Is it possible to set another user's password in Meteor if you have admin privileges?

Question

I am now trying to set another user's password in Meteor admin page.

Here is my code.

Meteor.methods({
  updateUserPassword: function(userId, password) {
    var loggedInUser = Meteor.user()

    if (!loggedInUser ||
        !(Roles.userIsInRole(loggedInUser, ['admin'], 'default_group')) || (loggedInUser._id == userId) ) {
      throw new Meteor.Error(403, "Access denied")
    }

    return Accounts.setPassword(userId, password);
  }
});

But when I run this code, I get Accounts.setPassword is undefined error.

I added accounts-password and accounts-base packages, but it still shows undefined error, so I suspect if the Accounts.setPassword is not supported anymore.

Please help me how to handle this problem!

Answer 1

Accounts.setPassword is a server-only function in Meteor. If you are getting the error in your browser console it is because your updateUserPassword method is declared in lib/ folder or somewhere similar and can be accessed by both client-side and server-side.

Usually, it is desirable for Meteor.methods to be declared in lib/ folder in order to take advantage of Meteor's Latency Compensation technique (also called Method Simulation).

In your case that is not desirable because Accounts.setPassword is server-only.

---

Solution 1:

You can use Meteor.isClient and Meteor.isServer to determine which code to run where. (You can also use this.isSimulation).

Meteor.methods({
  updateUserPassword: function(userId, password) {
    var loggedInUser = Meteor.user()

    if (!loggedInUser ||
        !(Roles.userIsInRole(loggedInUser, ['admin'], 'default_group')) || (loggedInUser._id == userId) ) {
      throw new Meteor.Error(403, "Access denied")
    }

    if(Meteor.isServer) {
        return Accounts.setPassword(userId, password);
    } else if(Meteor.isClient) {
        // do something else
    }
  }
});

---

Solution 2:

You can declare the Meteor.methods on the server-side by placing the file in the server-only server/ folder, or placing the whole of the Meteor.methods declaration within a if(Meteor.isServer) { ... } check.

This should be used when latency compensation is not needed.