Unexpected publishing of all user records. about meteor-roles HOT 7 CLOSED

Hi Juan, thanks for the report. I just tried with the example roles app and it doesn't seem to exhibit this behavior. Could you please double-check that nothing else in your app that is publishing the user data?

Here's an online version of the example app: http://roles.meteor.com/

While not signed in, if you open the console and enter Meteor.users.find().fetch() you will see an empty array as the result.

Meteor.users.find().fetch()
-> []

from meteor-roles.

Hey Alan, Yes, indeed if you run Meteor.users.find(), it will report only one user. But that's not the case that I'm referring to. I'm talking about the times that publish is called with an undefined user. This happens multiple times. Try the following snippet of code inserted in the server code to see that publish is called with an undefined user.

The reason that Meteor.users.find() reports only one user is that a subsequent publish with a defined userId is triggered soon after, thus restoring the single user case by the time you have the chance to type that query.

See the attached code below out of accounts-base. You will see that they guard against the undefined user case.

Thanks!
-Juan

// Report when publish is called with undefined user.
Meteor.publish(null, function () {
  var userId = this.userId;
  if (!userId) {
    //console.log("Publish invoked with undefined userId!");
    throw Error ("Publish invoked with undefined userId! (Benign. Debugging.)");
  }
  return undefined;
});

Code from accounts-base showing guard for undefined user:

https://github.com/meteor/meteor/blob/devel/packages/accounts-base/accounts_server.js

// Publish the current user's record to the client.
Meteor.publish(null, function() {
  if (this.userId) {
    return Meteor.users.find(
      {_id: this.userId},
      {fields: {profile: 1, username: 1, emails: 1}});
  } else {
    return null;
  }
}, /*suppress autopublish warning*/{is_auto: true});

from meteor-roles.

Actually I think you misunderstood my comment. I'm trying to reproduce the issue of all users being published but if you run the example app without signing in, it does not publish all users, even though this.userId is not set.

Can you put together a simple repro that illustrates the problem, please?

from meteor-roles.

Hey Alan, Sorry, I can't seem to reproduce. I inserted the publish code above into the party example and I do indeed see it invoked multiple times with this.userId==undefined. However, a Meteor.users.find({_id:userId}) inserted in that code returns an empty cursor. Not sure now why I had concluded earlier that it was returning otherwise. (And it looks like the guard in accounts_server.js is unnecessary.) Sorry for the confusion.

from meteor-roles.

No worries. I've had many instances where I thought one thing was the issue but a repro ended up identifying something else.

Since it is still happening in your app, I'd suggest commenting out your publish functions and adding them back in one-at-a-time and see if that helps track it down. May also be something re: Allow/Deny rules if you have any on users.

Closing for now. Feel free to re-open if it does turn out to be something in Roles.

from meteor-roles.

Hey Alan, To be clear, the extra publish invocations with undefined user are not specific to my app. They happen in the Parties app too. There's some extra triggering that happens in Meteor.

from meteor-roles.

Understood. I was referring to the sending of user data to the client even
when this.userId is unset. (Although perhaps I misunderstood your
original bug report and you just meant that the publish function itself was
being triggered when you weren't expecting it?)

FYI, the triggering of the publish function is expected behavior. When the
name argument is null the publish func will be run immediately for all
connected clients. It will run again whenever the logged in user changes.

On Tue, Aug 5, 2014 at 5:28 PM, Juan Pineda [email protected]
wrote:

Hey Alan, To be clear, the extra publish invocations with undefined user
are not specific to my app. They happen in the Parties app too. There's
some extra triggering that happens in Meteor.

—
Reply to this email directly or view it on GitHub
#47 (comment)
.

from meteor-roles.