Protected and restricted routes within iron-router
Create protected and user-roles restricted routes within iron-router.
For roles-restricted routes, please see meteor-roles
, you need to install meteor-roles
separately to use it.
Install:
meteor add ostrio:iron-router-protected
API:
Router.configure
and Router.route
will use next properties:
authTemplate
{String} - Name of the template to render, when access is deniedauthRoute
{String} - Route where user will be redirected, when access is deniedauthCallback
{Function} - This function will be triggered on each route, with current route-object as a context and two arguments:accessGranted
{Boolean|null} -true
if access is grantederror
{Object|null} - Object witherror
andreason
properties, if access is deniederror
-401
or403
.401
when access denied as for unauthorized user ().403
when access denied by role (Not enough rights).
Note: Don't use authTemplate
and authRoute
at the same time. If authTemplate
and authRoute
is both presented - only authTemplate
will be used and rendered.
Usage:
Create config:
1Router.configure 2 authTemplate: 'loginForm' # Render login form 3 # authRoute: '/admin/login' # Redirect to login form 4 protected: true # Deny access for unauthorized users on all routes 5 allowAccess: ['admin'] # Restrict access by role on all routes 6 authCallback: (accessGranted, error)-> 7 console.log accessGranted, error 8 layoutTemplate: '_layout' 9 notFoundTemplate: '_404' 10 loadingTemplate: 'loading'
Create protected route:
1Router.route 'admin', 2 template: 'admin' 3 path: '/admin' 4 protected: true # Deny access for unauthorized users 5 allowAccess: ['admin'] # Restrict access by role
Override default options:
1Router.route 'admin', 2 template: 'admin' 3 path: '/admin' 4 authTemplate: undefined # Do not render 5 authRoute: '/admin/login' # Redirect to login form 6 protected: true # Deny access for unauthorized users
If all routes is protected, give access to loginForm
:
1Router.route 'loginForm', 2 template: 'loginForm' 3 path: '/admin/login' 4 protected: false # Allow access to this route