Ensure that users log in first in a Meteor application.

This works by delaying treatment of incoming DDP messages, until .setUserId() is called.

Instructions

If you would like to enforce that your application not work at all for not logged-in users, proceed as follows:

1. meteor add epfl:loginfirst
2. (optional) Whitelist any Meteor methods and subscriptions that should not be delayed, e.g.
3. ???
4. Profit!

(Step 3 may involve, you know, putting some work into your project)

How It Works

The server rejects any and all method calls and subscription requests (unless whitelisted), and rejects them promptly (i.e. no server-side DDP message reordering takes place), unless and until the user is logged in.

As far as subscriptions are concerned, the Meteor client-side runtime does subscribe to a handful of them automagically as soon as the app starts, and some of your app's widgets might do same. All of these subscriptions will get a nosub DDP response before login completes — But that is harmless, because client-side Meteor already knows to retry all subscriptions whenever the login method succeeds¹. Also, the meteor.loginServiceConfiguration subscription is whitelisted by default, which is enough to let your app display a multi-provider login widget (with server-side list of providers) if it was programmed to do so prior to enabling epfl:loginfirst.

If you need to call a DDP method before login (which should be fairly unusual), make sure to whitelist it (see above).

¹ Covered by a test in meteor/packages/accounts-base/accounts_reconnect_tests.js