Meteor - check() VS new SimpleSchema() for verifying .publish() arguments

Question

To ensure the type of the arguments my publications receive, should I use SimpleSchema or check()?

Meteor.publish('todos.inList', function(listId, limit) {
  new SimpleSchema({
    listId: { type: String },
    limit: { type: Number }
  }).validate({ listId, limit });

  [...]
});

or

Meteor.publish('todos.inList', function(listId, limit) {
  check(listId, String);
  check (limit, Number);

  [...]
});

I use check on all arguments parsed to methods and publications, then simple-schema via collection2 on all DB operations. Both have there place in my book. — bigmadwolf, Jul 26 '16 at 16:21

score 6 · Answer 1 · answered May 15 '16 at 23:25

check() allows you to check data type, which is one thing, but is somewhat limited.

SimpleSchema is much more powerful as it checks all keys in a documents (instead of one at a time) and lets you define not only type but also allowed values, define default (or dynamic) values when not present.

You should use SimpleSchema this way:

mySchema = new SimpleSchema({ <your schema here>});

var MyCollection = new Mongo.Collection("my_collection");
MyCollection.attachSchema(mySchema);

That way, you don't event need to check the schema in methods: it will be done automatically. Of course it's always good practice to use the

mySchema.validate(document);

to validate a client generated document before inserting it in your collection, but if you don't and your document doesn't match the schema (extra keys, wrong types etc...) SimpleSchema will reject the parts that don't belong.

Thank you for your anwser. Just to be fair though, `Meteor.check()` also allows you [to check all the object properties in one go](http://docs.meteor.com/#/full/check). — Alexandre Bourlier, May 16 '16 at 08:54

score 4 · Answer 2 · answered May 16 '16 at 04:10

4

To check arguments to a publish() function or a Meteor.method() use check(). You define a SimpleSchema to validate inserts, upserts, and updates to collections. A publication is none of those - it's readonly. Your use of SimpleSchema with .validate() inline would actually work but it's a pretty unusual pattern and a bit of overkill.

You might find this helpful.

answered May 16 '16 at 04:10

Michel Floyd

18,793
4
24
39

Thank you for taking the time to edit and to answer. I believe I understood the usefulness of `SimpleSchema()` for arguments validation now. – Alexandre Bourlier May 16 '16 at 09:03

score 3 · Answer 3 · answered May 15 '16 at 11:45

CHECK is a lightweight package for argument checking and general pattern matching. where as SimpleSchema is a huge package with one of the check features. It is just that one package was made before the other. Both works the same. You can use CHECK externally in Meteor.methods as well. Decision is all yours.

score 1 · Answer 4 · answered May 16 '16 at 09:12

Michel Floyd answer's, made me realize that check() actually sends Meteor.Error(400, "Match Failed") to the client, while SimpleSchema within Methods sends detailed ValidationError one can act upon to display appropriate error messages on a form for instance.

So to answer the question : should we use check() or SimpleSchema() to assess our arguments types in Meteor, I believe the answer is :

Use SimpleSchema if you need a detailed report of the error from the client, otherwise check() is the way to go not to send back critical info.

Meteor - check() VS new SimpleSchema() for verifying .publish() arguments

4 Answers4