc)

The problem seems to be that Meteor.user() isn’t available yet when the trigger runs. I’ve experimented with different Tracker autorun options but they don’t seem to work.

I’ve created a repro here: https://github.com/proehlen/admin-pages-route-group-redirect.

Relevant code is in /imports/startup/client/routing.js starting at line 28.

[KaitaniLabs]

There is a pretty simple solution to this which I’m using:

// Logged In Routes Group
loggedInRoutes = exposedRoutes.group({
  prefix: '',
  name: 'loggedIn',
  triggersEnter: [function(context, redirect) {
    if(!Meteor.loggingIn() && !Meteor.userId()){
      let route = FlowRouter.current();
      if(route.route.name !== "Login"){
        Session.set("redirectAfterLogin",route.path);
        redirect('/login');
      }
    }
  }]
});

// Admin Routes Group (extends Logged In Routes)
adminRoutes = loggedInRoutes.group({
  prefix: '/admin',
  name: 'admin'
});

// Example Admin Route
adminRoutes.route('/dashboard', {
  name: "AdminDashboard",
  action: function () {
    BlazeLayout.render('AdminLayout', {topbar: 'AdminTopbar',content: 'AdminDashboard'});
  }
});

// AdminLayout is a layout template, but it is still a template so use the onCreated hook
Template.AdminLayout.onCreated(function() {
  const instance = this;
  instance.autorun(function () {
    var subscription = instance.subscribe('userData');
    if (subscription.ready()) {
      /**
       * Do your check here for access
       * E.g. if(user doesn't have access){FlowRouter.go("Some route for non-admins");}
       */
    }
  });
});

// AdminLayout Template
<template name="AdminLayout">
  {{#if Template.subscriptionsReady}}	
    {{>Template.dynamic template=topbar}}
    {{>Template.dynamic template=content}}
  {{else}}
{{> Loading}}
  {{/if}}
</template>

// Publish userData
Meteor.publish("userData",function(){
  if(this.userId){
    return Meteor.users.find({_id : this.userId});	
  }else{
    this.ready();
  }
});

This removes subscriptions from the Router making it do what it’s supposed to do and nothing more. Since all of your admin templates will use the same layout (or at least they probably should) the above code will work for any new admin routes you add to an app so long as the layout is ‘AdminLayout’.

Because Admin Routes group extends LoggedIn Routes group the triggersEnter get used automatically. So there is no need to check for Meteor.loggingIn() or Meteor.userId() in the Admin Routes group.

Hope that helps 😃

[proehlen]

I’ve moved on since the issue was raised to another platform for the project that prompted it so closing this issue. Thanks @Allerion for posting your work around. I’m sure it will come in handy for others facing this problem.