Ensure that users log in first in a Meteor application.

This works by blocking client DDP messages (for method calls and subscriptions), until .setUserId() is called.

If you would like to enforce that your application not work at all for not logged-in users, proceed as follows:

1. meteor add epfl:loginfirst
2. (optional) Whitelist any Meteor methods and subscriptions that should not be delayed, e.g.

   import LoginFirst from 'meteor/epfl:loginfirst'
   LoginFirst.whitelist.methods.append("myInnocuousMethodThatIsSoImportantThatItCannotWaitForTheUserToLogInFirst")
   LoginFirst.whitelist.subscriptions.append("dittoForSubscription")
   

3. ???
4. Profit!

(Step 3 may involve, you know, putting some work into your project)

The server rejects any and all method calls and subscription requests (unless whitelisted), and rejects them promptly (i.e. no server-side DDP message reordering takes place), unless and until the user is logged in.

As far as subscriptions are concerned, the Meteor client-side runtime does subscribe to a handful of them automagically as soon as the app starts, and some of your app's widgets might do same. All of these subscriptions will get a nosub DDP response before login completes — But that is harmless, because client-side Meteor already knows to retry all subscriptions whenever the login method succeeds¹. Also, the meteor.loginServiceConfiguration subscription is whitelisted by default, which is enough to let your app display a multi-provider login widget (with server-side list of providers) if it was programmed to do so prior to enabling epfl:loginfirst.

If you need to call a DDP method before login (which should be fairly unusual), make sure to whitelist it (see above).

¹ Covered by a test in meteor/packages/accounts-base/accounts_reconnect_tests.js

1. Make sure that you git clone this package outside of any Meteor application.
   💡 If you insist on wanting a cloned epfl:loginfirst in your Meteor application's packages/ subdirectory, you can use a symlink
2. Run

   env TEST_CLIENT=0 meteor test-packages ./ --driver-package meteortesting:mocha

   ... which should give you a nice and terse green bar; but in the, hopefully unusual case that it doesn't, use this instead to investigate:

   env DEBUG='loginfirst*' TEST_CLIENT=0 meteor test-packages ./ --driver-package meteortesting:mocha