Secure meteor admin functionality

Question

I have a couple of admin functions I want to add to a meteor site and was wandering what is the best way to create, hide and protect them ?

Thanks

Answer 1

You can use Meteor.methods. Just be sure to only include them on the server, by placing the code in a folder called server/ E.g.

server/admin.js

Meteor.methods({
  foo: function (arg1, arg2) {
    // confirm that the user is an admin
    if ( ! this.user.isAdmin )
      throw new Meteor.Error(401, "You are not authorized to perform this action");
    // perform task
    return "some return value";
  }
});