meteor-useraccounts / core

Meteor sign up and sign in templates' core functionalities
http://useraccounts.meteor.com/
MIT License
529 stars 278 forks source link

Meteor.userId should not be set in Accounts.onLogout callback #744

Open davesierra opened 7 years ago

davesierra commented 7 years ago

TL;DR

Meteor.userId() should not exist in the callback of Accounts.onLogout()

Issue

If the following holds true:

AccountsCommon#userId()

Get the current user id, or null if no user is logged in. A reactive data source.

Then it doesn't make sense that on the Accounts.onLogout() callback, Meteor.userId() exists yet Meteor.user() does not.

Example

I have the following code:

Accounts.onLogout( () => {
        console.log('accounts onlogout userId', Meteor.userId()); //=> '54hads572' (bad)
        console.log('accounts onlogout userId', Meteor.user()); //=> undefined (good)
        //end session code;
        FlowRouter.go('/'); //redirect user to / so they can sign back in
});

// and in routes.js

FlowRouter.route('/', {
    name: 'signIn',
    triggersEnter: [],
    action: function(params, queryParams) {
               // it will arrive here with a Meteor.userId, and try to redirect back to /dashboard
        if ( !Meteor.userId() ) {
            mount(SignIn);
        } else {
            FlowRouter.go('/dashboard');
        }
    }
});

So if I log out, either via clearing my loginTokens on the DB or through the 'Sign Out' button provided by Accounts, it will redirect me back to /dashboard thinking I was logged in.

bolaum commented 6 years ago

Did you solve this?

bolaum commented 6 years ago

I ended up using Meteor.user() instead of Meteor.userId in the / route test.

davesierra commented 6 years ago

@bolaum Yep, that was my solution as well. The reason I opened this issue was that it's a bit misleading if someone were to use Meteor.userId, it caused alot of confusion and too much time spent digging around to realize this subtle difference.

japrogramer commented 2 years ago

if neither is defined how would we know which user is logging out ?