[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-meteor-meteor-security":3,"mdc--n9iwlj-key":39,"related-org-meteor-meteor-security":2202,"related-repo-meteor-meteor-security":2362},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":34,"sourceUrl":37,"mdContent":38},"meteor-security","audit and harden Meteor 3 applications","Use when auditing or hardening a Meteor 3 application. Triggers on missing check() on method arguments, missing this.userId guards on publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption via Accounts.config oauthSecretKey, audit-argument-checks, allow\u002Fdeny legacy patterns, BrowserPolicy.content.disallowInlineScripts, BrowserPolicy.framing.disallow. Use this skill when the user asks about hardening, asks about a security review, or asks about CSP for a third-party script (Stripe, Google Maps, fonts).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"meteor","Meteor","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fmeteor.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Auth","auth",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Code Analysis","code-analysis",4,"https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills","2026-08-28T15:09:32.604319","MIT",0,[29,30,31,32,8,33],"agent-skills","ai-agents","claude-code","codex","meteorjs",{"repoUrl":24,"stars":23,"forks":27,"topics":35,"description":36},[29,30,31,32,8,33],"Meteor-maintained Agent Skills for building, migrating, testing, securing, and deploying Meteor 3 applications.","https:\u002F\u002Fgithub.com\u002Fmeteor\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fmeteor-security","---\nname: meteor-security\ndescription: >\n  Use when auditing or hardening a Meteor 3 application. Triggers on\n  missing check() on method arguments, missing this.userId guards on\n  publications, browser-policy CSP, DDPRateLimiter rules, oauth-encryption\n  via Accounts.config oauthSecretKey, audit-argument-checks, allow\u002Fdeny\n  legacy patterns, BrowserPolicy.content.disallowInlineScripts,\n  BrowserPolicy.framing.disallow. Use this skill when the user asks about\n  hardening, asks about a security review, or asks about CSP for a\n  third-party script (Stripe, Google Maps, fonts).\nmetadata:\n  author: meteor\n  kind: knowledge\n  meteor: \">=3.0\"\n  area: security\n  tagline: \"Audit and harden Meteor 3 apps (`check()` coverage, `this.userId` guards, browser-policy CSP, rate limits, oauth-encryption).\"\n  bundle: [\"essentials\", \"fullstack\"]\n  docs_synced_at: \"2026-08-25\"\nlicense: MIT\n---\n\n# Meteor security\n\nMeteor's security model is opinionated: the server holds authority, the\nclient cannot be trusted, and the only places that filter data before it\nreaches users are methods (write paths) and publications (read paths).\n\n## Decision flow\n\n1. Audit every method: does it `check()` every argument and guard on\n   `this.userId` when authentication matters?\n2. Audit every publication: does it filter by `this.userId` (when\n   user-specific) and project columns with `fields`?\n3. Add `audit-argument-checks` in dev to catch missing `check()`.\n4. Add `browser-policy` and configure CSP.\n5. Add `DDPRateLimiter` rules for sensitive methods (login, password\n   reset, resource creation).\n6. If the app uses OAuth, set `oauthSecretKey` to encrypt provider\n   secrets at rest.\n7. Remove `allow` \u002F `deny` rules. They are legacy and easy to misuse;\n   use methods instead.\n\n## Method guard checklist\n\n```javascript\nimport { Meteor } from \"meteor\u002Fmeteor\";\nimport { check, Match } from \"meteor\u002Fcheck\";\n\nMeteor.methods({\n  async updateProfile(payload) {\n    check(payload, { displayName: String, bio: Match.Optional(String) });\n    if (!this.userId) {\n      throw new Meteor.Error(\"not-authorized\");\n    }\n    await Meteor.users.updateAsync(this.userId, { $set: { profile: payload } });\n  },\n});\n```\n\nReject any method that does not match: `check` on every argument, userId\ngate when needed, `Meteor.Error(code, reason)` for failures, `*Async`\nMongo on the server.\n\n## Publication guard checklist\n\n```javascript\nMeteor.publish(\"items.mine\", function () {\n  if (!this.userId) return this.ready();\n  return Items.find(\n    { ownerId: this.userId },\n    { fields: { title: 1, qty: 1 }, limit: 200 },\n  );\n});\n```\n\nReject any publication that returns an unbounded cursor, omits the field\nprojection, or skips a userId filter on user-specific data.\n\n## CSP via `browser-policy`\n\n```bash\nmeteor add browser-policy\n```\n\n```javascript\n\u002F\u002F server top-level or inside Meteor.startup\nimport { BrowserPolicy } from \"meteor\u002Fbrowser-policy-common\";\nimport { Meteor } from \"meteor\u002Fmeteor\";\n\nMeteor.startup(async () => {\n  await BrowserPolicy.content.disallowInlineScripts();\n  BrowserPolicy.content.disallowEval();\n  BrowserPolicy.framing.disallow();\n});\n```\n\n`BrowserPolicy` is server-only. Configure it during module initialization or\nstartup so every request receives one deterministic process-wide policy. The\ncurrent implementation invalidates its cached CSP after a mutation, but do not\nmutate this global policy per request or per user. See\n`references\u002Fbrowser-policy-csp.md` for recipes (Stripe, Google Maps,\nfonts, inline-style allowance).\n\n## DDPRateLimiter for sensitive methods\n\n```javascript\nimport { DDPRateLimiter } from \"meteor\u002Fddp-rate-limiter\";\n\nDDPRateLimiter.addRule(\n  {\n    type: \"method\",\n    name: \"login\",\n    clientAddress: () => true,\n  },\n  5,\n  60000,                  \u002F\u002F 5 attempts per 60s, per IP\n);\n```\n\nOnly matcher fields contribute to the rate-limit bucket key. Without\n`clientAddress`, `connectionId`, or `userId`, every matching caller shares one\nglobal bucket. Meteor 3.5+ permits async matcher functions for database-backed\ndecisions; keep their queries fast because the connection waits for them. On\nMeteor 3.0 through 3.4, matchers must stay synchronous. Use a fixed rule,\nprecomputed synchronous state, or upgrade rather than awaiting Mongo there.\n\nThe default rule (5 in 10s for login \u002F signup \u002F password reset) ships\nwith `accounts-base`. Remove with `Accounts.removeDefaultRateLimit()`\nonly if you replace it.\n\n## OAuth secret encryption\n\nAdd `oauth-encryption` and pass a 16-byte base64 key (NOT 32 bytes) to\n`Accounts.config` at module top level (not inside `Meteor.startup`):\n\n```bash\nmeteor node -e \"console.log(require('crypto').randomBytes(16).toString('base64'))\"\n```\n\n```javascript\nimport { Accounts } from \"meteor\u002Faccounts-base\";\n\nAccounts.config({\n  oauthSecretKey: Meteor.settings.oauthSecretKey,\n});\n```\n\nAt startup, `accounts-oauth` seals an unsealed provider application secret at\n`ServiceConfiguration.configurations.secret`. Provider packages also seal\nsupported per-user token fields, such as `services.github.accessToken` or\nTwitter's `accessTokenSecret`. There is no generic\n`Meteor.users.services.\u003Cprovider>.secret` field. Inspect the provider schema\nbefore asserting which user credential is encrypted.\n\n## `audit-argument-checks`\n\n```bash\nmeteor add audit-argument-checks\n```\n\nThrows if any method or publication runs without `check()` covering\nevery argument. Methods that legitimately accept arbitrary input declare\nthis explicitly:\n\n```javascript\nMeteor.methods({\n  rawLog(...args) {\n    check(args, [Match.Any]);\n    \u002F\u002F ...\n  },\n});\n```\n\n## Anti-patterns\n\n- `Collection.allow` \u002F `Collection.deny` rules. Legacy; easy to combine\n  into a soft-fail. Replace with methods.\n- `Meteor.settings.public.\u003Csecret>`. The client sees `public`. Move\n  secrets to the top level of `settings.json`.\n- Publish the entire `Meteor.users` collection. Always project (e.g.\n  `fields: { username: 1, profile: 1 }`) and filter. Publish email only to\n  the owning user or another explicitly authorized audience.\n- Use `BrowserPolicy.content.allowOriginForAll` for a third-party script. It\n  grants the origin to every current content directive. Allow only the script,\n  frame, connect, image, style, or font directives the integration needs.\n- Methods that accept callback-shaped arguments. Functions cannot travel\n  over DDP.\n- Call `Accounts.config({ oauthSecretKey })` inside `Meteor.startup`.\n  Must be at module top level so it loads before the OAuth packages\n  read it.\n\n## See also\n\n- `references\u002Fmethod-and-publish-guards.md`\n- `references\u002Fbrowser-policy-csp.md`\n- `references\u002Feval-cases.md`\n- Related skills: `meteor-methods`, `meteor-pubsub`, `meteor-accounts`.\n",{"data":40,"body":49},{"name":4,"description":6,"metadata":41,"license":26},{"author":8,"kind":42,"meteor":43,"area":14,"tagline":44,"bundle":45,"docs_synced_at":48},"knowledge",">=3.0","Audit and harden Meteor 3 apps (`check()` coverage, `this.userId` guards, browser-policy CSP, rate limits, oauth-encryption).",[46,47],"essentials","fullstack","2026-08-25",{"type":50,"children":51},"root",[52,60,66,73,198,204,701,730,736,1001,1006,1017,1044,1304,1323,1329,1548,1576,1597,1603,1631,1669,1801,1846,1854,1877,1889,2022,2028,2135,2141,2196],{"type":53,"tag":54,"props":55,"children":56},"element","h1",{"id":4},[57],{"type":58,"value":59},"text","Meteor security",{"type":53,"tag":61,"props":62,"children":63},"p",{},[64],{"type":58,"value":65},"Meteor's security model is opinionated: the server holds authority, the\nclient cannot be trusted, and the only places that filter data before it\nreaches users are methods (write paths) and publications (read paths).",{"type":53,"tag":67,"props":68,"children":70},"h2",{"id":69},"decision-flow",[71],{"type":58,"value":72},"Decision flow",{"type":53,"tag":74,"props":75,"children":76},"ol",{},[77,100,120,140,152,164,177],{"type":53,"tag":78,"props":79,"children":80},"li",{},[81,83,90,92,98],{"type":58,"value":82},"Audit every method: does it ",{"type":53,"tag":84,"props":85,"children":87},"code",{"className":86},[],[88],{"type":58,"value":89},"check()",{"type":58,"value":91}," every argument and guard on\n",{"type":53,"tag":84,"props":93,"children":95},{"className":94},[],[96],{"type":58,"value":97},"this.userId",{"type":58,"value":99}," when authentication matters?",{"type":53,"tag":78,"props":101,"children":102},{},[103,105,110,112,118],{"type":58,"value":104},"Audit every publication: does it filter by ",{"type":53,"tag":84,"props":106,"children":108},{"className":107},[],[109],{"type":58,"value":97},{"type":58,"value":111}," (when\nuser-specific) and project columns with ",{"type":53,"tag":84,"props":113,"children":115},{"className":114},[],[116],{"type":58,"value":117},"fields",{"type":58,"value":119},"?",{"type":53,"tag":78,"props":121,"children":122},{},[123,125,131,133,138],{"type":58,"value":124},"Add ",{"type":53,"tag":84,"props":126,"children":128},{"className":127},[],[129],{"type":58,"value":130},"audit-argument-checks",{"type":58,"value":132}," in dev to catch missing ",{"type":53,"tag":84,"props":134,"children":136},{"className":135},[],[137],{"type":58,"value":89},{"type":58,"value":139},".",{"type":53,"tag":78,"props":141,"children":142},{},[143,144,150],{"type":58,"value":124},{"type":53,"tag":84,"props":145,"children":147},{"className":146},[],[148],{"type":58,"value":149},"browser-policy",{"type":58,"value":151}," and configure CSP.",{"type":53,"tag":78,"props":153,"children":154},{},[155,156,162],{"type":58,"value":124},{"type":53,"tag":84,"props":157,"children":159},{"className":158},[],[160],{"type":58,"value":161},"DDPRateLimiter",{"type":58,"value":163}," rules for sensitive methods (login, password\nreset, resource creation).",{"type":53,"tag":78,"props":165,"children":166},{},[167,169,175],{"type":58,"value":168},"If the app uses OAuth, set ",{"type":53,"tag":84,"props":170,"children":172},{"className":171},[],[173],{"type":58,"value":174},"oauthSecretKey",{"type":58,"value":176}," to encrypt provider\nsecrets at rest.",{"type":53,"tag":78,"props":178,"children":179},{},[180,182,188,190,196],{"type":58,"value":181},"Remove ",{"type":53,"tag":84,"props":183,"children":185},{"className":184},[],[186],{"type":58,"value":187},"allow",{"type":58,"value":189}," \u002F ",{"type":53,"tag":84,"props":191,"children":193},{"className":192},[],[194],{"type":58,"value":195},"deny",{"type":58,"value":197}," rules. They are legacy and easy to misuse;\nuse methods instead.",{"type":53,"tag":67,"props":199,"children":201},{"id":200},"method-guard-checklist",[202],{"type":58,"value":203},"Method guard checklist",{"type":53,"tag":205,"props":206,"children":211},"pre",{"className":207,"code":208,"language":209,"meta":210,"style":210},"language-javascript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { Meteor } from \"meteor\u002Fmeteor\";\nimport { check, Match } from \"meteor\u002Fcheck\";\n\nMeteor.methods({\n  async updateProfile(payload) {\n    check(payload, { displayName: String, bio: Match.Optional(String) });\n    if (!this.userId) {\n      throw new Meteor.Error(\"not-authorized\");\n    }\n    await Meteor.users.updateAsync(this.userId, { $set: { profile: payload } });\n  },\n});\n","javascript","",[212],{"type":53,"tag":84,"props":213,"children":214},{"__ignoreMap":210},[215,270,322,332,359,395,488,520,572,581,676,685],{"type":53,"tag":216,"props":217,"children":220},"span",{"class":218,"line":219},"line",1,[221,227,233,239,244,249,254,260,265],{"type":53,"tag":216,"props":222,"children":224},{"style":223},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[225],{"type":58,"value":226},"import",{"type":53,"tag":216,"props":228,"children":230},{"style":229},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[231],{"type":58,"value":232}," {",{"type":53,"tag":216,"props":234,"children":236},{"style":235},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[237],{"type":58,"value":238}," Meteor",{"type":53,"tag":216,"props":240,"children":241},{"style":229},[242],{"type":58,"value":243}," }",{"type":53,"tag":216,"props":245,"children":246},{"style":223},[247],{"type":58,"value":248}," from",{"type":53,"tag":216,"props":250,"children":251},{"style":229},[252],{"type":58,"value":253}," \"",{"type":53,"tag":216,"props":255,"children":257},{"style":256},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[258],{"type":58,"value":259},"meteor\u002Fmeteor",{"type":53,"tag":216,"props":261,"children":262},{"style":229},[263],{"type":58,"value":264},"\"",{"type":53,"tag":216,"props":266,"children":267},{"style":229},[268],{"type":58,"value":269},";\n",{"type":53,"tag":216,"props":271,"children":273},{"class":218,"line":272},2,[274,278,282,287,292,297,301,305,309,314,318],{"type":53,"tag":216,"props":275,"children":276},{"style":223},[277],{"type":58,"value":226},{"type":53,"tag":216,"props":279,"children":280},{"style":229},[281],{"type":58,"value":232},{"type":53,"tag":216,"props":283,"children":284},{"style":235},[285],{"type":58,"value":286}," check",{"type":53,"tag":216,"props":288,"children":289},{"style":229},[290],{"type":58,"value":291},",",{"type":53,"tag":216,"props":293,"children":294},{"style":235},[295],{"type":58,"value":296}," Match",{"type":53,"tag":216,"props":298,"children":299},{"style":229},[300],{"type":58,"value":243},{"type":53,"tag":216,"props":302,"children":303},{"style":223},[304],{"type":58,"value":248},{"type":53,"tag":216,"props":306,"children":307},{"style":229},[308],{"type":58,"value":253},{"type":53,"tag":216,"props":310,"children":311},{"style":256},[312],{"type":58,"value":313},"meteor\u002Fcheck",{"type":53,"tag":216,"props":315,"children":316},{"style":229},[317],{"type":58,"value":264},{"type":53,"tag":216,"props":319,"children":320},{"style":229},[321],{"type":58,"value":269},{"type":53,"tag":216,"props":323,"children":325},{"class":218,"line":324},3,[326],{"type":53,"tag":216,"props":327,"children":329},{"emptyLinePlaceholder":328},true,[330],{"type":58,"value":331},"\n",{"type":53,"tag":216,"props":333,"children":334},{"class":218,"line":23},[335,339,343,349,354],{"type":53,"tag":216,"props":336,"children":337},{"style":235},[338],{"type":58,"value":9},{"type":53,"tag":216,"props":340,"children":341},{"style":229},[342],{"type":58,"value":139},{"type":53,"tag":216,"props":344,"children":346},{"style":345},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[347],{"type":58,"value":348},"methods",{"type":53,"tag":216,"props":350,"children":351},{"style":235},[352],{"type":58,"value":353},"(",{"type":53,"tag":216,"props":355,"children":356},{"style":229},[357],{"type":58,"value":358},"{\n",{"type":53,"tag":216,"props":360,"children":362},{"class":218,"line":361},5,[363,369,375,379,385,390],{"type":53,"tag":216,"props":364,"children":366},{"style":365},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[367],{"type":58,"value":368},"  async",{"type":53,"tag":216,"props":370,"children":372},{"style":371},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[373],{"type":58,"value":374}," updateProfile",{"type":53,"tag":216,"props":376,"children":377},{"style":229},[378],{"type":58,"value":353},{"type":53,"tag":216,"props":380,"children":382},{"style":381},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic",[383],{"type":58,"value":384},"payload",{"type":53,"tag":216,"props":386,"children":387},{"style":229},[388],{"type":58,"value":389},")",{"type":53,"tag":216,"props":391,"children":392},{"style":229},[393],{"type":58,"value":394}," {\n",{"type":53,"tag":216,"props":396,"children":398},{"class":218,"line":397},6,[399,404,408,412,416,420,425,430,435,439,444,448,452,456,461,465,470,475,480,484],{"type":53,"tag":216,"props":400,"children":401},{"style":345},[402],{"type":58,"value":403},"    check",{"type":53,"tag":216,"props":405,"children":406},{"style":371},[407],{"type":58,"value":353},{"type":53,"tag":216,"props":409,"children":410},{"style":235},[411],{"type":58,"value":384},{"type":53,"tag":216,"props":413,"children":414},{"style":229},[415],{"type":58,"value":291},{"type":53,"tag":216,"props":417,"children":418},{"style":229},[419],{"type":58,"value":232},{"type":53,"tag":216,"props":421,"children":422},{"style":371},[423],{"type":58,"value":424}," displayName",{"type":53,"tag":216,"props":426,"children":427},{"style":229},[428],{"type":58,"value":429},":",{"type":53,"tag":216,"props":431,"children":432},{"style":235},[433],{"type":58,"value":434}," String",{"type":53,"tag":216,"props":436,"children":437},{"style":229},[438],{"type":58,"value":291},{"type":53,"tag":216,"props":440,"children":441},{"style":371},[442],{"type":58,"value":443}," bio",{"type":53,"tag":216,"props":445,"children":446},{"style":229},[447],{"type":58,"value":429},{"type":53,"tag":216,"props":449,"children":450},{"style":235},[451],{"type":58,"value":296},{"type":53,"tag":216,"props":453,"children":454},{"style":229},[455],{"type":58,"value":139},{"type":53,"tag":216,"props":457,"children":458},{"style":345},[459],{"type":58,"value":460},"Optional",{"type":53,"tag":216,"props":462,"children":463},{"style":371},[464],{"type":58,"value":353},{"type":53,"tag":216,"props":466,"children":467},{"style":235},[468],{"type":58,"value":469},"String",{"type":53,"tag":216,"props":471,"children":472},{"style":371},[473],{"type":58,"value":474},") ",{"type":53,"tag":216,"props":476,"children":477},{"style":229},[478],{"type":58,"value":479},"}",{"type":53,"tag":216,"props":481,"children":482},{"style":371},[483],{"type":58,"value":389},{"type":53,"tag":216,"props":485,"children":486},{"style":229},[487],{"type":58,"value":269},{"type":53,"tag":216,"props":489,"children":491},{"class":218,"line":490},7,[492,497,502,507,512,516],{"type":53,"tag":216,"props":493,"children":494},{"style":223},[495],{"type":58,"value":496},"    if",{"type":53,"tag":216,"props":498,"children":499},{"style":371},[500],{"type":58,"value":501}," (",{"type":53,"tag":216,"props":503,"children":504},{"style":229},[505],{"type":58,"value":506},"!this.",{"type":53,"tag":216,"props":508,"children":509},{"style":235},[510],{"type":58,"value":511},"userId",{"type":53,"tag":216,"props":513,"children":514},{"style":371},[515],{"type":58,"value":474},{"type":53,"tag":216,"props":517,"children":518},{"style":229},[519],{"type":58,"value":358},{"type":53,"tag":216,"props":521,"children":523},{"class":218,"line":522},8,[524,529,534,538,542,547,551,555,560,564,568],{"type":53,"tag":216,"props":525,"children":526},{"style":223},[527],{"type":58,"value":528},"      throw",{"type":53,"tag":216,"props":530,"children":531},{"style":229},[532],{"type":58,"value":533}," new",{"type":53,"tag":216,"props":535,"children":536},{"style":235},[537],{"type":58,"value":238},{"type":53,"tag":216,"props":539,"children":540},{"style":229},[541],{"type":58,"value":139},{"type":53,"tag":216,"props":543,"children":544},{"style":345},[545],{"type":58,"value":546},"Error",{"type":53,"tag":216,"props":548,"children":549},{"style":371},[550],{"type":58,"value":353},{"type":53,"tag":216,"props":552,"children":553},{"style":229},[554],{"type":58,"value":264},{"type":53,"tag":216,"props":556,"children":557},{"style":256},[558],{"type":58,"value":559},"not-authorized",{"type":53,"tag":216,"props":561,"children":562},{"style":229},[563],{"type":58,"value":264},{"type":53,"tag":216,"props":565,"children":566},{"style":371},[567],{"type":58,"value":389},{"type":53,"tag":216,"props":569,"children":570},{"style":229},[571],{"type":58,"value":269},{"type":53,"tag":216,"props":573,"children":575},{"class":218,"line":574},9,[576],{"type":53,"tag":216,"props":577,"children":578},{"style":229},[579],{"type":58,"value":580},"    }\n",{"type":53,"tag":216,"props":582,"children":584},{"class":218,"line":583},10,[585,590,594,598,603,607,612,616,621,625,629,633,638,642,646,651,655,660,664,668,672],{"type":53,"tag":216,"props":586,"children":587},{"style":223},[588],{"type":58,"value":589},"    await",{"type":53,"tag":216,"props":591,"children":592},{"style":235},[593],{"type":58,"value":238},{"type":53,"tag":216,"props":595,"children":596},{"style":229},[597],{"type":58,"value":139},{"type":53,"tag":216,"props":599,"children":600},{"style":235},[601],{"type":58,"value":602},"users",{"type":53,"tag":216,"props":604,"children":605},{"style":229},[606],{"type":58,"value":139},{"type":53,"tag":216,"props":608,"children":609},{"style":345},[610],{"type":58,"value":611},"updateAsync",{"type":53,"tag":216,"props":613,"children":614},{"style":371},[615],{"type":58,"value":353},{"type":53,"tag":216,"props":617,"children":618},{"style":229},[619],{"type":58,"value":620},"this.",{"type":53,"tag":216,"props":622,"children":623},{"style":235},[624],{"type":58,"value":511},{"type":53,"tag":216,"props":626,"children":627},{"style":229},[628],{"type":58,"value":291},{"type":53,"tag":216,"props":630,"children":631},{"style":229},[632],{"type":58,"value":232},{"type":53,"tag":216,"props":634,"children":635},{"style":371},[636],{"type":58,"value":637}," $set",{"type":53,"tag":216,"props":639,"children":640},{"style":229},[641],{"type":58,"value":429},{"type":53,"tag":216,"props":643,"children":644},{"style":229},[645],{"type":58,"value":232},{"type":53,"tag":216,"props":647,"children":648},{"style":371},[649],{"type":58,"value":650}," profile",{"type":53,"tag":216,"props":652,"children":653},{"style":229},[654],{"type":58,"value":429},{"type":53,"tag":216,"props":656,"children":657},{"style":235},[658],{"type":58,"value":659}," payload",{"type":53,"tag":216,"props":661,"children":662},{"style":229},[663],{"type":58,"value":243},{"type":53,"tag":216,"props":665,"children":666},{"style":229},[667],{"type":58,"value":243},{"type":53,"tag":216,"props":669,"children":670},{"style":371},[671],{"type":58,"value":389},{"type":53,"tag":216,"props":673,"children":674},{"style":229},[675],{"type":58,"value":269},{"type":53,"tag":216,"props":677,"children":679},{"class":218,"line":678},11,[680],{"type":53,"tag":216,"props":681,"children":682},{"style":229},[683],{"type":58,"value":684},"  },\n",{"type":53,"tag":216,"props":686,"children":688},{"class":218,"line":687},12,[689,693,697],{"type":53,"tag":216,"props":690,"children":691},{"style":229},[692],{"type":58,"value":479},{"type":53,"tag":216,"props":694,"children":695},{"style":235},[696],{"type":58,"value":389},{"type":53,"tag":216,"props":698,"children":699},{"style":229},[700],{"type":58,"value":269},{"type":53,"tag":61,"props":702,"children":703},{},[704,706,712,714,720,722,728],{"type":58,"value":705},"Reject any method that does not match: ",{"type":53,"tag":84,"props":707,"children":709},{"className":708},[],[710],{"type":58,"value":711},"check",{"type":58,"value":713}," on every argument, userId\ngate when needed, ",{"type":53,"tag":84,"props":715,"children":717},{"className":716},[],[718],{"type":58,"value":719},"Meteor.Error(code, reason)",{"type":58,"value":721}," for failures, ",{"type":53,"tag":84,"props":723,"children":725},{"className":724},[],[726],{"type":58,"value":727},"*Async",{"type":58,"value":729},"\nMongo on the server.",{"type":53,"tag":67,"props":731,"children":733},{"id":732},"publication-guard-checklist",[734],{"type":58,"value":735},"Publication guard checklist",{"type":53,"tag":205,"props":737,"children":739},{"className":207,"code":738,"language":209,"meta":210,"style":210},"Meteor.publish(\"items.mine\", function () {\n  if (!this.userId) return this.ready();\n  return Items.find(\n    { ownerId: this.userId },\n    { fields: { title: 1, qty: 1 }, limit: 200 },\n  );\n});\n",[740],{"type":53,"tag":84,"props":741,"children":742},{"__ignoreMap":210},[743,794,842,869,899,974,986],{"type":53,"tag":216,"props":744,"children":745},{"class":218,"line":219},[746,750,754,759,763,767,772,776,780,785,790],{"type":53,"tag":216,"props":747,"children":748},{"style":235},[749],{"type":58,"value":9},{"type":53,"tag":216,"props":751,"children":752},{"style":229},[753],{"type":58,"value":139},{"type":53,"tag":216,"props":755,"children":756},{"style":345},[757],{"type":58,"value":758},"publish",{"type":53,"tag":216,"props":760,"children":761},{"style":235},[762],{"type":58,"value":353},{"type":53,"tag":216,"props":764,"children":765},{"style":229},[766],{"type":58,"value":264},{"type":53,"tag":216,"props":768,"children":769},{"style":256},[770],{"type":58,"value":771},"items.mine",{"type":53,"tag":216,"props":773,"children":774},{"style":229},[775],{"type":58,"value":264},{"type":53,"tag":216,"props":777,"children":778},{"style":229},[779],{"type":58,"value":291},{"type":53,"tag":216,"props":781,"children":782},{"style":365},[783],{"type":58,"value":784}," function",{"type":53,"tag":216,"props":786,"children":787},{"style":229},[788],{"type":58,"value":789}," ()",{"type":53,"tag":216,"props":791,"children":792},{"style":229},[793],{"type":58,"value":394},{"type":53,"tag":216,"props":795,"children":796},{"class":218,"line":272},[797,802,806,810,814,818,823,828,833,838],{"type":53,"tag":216,"props":798,"children":799},{"style":223},[800],{"type":58,"value":801},"  if",{"type":53,"tag":216,"props":803,"children":804},{"style":371},[805],{"type":58,"value":501},{"type":53,"tag":216,"props":807,"children":808},{"style":229},[809],{"type":58,"value":506},{"type":53,"tag":216,"props":811,"children":812},{"style":235},[813],{"type":58,"value":511},{"type":53,"tag":216,"props":815,"children":816},{"style":371},[817],{"type":58,"value":474},{"type":53,"tag":216,"props":819,"children":820},{"style":223},[821],{"type":58,"value":822},"return",{"type":53,"tag":216,"props":824,"children":825},{"style":229},[826],{"type":58,"value":827}," this.",{"type":53,"tag":216,"props":829,"children":830},{"style":345},[831],{"type":58,"value":832},"ready",{"type":53,"tag":216,"props":834,"children":835},{"style":371},[836],{"type":58,"value":837},"()",{"type":53,"tag":216,"props":839,"children":840},{"style":229},[841],{"type":58,"value":269},{"type":53,"tag":216,"props":843,"children":844},{"class":218,"line":324},[845,850,855,859,864],{"type":53,"tag":216,"props":846,"children":847},{"style":223},[848],{"type":58,"value":849},"  return",{"type":53,"tag":216,"props":851,"children":852},{"style":235},[853],{"type":58,"value":854}," Items",{"type":53,"tag":216,"props":856,"children":857},{"style":229},[858],{"type":58,"value":139},{"type":53,"tag":216,"props":860,"children":861},{"style":345},[862],{"type":58,"value":863},"find",{"type":53,"tag":216,"props":865,"children":866},{"style":371},[867],{"type":58,"value":868},"(\n",{"type":53,"tag":216,"props":870,"children":871},{"class":218,"line":23},[872,877,882,886,890,894],{"type":53,"tag":216,"props":873,"children":874},{"style":229},[875],{"type":58,"value":876},"    {",{"type":53,"tag":216,"props":878,"children":879},{"style":371},[880],{"type":58,"value":881}," ownerId",{"type":53,"tag":216,"props":883,"children":884},{"style":229},[885],{"type":58,"value":429},{"type":53,"tag":216,"props":887,"children":888},{"style":229},[889],{"type":58,"value":827},{"type":53,"tag":216,"props":891,"children":892},{"style":235},[893],{"type":58,"value":511},{"type":53,"tag":216,"props":895,"children":896},{"style":229},[897],{"type":58,"value":898}," },\n",{"type":53,"tag":216,"props":900,"children":901},{"class":218,"line":361},[902,906,911,915,919,924,928,934,938,943,947,951,956,961,965,970],{"type":53,"tag":216,"props":903,"children":904},{"style":229},[905],{"type":58,"value":876},{"type":53,"tag":216,"props":907,"children":908},{"style":371},[909],{"type":58,"value":910}," fields",{"type":53,"tag":216,"props":912,"children":913},{"style":229},[914],{"type":58,"value":429},{"type":53,"tag":216,"props":916,"children":917},{"style":229},[918],{"type":58,"value":232},{"type":53,"tag":216,"props":920,"children":921},{"style":371},[922],{"type":58,"value":923}," title",{"type":53,"tag":216,"props":925,"children":926},{"style":229},[927],{"type":58,"value":429},{"type":53,"tag":216,"props":929,"children":931},{"style":930},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[932],{"type":58,"value":933}," 1",{"type":53,"tag":216,"props":935,"children":936},{"style":229},[937],{"type":58,"value":291},{"type":53,"tag":216,"props":939,"children":940},{"style":371},[941],{"type":58,"value":942}," qty",{"type":53,"tag":216,"props":944,"children":945},{"style":229},[946],{"type":58,"value":429},{"type":53,"tag":216,"props":948,"children":949},{"style":930},[950],{"type":58,"value":933},{"type":53,"tag":216,"props":952,"children":953},{"style":229},[954],{"type":58,"value":955}," },",{"type":53,"tag":216,"props":957,"children":958},{"style":371},[959],{"type":58,"value":960}," limit",{"type":53,"tag":216,"props":962,"children":963},{"style":229},[964],{"type":58,"value":429},{"type":53,"tag":216,"props":966,"children":967},{"style":930},[968],{"type":58,"value":969}," 200",{"type":53,"tag":216,"props":971,"children":972},{"style":229},[973],{"type":58,"value":898},{"type":53,"tag":216,"props":975,"children":976},{"class":218,"line":397},[977,982],{"type":53,"tag":216,"props":978,"children":979},{"style":371},[980],{"type":58,"value":981},"  )",{"type":53,"tag":216,"props":983,"children":984},{"style":229},[985],{"type":58,"value":269},{"type":53,"tag":216,"props":987,"children":988},{"class":218,"line":490},[989,993,997],{"type":53,"tag":216,"props":990,"children":991},{"style":229},[992],{"type":58,"value":479},{"type":53,"tag":216,"props":994,"children":995},{"style":235},[996],{"type":58,"value":389},{"type":53,"tag":216,"props":998,"children":999},{"style":229},[1000],{"type":58,"value":269},{"type":53,"tag":61,"props":1002,"children":1003},{},[1004],{"type":58,"value":1005},"Reject any publication that returns an unbounded cursor, omits the field\nprojection, or skips a userId filter on user-specific data.",{"type":53,"tag":67,"props":1007,"children":1009},{"id":1008},"csp-via-browser-policy",[1010,1012],{"type":58,"value":1011},"CSP via ",{"type":53,"tag":84,"props":1013,"children":1015},{"className":1014},[],[1016],{"type":58,"value":149},{"type":53,"tag":205,"props":1018,"children":1022},{"className":1019,"code":1020,"language":1021,"meta":210,"style":210},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","meteor add browser-policy\n","bash",[1023],{"type":53,"tag":84,"props":1024,"children":1025},{"__ignoreMap":210},[1026],{"type":53,"tag":216,"props":1027,"children":1028},{"class":218,"line":219},[1029,1034,1039],{"type":53,"tag":216,"props":1030,"children":1032},{"style":1031},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1033],{"type":58,"value":8},{"type":53,"tag":216,"props":1035,"children":1036},{"style":256},[1037],{"type":58,"value":1038}," add",{"type":53,"tag":216,"props":1040,"children":1041},{"style":256},[1042],{"type":58,"value":1043}," browser-policy\n",{"type":53,"tag":205,"props":1045,"children":1047},{"className":207,"code":1046,"language":209,"meta":210,"style":210},"\u002F\u002F server top-level or inside Meteor.startup\nimport { BrowserPolicy } from \"meteor\u002Fbrowser-policy-common\";\nimport { Meteor } from \"meteor\u002Fmeteor\";\n\nMeteor.startup(async () => {\n  await BrowserPolicy.content.disallowInlineScripts();\n  BrowserPolicy.content.disallowEval();\n  BrowserPolicy.framing.disallow();\n});\n",[1048],{"type":53,"tag":84,"props":1049,"children":1050},{"__ignoreMap":210},[1051,1060,1101,1140,1147,1185,1223,1256,1289],{"type":53,"tag":216,"props":1052,"children":1053},{"class":218,"line":219},[1054],{"type":53,"tag":216,"props":1055,"children":1057},{"style":1056},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1058],{"type":58,"value":1059},"\u002F\u002F server top-level or inside Meteor.startup\n",{"type":53,"tag":216,"props":1061,"children":1062},{"class":218,"line":272},[1063,1067,1071,1076,1080,1084,1088,1093,1097],{"type":53,"tag":216,"props":1064,"children":1065},{"style":223},[1066],{"type":58,"value":226},{"type":53,"tag":216,"props":1068,"children":1069},{"style":229},[1070],{"type":58,"value":232},{"type":53,"tag":216,"props":1072,"children":1073},{"style":235},[1074],{"type":58,"value":1075}," BrowserPolicy",{"type":53,"tag":216,"props":1077,"children":1078},{"style":229},[1079],{"type":58,"value":243},{"type":53,"tag":216,"props":1081,"children":1082},{"style":223},[1083],{"type":58,"value":248},{"type":53,"tag":216,"props":1085,"children":1086},{"style":229},[1087],{"type":58,"value":253},{"type":53,"tag":216,"props":1089,"children":1090},{"style":256},[1091],{"type":58,"value":1092},"meteor\u002Fbrowser-policy-common",{"type":53,"tag":216,"props":1094,"children":1095},{"style":229},[1096],{"type":58,"value":264},{"type":53,"tag":216,"props":1098,"children":1099},{"style":229},[1100],{"type":58,"value":269},{"type":53,"tag":216,"props":1102,"children":1103},{"class":218,"line":324},[1104,1108,1112,1116,1120,1124,1128,1132,1136],{"type":53,"tag":216,"props":1105,"children":1106},{"style":223},[1107],{"type":58,"value":226},{"type":53,"tag":216,"props":1109,"children":1110},{"style":229},[1111],{"type":58,"value":232},{"type":53,"tag":216,"props":1113,"children":1114},{"style":235},[1115],{"type":58,"value":238},{"type":53,"tag":216,"props":1117,"children":1118},{"style":229},[1119],{"type":58,"value":243},{"type":53,"tag":216,"props":1121,"children":1122},{"style":223},[1123],{"type":58,"value":248},{"type":53,"tag":216,"props":1125,"children":1126},{"style":229},[1127],{"type":58,"value":253},{"type":53,"tag":216,"props":1129,"children":1130},{"style":256},[1131],{"type":58,"value":259},{"type":53,"tag":216,"props":1133,"children":1134},{"style":229},[1135],{"type":58,"value":264},{"type":53,"tag":216,"props":1137,"children":1138},{"style":229},[1139],{"type":58,"value":269},{"type":53,"tag":216,"props":1141,"children":1142},{"class":218,"line":23},[1143],{"type":53,"tag":216,"props":1144,"children":1145},{"emptyLinePlaceholder":328},[1146],{"type":58,"value":331},{"type":53,"tag":216,"props":1148,"children":1149},{"class":218,"line":361},[1150,1154,1158,1163,1167,1172,1176,1181],{"type":53,"tag":216,"props":1151,"children":1152},{"style":235},[1153],{"type":58,"value":9},{"type":53,"tag":216,"props":1155,"children":1156},{"style":229},[1157],{"type":58,"value":139},{"type":53,"tag":216,"props":1159,"children":1160},{"style":345},[1161],{"type":58,"value":1162},"startup",{"type":53,"tag":216,"props":1164,"children":1165},{"style":235},[1166],{"type":58,"value":353},{"type":53,"tag":216,"props":1168,"children":1169},{"style":365},[1170],{"type":58,"value":1171},"async",{"type":53,"tag":216,"props":1173,"children":1174},{"style":229},[1175],{"type":58,"value":789},{"type":53,"tag":216,"props":1177,"children":1178},{"style":365},[1179],{"type":58,"value":1180}," =>",{"type":53,"tag":216,"props":1182,"children":1183},{"style":229},[1184],{"type":58,"value":394},{"type":53,"tag":216,"props":1186,"children":1187},{"class":218,"line":397},[1188,1193,1197,1201,1206,1210,1215,1219],{"type":53,"tag":216,"props":1189,"children":1190},{"style":223},[1191],{"type":58,"value":1192},"  await",{"type":53,"tag":216,"props":1194,"children":1195},{"style":235},[1196],{"type":58,"value":1075},{"type":53,"tag":216,"props":1198,"children":1199},{"style":229},[1200],{"type":58,"value":139},{"type":53,"tag":216,"props":1202,"children":1203},{"style":235},[1204],{"type":58,"value":1205},"content",{"type":53,"tag":216,"props":1207,"children":1208},{"style":229},[1209],{"type":58,"value":139},{"type":53,"tag":216,"props":1211,"children":1212},{"style":345},[1213],{"type":58,"value":1214},"disallowInlineScripts",{"type":53,"tag":216,"props":1216,"children":1217},{"style":371},[1218],{"type":58,"value":837},{"type":53,"tag":216,"props":1220,"children":1221},{"style":229},[1222],{"type":58,"value":269},{"type":53,"tag":216,"props":1224,"children":1225},{"class":218,"line":490},[1226,1231,1235,1239,1243,1248,1252],{"type":53,"tag":216,"props":1227,"children":1228},{"style":235},[1229],{"type":58,"value":1230},"  BrowserPolicy",{"type":53,"tag":216,"props":1232,"children":1233},{"style":229},[1234],{"type":58,"value":139},{"type":53,"tag":216,"props":1236,"children":1237},{"style":235},[1238],{"type":58,"value":1205},{"type":53,"tag":216,"props":1240,"children":1241},{"style":229},[1242],{"type":58,"value":139},{"type":53,"tag":216,"props":1244,"children":1245},{"style":345},[1246],{"type":58,"value":1247},"disallowEval",{"type":53,"tag":216,"props":1249,"children":1250},{"style":371},[1251],{"type":58,"value":837},{"type":53,"tag":216,"props":1253,"children":1254},{"style":229},[1255],{"type":58,"value":269},{"type":53,"tag":216,"props":1257,"children":1258},{"class":218,"line":522},[1259,1263,1267,1272,1276,1281,1285],{"type":53,"tag":216,"props":1260,"children":1261},{"style":235},[1262],{"type":58,"value":1230},{"type":53,"tag":216,"props":1264,"children":1265},{"style":229},[1266],{"type":58,"value":139},{"type":53,"tag":216,"props":1268,"children":1269},{"style":235},[1270],{"type":58,"value":1271},"framing",{"type":53,"tag":216,"props":1273,"children":1274},{"style":229},[1275],{"type":58,"value":139},{"type":53,"tag":216,"props":1277,"children":1278},{"style":345},[1279],{"type":58,"value":1280},"disallow",{"type":53,"tag":216,"props":1282,"children":1283},{"style":371},[1284],{"type":58,"value":837},{"type":53,"tag":216,"props":1286,"children":1287},{"style":229},[1288],{"type":58,"value":269},{"type":53,"tag":216,"props":1290,"children":1291},{"class":218,"line":574},[1292,1296,1300],{"type":53,"tag":216,"props":1293,"children":1294},{"style":229},[1295],{"type":58,"value":479},{"type":53,"tag":216,"props":1297,"children":1298},{"style":235},[1299],{"type":58,"value":389},{"type":53,"tag":216,"props":1301,"children":1302},{"style":229},[1303],{"type":58,"value":269},{"type":53,"tag":61,"props":1305,"children":1306},{},[1307,1313,1315,1321],{"type":53,"tag":84,"props":1308,"children":1310},{"className":1309},[],[1311],{"type":58,"value":1312},"BrowserPolicy",{"type":58,"value":1314}," is server-only. Configure it during module initialization or\nstartup so every request receives one deterministic process-wide policy. The\ncurrent implementation invalidates its cached CSP after a mutation, but do not\nmutate this global policy per request or per user. See\n",{"type":53,"tag":84,"props":1316,"children":1318},{"className":1317},[],[1319],{"type":58,"value":1320},"references\u002Fbrowser-policy-csp.md",{"type":58,"value":1322}," for recipes (Stripe, Google Maps,\nfonts, inline-style allowance).",{"type":53,"tag":67,"props":1324,"children":1326},{"id":1325},"ddpratelimiter-for-sensitive-methods",[1327],{"type":58,"value":1328},"DDPRateLimiter for sensitive methods",{"type":53,"tag":205,"props":1330,"children":1332},{"className":207,"code":1331,"language":209,"meta":210,"style":210},"import { DDPRateLimiter } from \"meteor\u002Fddp-rate-limiter\";\n\nDDPRateLimiter.addRule(\n  {\n    type: \"method\",\n    name: \"login\",\n    clientAddress: () => true,\n  },\n  5,\n  60000,                  \u002F\u002F 5 attempts per 60s, per IP\n);\n",[1333],{"type":53,"tag":84,"props":1334,"children":1335},{"__ignoreMap":210},[1336,1377,1384,1404,1412,1442,1471,1501,1508,1520,1537],{"type":53,"tag":216,"props":1337,"children":1338},{"class":218,"line":219},[1339,1343,1347,1352,1356,1360,1364,1369,1373],{"type":53,"tag":216,"props":1340,"children":1341},{"style":223},[1342],{"type":58,"value":226},{"type":53,"tag":216,"props":1344,"children":1345},{"style":229},[1346],{"type":58,"value":232},{"type":53,"tag":216,"props":1348,"children":1349},{"style":235},[1350],{"type":58,"value":1351}," DDPRateLimiter",{"type":53,"tag":216,"props":1353,"children":1354},{"style":229},[1355],{"type":58,"value":243},{"type":53,"tag":216,"props":1357,"children":1358},{"style":223},[1359],{"type":58,"value":248},{"type":53,"tag":216,"props":1361,"children":1362},{"style":229},[1363],{"type":58,"value":253},{"type":53,"tag":216,"props":1365,"children":1366},{"style":256},[1367],{"type":58,"value":1368},"meteor\u002Fddp-rate-limiter",{"type":53,"tag":216,"props":1370,"children":1371},{"style":229},[1372],{"type":58,"value":264},{"type":53,"tag":216,"props":1374,"children":1375},{"style":229},[1376],{"type":58,"value":269},{"type":53,"tag":216,"props":1378,"children":1379},{"class":218,"line":272},[1380],{"type":53,"tag":216,"props":1381,"children":1382},{"emptyLinePlaceholder":328},[1383],{"type":58,"value":331},{"type":53,"tag":216,"props":1385,"children":1386},{"class":218,"line":324},[1387,1391,1395,1400],{"type":53,"tag":216,"props":1388,"children":1389},{"style":235},[1390],{"type":58,"value":161},{"type":53,"tag":216,"props":1392,"children":1393},{"style":229},[1394],{"type":58,"value":139},{"type":53,"tag":216,"props":1396,"children":1397},{"style":345},[1398],{"type":58,"value":1399},"addRule",{"type":53,"tag":216,"props":1401,"children":1402},{"style":235},[1403],{"type":58,"value":868},{"type":53,"tag":216,"props":1405,"children":1406},{"class":218,"line":23},[1407],{"type":53,"tag":216,"props":1408,"children":1409},{"style":229},[1410],{"type":58,"value":1411},"  {\n",{"type":53,"tag":216,"props":1413,"children":1414},{"class":218,"line":361},[1415,1420,1424,1428,1433,1437],{"type":53,"tag":216,"props":1416,"children":1417},{"style":371},[1418],{"type":58,"value":1419},"    type",{"type":53,"tag":216,"props":1421,"children":1422},{"style":229},[1423],{"type":58,"value":429},{"type":53,"tag":216,"props":1425,"children":1426},{"style":229},[1427],{"type":58,"value":253},{"type":53,"tag":216,"props":1429,"children":1430},{"style":256},[1431],{"type":58,"value":1432},"method",{"type":53,"tag":216,"props":1434,"children":1435},{"style":229},[1436],{"type":58,"value":264},{"type":53,"tag":216,"props":1438,"children":1439},{"style":229},[1440],{"type":58,"value":1441},",\n",{"type":53,"tag":216,"props":1443,"children":1444},{"class":218,"line":397},[1445,1450,1454,1458,1463,1467],{"type":53,"tag":216,"props":1446,"children":1447},{"style":371},[1448],{"type":58,"value":1449},"    name",{"type":53,"tag":216,"props":1451,"children":1452},{"style":229},[1453],{"type":58,"value":429},{"type":53,"tag":216,"props":1455,"children":1456},{"style":229},[1457],{"type":58,"value":253},{"type":53,"tag":216,"props":1459,"children":1460},{"style":256},[1461],{"type":58,"value":1462},"login",{"type":53,"tag":216,"props":1464,"children":1465},{"style":229},[1466],{"type":58,"value":264},{"type":53,"tag":216,"props":1468,"children":1469},{"style":229},[1470],{"type":58,"value":1441},{"type":53,"tag":216,"props":1472,"children":1473},{"class":218,"line":490},[1474,1479,1483,1487,1491,1497],{"type":53,"tag":216,"props":1475,"children":1476},{"style":345},[1477],{"type":58,"value":1478},"    clientAddress",{"type":53,"tag":216,"props":1480,"children":1481},{"style":229},[1482],{"type":58,"value":429},{"type":53,"tag":216,"props":1484,"children":1485},{"style":229},[1486],{"type":58,"value":789},{"type":53,"tag":216,"props":1488,"children":1489},{"style":365},[1490],{"type":58,"value":1180},{"type":53,"tag":216,"props":1492,"children":1494},{"style":1493},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[1495],{"type":58,"value":1496}," true",{"type":53,"tag":216,"props":1498,"children":1499},{"style":229},[1500],{"type":58,"value":1441},{"type":53,"tag":216,"props":1502,"children":1503},{"class":218,"line":522},[1504],{"type":53,"tag":216,"props":1505,"children":1506},{"style":229},[1507],{"type":58,"value":684},{"type":53,"tag":216,"props":1509,"children":1510},{"class":218,"line":574},[1511,1516],{"type":53,"tag":216,"props":1512,"children":1513},{"style":930},[1514],{"type":58,"value":1515},"  5",{"type":53,"tag":216,"props":1517,"children":1518},{"style":229},[1519],{"type":58,"value":1441},{"type":53,"tag":216,"props":1521,"children":1522},{"class":218,"line":583},[1523,1528,1532],{"type":53,"tag":216,"props":1524,"children":1525},{"style":930},[1526],{"type":58,"value":1527},"  60000",{"type":53,"tag":216,"props":1529,"children":1530},{"style":229},[1531],{"type":58,"value":291},{"type":53,"tag":216,"props":1533,"children":1534},{"style":1056},[1535],{"type":58,"value":1536},"                  \u002F\u002F 5 attempts per 60s, per IP\n",{"type":53,"tag":216,"props":1538,"children":1539},{"class":218,"line":678},[1540,1544],{"type":53,"tag":216,"props":1541,"children":1542},{"style":235},[1543],{"type":58,"value":389},{"type":53,"tag":216,"props":1545,"children":1546},{"style":229},[1547],{"type":58,"value":269},{"type":53,"tag":61,"props":1549,"children":1550},{},[1551,1553,1559,1561,1567,1569,1574],{"type":58,"value":1552},"Only matcher fields contribute to the rate-limit bucket key. Without\n",{"type":53,"tag":84,"props":1554,"children":1556},{"className":1555},[],[1557],{"type":58,"value":1558},"clientAddress",{"type":58,"value":1560},", ",{"type":53,"tag":84,"props":1562,"children":1564},{"className":1563},[],[1565],{"type":58,"value":1566},"connectionId",{"type":58,"value":1568},", or ",{"type":53,"tag":84,"props":1570,"children":1572},{"className":1571},[],[1573],{"type":58,"value":511},{"type":58,"value":1575},", every matching caller shares one\nglobal bucket. Meteor 3.5+ permits async matcher functions for database-backed\ndecisions; keep their queries fast because the connection waits for them. On\nMeteor 3.0 through 3.4, matchers must stay synchronous. Use a fixed rule,\nprecomputed synchronous state, or upgrade rather than awaiting Mongo there.",{"type":53,"tag":61,"props":1577,"children":1578},{},[1579,1581,1587,1589,1595],{"type":58,"value":1580},"The default rule (5 in 10s for login \u002F signup \u002F password reset) ships\nwith ",{"type":53,"tag":84,"props":1582,"children":1584},{"className":1583},[],[1585],{"type":58,"value":1586},"accounts-base",{"type":58,"value":1588},". Remove with ",{"type":53,"tag":84,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":58,"value":1594},"Accounts.removeDefaultRateLimit()",{"type":58,"value":1596},"\nonly if you replace it.",{"type":53,"tag":67,"props":1598,"children":1600},{"id":1599},"oauth-secret-encryption",[1601],{"type":58,"value":1602},"OAuth secret encryption",{"type":53,"tag":61,"props":1604,"children":1605},{},[1606,1607,1613,1615,1621,1623,1629],{"type":58,"value":124},{"type":53,"tag":84,"props":1608,"children":1610},{"className":1609},[],[1611],{"type":58,"value":1612},"oauth-encryption",{"type":58,"value":1614}," and pass a 16-byte base64 key (NOT 32 bytes) to\n",{"type":53,"tag":84,"props":1616,"children":1618},{"className":1617},[],[1619],{"type":58,"value":1620},"Accounts.config",{"type":58,"value":1622}," at module top level (not inside ",{"type":53,"tag":84,"props":1624,"children":1626},{"className":1625},[],[1627],{"type":58,"value":1628},"Meteor.startup",{"type":58,"value":1630},"):",{"type":53,"tag":205,"props":1632,"children":1634},{"className":1019,"code":1633,"language":1021,"meta":210,"style":210},"meteor node -e \"console.log(require('crypto').randomBytes(16).toString('base64'))\"\n",[1635],{"type":53,"tag":84,"props":1636,"children":1637},{"__ignoreMap":210},[1638],{"type":53,"tag":216,"props":1639,"children":1640},{"class":218,"line":219},[1641,1645,1650,1655,1659,1664],{"type":53,"tag":216,"props":1642,"children":1643},{"style":1031},[1644],{"type":58,"value":8},{"type":53,"tag":216,"props":1646,"children":1647},{"style":256},[1648],{"type":58,"value":1649}," node",{"type":53,"tag":216,"props":1651,"children":1652},{"style":256},[1653],{"type":58,"value":1654}," -e",{"type":53,"tag":216,"props":1656,"children":1657},{"style":229},[1658],{"type":58,"value":253},{"type":53,"tag":216,"props":1660,"children":1661},{"style":256},[1662],{"type":58,"value":1663},"console.log(require('crypto').randomBytes(16).toString('base64'))",{"type":53,"tag":216,"props":1665,"children":1666},{"style":229},[1667],{"type":58,"value":1668},"\"\n",{"type":53,"tag":205,"props":1670,"children":1672},{"className":207,"code":1671,"language":209,"meta":210,"style":210},"import { Accounts } from \"meteor\u002Faccounts-base\";\n\nAccounts.config({\n  oauthSecretKey: Meteor.settings.oauthSecretKey,\n});\n",[1673],{"type":53,"tag":84,"props":1674,"children":1675},{"__ignoreMap":210},[1676,1717,1724,1749,1786],{"type":53,"tag":216,"props":1677,"children":1678},{"class":218,"line":219},[1679,1683,1687,1692,1696,1700,1704,1709,1713],{"type":53,"tag":216,"props":1680,"children":1681},{"style":223},[1682],{"type":58,"value":226},{"type":53,"tag":216,"props":1684,"children":1685},{"style":229},[1686],{"type":58,"value":232},{"type":53,"tag":216,"props":1688,"children":1689},{"style":235},[1690],{"type":58,"value":1691}," Accounts",{"type":53,"tag":216,"props":1693,"children":1694},{"style":229},[1695],{"type":58,"value":243},{"type":53,"tag":216,"props":1697,"children":1698},{"style":223},[1699],{"type":58,"value":248},{"type":53,"tag":216,"props":1701,"children":1702},{"style":229},[1703],{"type":58,"value":253},{"type":53,"tag":216,"props":1705,"children":1706},{"style":256},[1707],{"type":58,"value":1708},"meteor\u002Faccounts-base",{"type":53,"tag":216,"props":1710,"children":1711},{"style":229},[1712],{"type":58,"value":264},{"type":53,"tag":216,"props":1714,"children":1715},{"style":229},[1716],{"type":58,"value":269},{"type":53,"tag":216,"props":1718,"children":1719},{"class":218,"line":272},[1720],{"type":53,"tag":216,"props":1721,"children":1722},{"emptyLinePlaceholder":328},[1723],{"type":58,"value":331},{"type":53,"tag":216,"props":1725,"children":1726},{"class":218,"line":324},[1727,1732,1736,1741,1745],{"type":53,"tag":216,"props":1728,"children":1729},{"style":235},[1730],{"type":58,"value":1731},"Accounts",{"type":53,"tag":216,"props":1733,"children":1734},{"style":229},[1735],{"type":58,"value":139},{"type":53,"tag":216,"props":1737,"children":1738},{"style":345},[1739],{"type":58,"value":1740},"config",{"type":53,"tag":216,"props":1742,"children":1743},{"style":235},[1744],{"type":58,"value":353},{"type":53,"tag":216,"props":1746,"children":1747},{"style":229},[1748],{"type":58,"value":358},{"type":53,"tag":216,"props":1750,"children":1751},{"class":218,"line":23},[1752,1757,1761,1765,1769,1774,1778,1782],{"type":53,"tag":216,"props":1753,"children":1754},{"style":371},[1755],{"type":58,"value":1756},"  oauthSecretKey",{"type":53,"tag":216,"props":1758,"children":1759},{"style":229},[1760],{"type":58,"value":429},{"type":53,"tag":216,"props":1762,"children":1763},{"style":235},[1764],{"type":58,"value":238},{"type":53,"tag":216,"props":1766,"children":1767},{"style":229},[1768],{"type":58,"value":139},{"type":53,"tag":216,"props":1770,"children":1771},{"style":235},[1772],{"type":58,"value":1773},"settings",{"type":53,"tag":216,"props":1775,"children":1776},{"style":229},[1777],{"type":58,"value":139},{"type":53,"tag":216,"props":1779,"children":1780},{"style":235},[1781],{"type":58,"value":174},{"type":53,"tag":216,"props":1783,"children":1784},{"style":229},[1785],{"type":58,"value":1441},{"type":53,"tag":216,"props":1787,"children":1788},{"class":218,"line":361},[1789,1793,1797],{"type":53,"tag":216,"props":1790,"children":1791},{"style":229},[1792],{"type":58,"value":479},{"type":53,"tag":216,"props":1794,"children":1795},{"style":235},[1796],{"type":58,"value":389},{"type":53,"tag":216,"props":1798,"children":1799},{"style":229},[1800],{"type":58,"value":269},{"type":53,"tag":61,"props":1802,"children":1803},{},[1804,1806,1812,1814,1820,1822,1828,1830,1836,1838,1844],{"type":58,"value":1805},"At startup, ",{"type":53,"tag":84,"props":1807,"children":1809},{"className":1808},[],[1810],{"type":58,"value":1811},"accounts-oauth",{"type":58,"value":1813}," seals an unsealed provider application secret at\n",{"type":53,"tag":84,"props":1815,"children":1817},{"className":1816},[],[1818],{"type":58,"value":1819},"ServiceConfiguration.configurations.secret",{"type":58,"value":1821},". Provider packages also seal\nsupported per-user token fields, such as ",{"type":53,"tag":84,"props":1823,"children":1825},{"className":1824},[],[1826],{"type":58,"value":1827},"services.github.accessToken",{"type":58,"value":1829}," or\nTwitter's ",{"type":53,"tag":84,"props":1831,"children":1833},{"className":1832},[],[1834],{"type":58,"value":1835},"accessTokenSecret",{"type":58,"value":1837},". There is no generic\n",{"type":53,"tag":84,"props":1839,"children":1841},{"className":1840},[],[1842],{"type":58,"value":1843},"Meteor.users.services.\u003Cprovider>.secret",{"type":58,"value":1845}," field. Inspect the provider schema\nbefore asserting which user credential is encrypted.",{"type":53,"tag":67,"props":1847,"children":1848},{"id":130},[1849],{"type":53,"tag":84,"props":1850,"children":1852},{"className":1851},[],[1853],{"type":58,"value":130},{"type":53,"tag":205,"props":1855,"children":1857},{"className":1019,"code":1856,"language":1021,"meta":210,"style":210},"meteor add audit-argument-checks\n",[1858],{"type":53,"tag":84,"props":1859,"children":1860},{"__ignoreMap":210},[1861],{"type":53,"tag":216,"props":1862,"children":1863},{"class":218,"line":219},[1864,1868,1872],{"type":53,"tag":216,"props":1865,"children":1866},{"style":1031},[1867],{"type":58,"value":8},{"type":53,"tag":216,"props":1869,"children":1870},{"style":256},[1871],{"type":58,"value":1038},{"type":53,"tag":216,"props":1873,"children":1874},{"style":256},[1875],{"type":58,"value":1876}," audit-argument-checks\n",{"type":53,"tag":61,"props":1878,"children":1879},{},[1880,1882,1887],{"type":58,"value":1881},"Throws if any method or publication runs without ",{"type":53,"tag":84,"props":1883,"children":1885},{"className":1884},[],[1886],{"type":58,"value":89},{"type":58,"value":1888}," covering\nevery argument. Methods that legitimately accept arbitrary input declare\nthis explicitly:",{"type":53,"tag":205,"props":1890,"children":1892},{"className":207,"code":1891,"language":209,"meta":210,"style":210},"Meteor.methods({\n  rawLog(...args) {\n    check(args, [Match.Any]);\n    \u002F\u002F ...\n  },\n});\n",[1893],{"type":53,"tag":84,"props":1894,"children":1895},{"__ignoreMap":210},[1896,1919,1945,1992,2000,2007],{"type":53,"tag":216,"props":1897,"children":1898},{"class":218,"line":219},[1899,1903,1907,1911,1915],{"type":53,"tag":216,"props":1900,"children":1901},{"style":235},[1902],{"type":58,"value":9},{"type":53,"tag":216,"props":1904,"children":1905},{"style":229},[1906],{"type":58,"value":139},{"type":53,"tag":216,"props":1908,"children":1909},{"style":345},[1910],{"type":58,"value":348},{"type":53,"tag":216,"props":1912,"children":1913},{"style":235},[1914],{"type":58,"value":353},{"type":53,"tag":216,"props":1916,"children":1917},{"style":229},[1918],{"type":58,"value":358},{"type":53,"tag":216,"props":1920,"children":1921},{"class":218,"line":272},[1922,1927,1932,1937,1941],{"type":53,"tag":216,"props":1923,"children":1924},{"style":371},[1925],{"type":58,"value":1926},"  rawLog",{"type":53,"tag":216,"props":1928,"children":1929},{"style":229},[1930],{"type":58,"value":1931},"(...",{"type":53,"tag":216,"props":1933,"children":1934},{"style":381},[1935],{"type":58,"value":1936},"args",{"type":53,"tag":216,"props":1938,"children":1939},{"style":229},[1940],{"type":58,"value":389},{"type":53,"tag":216,"props":1942,"children":1943},{"style":229},[1944],{"type":58,"value":394},{"type":53,"tag":216,"props":1946,"children":1947},{"class":218,"line":324},[1948,1952,1956,1960,1964,1969,1974,1978,1983,1988],{"type":53,"tag":216,"props":1949,"children":1950},{"style":345},[1951],{"type":58,"value":403},{"type":53,"tag":216,"props":1953,"children":1954},{"style":371},[1955],{"type":58,"value":353},{"type":53,"tag":216,"props":1957,"children":1958},{"style":235},[1959],{"type":58,"value":1936},{"type":53,"tag":216,"props":1961,"children":1962},{"style":229},[1963],{"type":58,"value":291},{"type":53,"tag":216,"props":1965,"children":1966},{"style":371},[1967],{"type":58,"value":1968}," [",{"type":53,"tag":216,"props":1970,"children":1971},{"style":235},[1972],{"type":58,"value":1973},"Match",{"type":53,"tag":216,"props":1975,"children":1976},{"style":229},[1977],{"type":58,"value":139},{"type":53,"tag":216,"props":1979,"children":1980},{"style":235},[1981],{"type":58,"value":1982},"Any",{"type":53,"tag":216,"props":1984,"children":1985},{"style":371},[1986],{"type":58,"value":1987},"])",{"type":53,"tag":216,"props":1989,"children":1990},{"style":229},[1991],{"type":58,"value":269},{"type":53,"tag":216,"props":1993,"children":1994},{"class":218,"line":23},[1995],{"type":53,"tag":216,"props":1996,"children":1997},{"style":1056},[1998],{"type":58,"value":1999},"    \u002F\u002F ...\n",{"type":53,"tag":216,"props":2001,"children":2002},{"class":218,"line":361},[2003],{"type":53,"tag":216,"props":2004,"children":2005},{"style":229},[2006],{"type":58,"value":684},{"type":53,"tag":216,"props":2008,"children":2009},{"class":218,"line":397},[2010,2014,2018],{"type":53,"tag":216,"props":2011,"children":2012},{"style":229},[2013],{"type":58,"value":479},{"type":53,"tag":216,"props":2015,"children":2016},{"style":235},[2017],{"type":58,"value":389},{"type":53,"tag":216,"props":2019,"children":2020},{"style":229},[2021],{"type":58,"value":269},{"type":53,"tag":67,"props":2023,"children":2025},{"id":2024},"anti-patterns",[2026],{"type":58,"value":2027},"Anti-patterns",{"type":53,"tag":2029,"props":2030,"children":2031},"ul",{},[2032,2050,2076,2097,2110,2115],{"type":53,"tag":78,"props":2033,"children":2034},{},[2035,2041,2042,2048],{"type":53,"tag":84,"props":2036,"children":2038},{"className":2037},[],[2039],{"type":58,"value":2040},"Collection.allow",{"type":58,"value":189},{"type":53,"tag":84,"props":2043,"children":2045},{"className":2044},[],[2046],{"type":58,"value":2047},"Collection.deny",{"type":58,"value":2049}," rules. Legacy; easy to combine\ninto a soft-fail. Replace with methods.",{"type":53,"tag":78,"props":2051,"children":2052},{},[2053,2059,2061,2067,2069,2075],{"type":53,"tag":84,"props":2054,"children":2056},{"className":2055},[],[2057],{"type":58,"value":2058},"Meteor.settings.public.\u003Csecret>",{"type":58,"value":2060},". The client sees ",{"type":53,"tag":84,"props":2062,"children":2064},{"className":2063},[],[2065],{"type":58,"value":2066},"public",{"type":58,"value":2068},". Move\nsecrets to the top level of ",{"type":53,"tag":84,"props":2070,"children":2072},{"className":2071},[],[2073],{"type":58,"value":2074},"settings.json",{"type":58,"value":139},{"type":53,"tag":78,"props":2077,"children":2078},{},[2079,2081,2087,2089,2095],{"type":58,"value":2080},"Publish the entire ",{"type":53,"tag":84,"props":2082,"children":2084},{"className":2083},[],[2085],{"type":58,"value":2086},"Meteor.users",{"type":58,"value":2088}," collection. Always project (e.g.\n",{"type":53,"tag":84,"props":2090,"children":2092},{"className":2091},[],[2093],{"type":58,"value":2094},"fields: { username: 1, profile: 1 }",{"type":58,"value":2096},") and filter. Publish email only to\nthe owning user or another explicitly authorized audience.",{"type":53,"tag":78,"props":2098,"children":2099},{},[2100,2102,2108],{"type":58,"value":2101},"Use ",{"type":53,"tag":84,"props":2103,"children":2105},{"className":2104},[],[2106],{"type":58,"value":2107},"BrowserPolicy.content.allowOriginForAll",{"type":58,"value":2109}," for a third-party script. It\ngrants the origin to every current content directive. Allow only the script,\nframe, connect, image, style, or font directives the integration needs.",{"type":53,"tag":78,"props":2111,"children":2112},{},[2113],{"type":58,"value":2114},"Methods that accept callback-shaped arguments. Functions cannot travel\nover DDP.",{"type":53,"tag":78,"props":2116,"children":2117},{},[2118,2120,2126,2128,2133],{"type":58,"value":2119},"Call ",{"type":53,"tag":84,"props":2121,"children":2123},{"className":2122},[],[2124],{"type":58,"value":2125},"Accounts.config({ oauthSecretKey })",{"type":58,"value":2127}," inside ",{"type":53,"tag":84,"props":2129,"children":2131},{"className":2130},[],[2132],{"type":58,"value":1628},{"type":58,"value":2134},".\nMust be at module top level so it loads before the OAuth packages\nread it.",{"type":53,"tag":67,"props":2136,"children":2138},{"id":2137},"see-also",[2139],{"type":58,"value":2140},"See also",{"type":53,"tag":2029,"props":2142,"children":2143},{},[2144,2153,2161,2170],{"type":53,"tag":78,"props":2145,"children":2146},{},[2147],{"type":53,"tag":84,"props":2148,"children":2150},{"className":2149},[],[2151],{"type":58,"value":2152},"references\u002Fmethod-and-publish-guards.md",{"type":53,"tag":78,"props":2154,"children":2155},{},[2156],{"type":53,"tag":84,"props":2157,"children":2159},{"className":2158},[],[2160],{"type":58,"value":1320},{"type":53,"tag":78,"props":2162,"children":2163},{},[2164],{"type":53,"tag":84,"props":2165,"children":2167},{"className":2166},[],[2168],{"type":58,"value":2169},"references\u002Feval-cases.md",{"type":53,"tag":78,"props":2171,"children":2172},{},[2173,2175,2181,2182,2188,2189,2195],{"type":58,"value":2174},"Related skills: ",{"type":53,"tag":84,"props":2176,"children":2178},{"className":2177},[],[2179],{"type":58,"value":2180},"meteor-methods",{"type":58,"value":1560},{"type":53,"tag":84,"props":2183,"children":2185},{"className":2184},[],[2186],{"type":58,"value":2187},"meteor-pubsub",{"type":58,"value":1560},{"type":53,"tag":84,"props":2190,"children":2192},{"className":2191},[],[2193],{"type":58,"value":2194},"meteor-accounts",{"type":58,"value":139},{"type":53,"tag":2197,"props":2198,"children":2199},"style",{},[2200],{"type":58,"value":2201},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2203,"total":2361},[2204,2218,2232,2243,2257,2274,2287,2301,2316,2327,2340,2347],{"slug":2194,"name":2194,"fn":2205,"description":2206,"org":2207,"tags":2208,"stars":23,"repoUrl":24,"updatedAt":2217},"implement authentication in Meteor apps","Use when wiring up authentication in a Meteor 3 app. Triggers on accounts-password, accounts-base, OAuth (Google, Facebook, GitHub, Apple, Twitter, Meetup, Weibo), accounts-2fa, accounts-passwordless, ServiceConfiguration.configurations.upsertAsync, Accounts.createUserAsync, Accounts.setPasswordAsync, Accounts.forgotPassword, Accounts.resetPassword, Accounts.verifyEmail, useHttpOnlyCookies, clientStorage, Meteor.loginWithPasswordAnd2faCode, email verification. Use this skill when the user asks about signups, signins, or asks about token storage vs HttpOnly cookies.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2209,2210,2213,2214],{"name":17,"slug":18,"type":15},{"name":2211,"slug":2212,"type":15},"Authentication","authentication",{"name":9,"slug":8,"type":15},{"name":2215,"slug":2216,"type":15},"OAuth","oauth","2026-08-28T15:08:40.058032",{"slug":2219,"name":2219,"fn":2220,"description":2221,"org":2222,"tags":2223,"stars":23,"repoUrl":24,"updatedAt":2231},"meteor-blaze","build and debug Meteor Blaze interfaces","Use when building or debugging Blaze interfaces in Meteor 3: meteor create --blaze, Spacebars templates, Template helpers and events, lifecycle hooks, Tracker, ReactiveVar or ReactiveDict, template subscriptions, Promise helpers, #let async states, Template.dynamic, Blaze.render, and blaze-hot HMR with the Meteor bundler. Triggers on stale async helper results, lost reactivity after await, data-context lookup surprises, duplicate DOM integrations after HMR, Rspack full reloads, or raw HTML in triple braces. Use this skill when the user asks about reusable Blaze components, current Blaze packages, Rspack entry imports, or testing Blaze templates. For Meteor 2 to 3 upgrades, use migrate-to-meteor-3 instead.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2224,2227,2228],{"name":2225,"slug":2226,"type":15},"Frontend","frontend",{"name":9,"slug":8,"type":15},{"name":2229,"slug":2230,"type":15},"Web Development","web-development","2026-08-28T15:09:37.601349",{"slug":2233,"name":2233,"fn":2234,"description":2235,"org":2236,"tags":2237,"stars":23,"repoUrl":24,"updatedAt":2242},"meteor-community-packages","manage Meteor community packages","Use when choosing, evaluating, adopting, configuring, or debugging a package from Meteor's documented community catalog, or moving from a community package to a promoted core package such as roles. Triggers on community package recommendations, Atmosphere vs npm selection, Packosphere maintenance checks, jam:* helpers, Meteor.publish.once, Meteor.publish.stream, meteor-rpc, Wormhole, cluster, and mail-preview. Use this skill when the user asks which maintained package fits or how its documented integration works. Route Meteor 2-to-3 package failures to migrate-to-meteor-3 and underlying core API design to its owning skill.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2238,2241],{"name":2239,"slug":2240,"type":15},"Engineering","engineering",{"name":9,"slug":8,"type":15},"2026-08-28T15:08:45.28079",{"slug":2244,"name":2244,"fn":2245,"description":2246,"org":2247,"tags":2248,"stars":23,"repoUrl":24,"updatedAt":2256},"meteor-debugging","diagnose failures in Meteor 3 applications","Use when diagnosing an unexplained failure in a Meteor 3 application before the failing layer or fix is known. Triggers on server crashes, client-only errors, stuck subscriptions, DDP or WebSocket disconnects, Minimongo\u002Fserver data mismatches, hanging or flaky tests, slow builds, --inspect, console.log, .only, Playwright traces, or requests to debug a Meteor app. Use this skill when evidence must distinguish Meteor tool, server, client, data, test, browser, mobile, or production boundaries. For test setup and authoring use meteor-testing; after confirming a domain cause, hand the repair to the owning skill.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2249,2252,2253],{"name":2250,"slug":2251,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":2254,"slug":2255,"type":15},"WebSockets","websockets","2026-08-28T15:08:40.430401",{"slug":2258,"name":2258,"fn":2259,"description":2260,"org":2261,"tags":2262,"stars":23,"repoUrl":24,"updatedAt":2273},"meteor-deployment","deploy Meteor 3 applications","Use when deploying a Meteor 3 application. Triggers on meteor build, meteor deploy, Galaxy Push to Deploy, Galaxy Mode, Repository Mode, DEPLOY_HOSTNAME, Docker, Kubernetes, settings.json, METEOR_SETTINGS, MONGO_URL, MONGO_OPLOG_URL, ROOT_URL, PORT, HTTP_FORWARDED_COUNT, NODE_OPTIONS, health checks, pre-deploy commands, hot code push, --architecture os.linux.x86_64, --server-only, or a deployed Node.js version mismatch. Use this skill when the user asks about shipping the app, asks about production config, or asks about containerizing.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2263,2266,2269,2272],{"name":2264,"slug":2265,"type":15},"Deployment","deployment",{"name":2267,"slug":2268,"type":15},"Docker","docker",{"name":2270,"slug":2271,"type":15},"Kubernetes","kubernetes",{"name":9,"slug":8,"type":15},"2026-08-28T15:08:44.881769",{"slug":2180,"name":2180,"fn":2275,"description":2276,"org":2277,"tags":2278,"stars":23,"repoUrl":24,"updatedAt":2286},"author and debug Meteor methods","Use when authoring or debugging Meteor methods (Meteor.methods, Meteor.call, Meteor.callAsync). Triggers on argument validation with check(), optimistic UI stubs, latency compensation, Meteor.Error handling, and DDPRateLimiter. Use this skill when the user asks about server-side mutation, asks about rate limiting RPC, or asks about wrapping a method with auth checks.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2279,2282,2285],{"name":2280,"slug":2281,"type":15},"API Development","api-development",{"name":2283,"slug":2284,"type":15},"Backend","backend",{"name":9,"slug":8,"type":15},"2026-08-28T15:09:38.691128",{"slug":2288,"name":2288,"fn":2289,"description":2290,"org":2291,"tags":2292,"stars":23,"repoUrl":24,"updatedAt":2300},"meteor-modern-build-stack","configure Meteor 3 modern build stacks","Use when configuring or tuning the Meteor 3 modern build stack: SWC transpiler, SWC-based minifier, modern @parcel\u002Fwatcher, web-arch skipping in development, .meteorignore, and the Rspack bundler integration via the rspack Atmosphere package. Triggers on package.json \"meteor\": { \"modern\": true }, .swcrc, swc.config.js, [Transpiler] Used Babel Fallback logs, rspack.config.js, rspack.config.ts, defineConfig from @meteorjs\u002Frspack, Meteor.compileWith* helpers, Meteor.extendConfig, Meteor.extendSwcConfig vs Meteor.replaceSwcConfig, Meteor.splitVendorChunk, Meteor.persistDevFiles, Meteor.disablePlugins, Meteor.enablePortableBuild, HtmlRspackPlugin customization, RSPACK_DEVSERVER_PORT, TOOL_NODE_FLAGS for OOM, modern\u002Flegacy archs. Use this skill when the user asks about enabling the modern build stack, asks about SWC vs Babel in Meteor, asks about Rspack integration setup, or asks about customizing rspack.config.js. For converting an existing app's code to be Rspack-compatible, use migrate-to-rspack instead.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2293,2296,2297],{"name":2294,"slug":2295,"type":15},"Build","build",{"name":9,"slug":8,"type":15},{"name":2298,"slug":2299,"type":15},"Performance","performance","2026-08-28T15:09:42.877439",{"slug":2302,"name":2302,"fn":2303,"description":2304,"org":2305,"tags":2306,"stars":23,"repoUrl":24,"updatedAt":2315},"meteor-mongo-minimongo","author and debug Meteor MongoDB queries","Use when authoring or debugging Mongo queries in Meteor 3. Triggers on Mongo.Collection, find\u002FfindOne, server async vs client Minimongo sync, oplog vs change streams, indexes, selectors, modifiers, projections. Use this skill when the user asks about Mongo on the server or asks about Minimongo on the client.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2307,2310,2311,2312],{"name":2308,"slug":2309,"type":15},"Database","database",{"name":2250,"slug":2251,"type":15},{"name":9,"slug":8,"type":15},{"name":2313,"slug":2314,"type":15},"MongoDB","mongodb","2026-08-28T15:08:44.473981",{"slug":2187,"name":2187,"fn":2317,"description":2318,"org":2319,"tags":2320,"stars":23,"repoUrl":24,"updatedAt":2326},"author and debug Meteor publications","Use when authoring or debugging Meteor publications and subscriptions (Meteor.publish, Meteor.subscribe). Triggers on publication strategies (SERVER_MERGE, NO_MERGE, NO_MERGE_NO_HISTORY), the low-level publish API (added\u002Fchanged\u002Fremoved), cursor authorization, reactive joins, leaked documents. Use this skill when the user asks about pub\u002Fsub or asks about reactive data fetching.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2321,2322,2323],{"name":2283,"slug":2284,"type":15},{"name":9,"slug":8,"type":15},{"name":2324,"slug":2325,"type":15},"Real-time","real-time","2026-08-28T15:09:37.97396",{"slug":2328,"name":2328,"fn":2329,"description":2330,"org":2331,"tags":2332,"stars":23,"repoUrl":24,"updatedAt":2339},"meteor-react","build and debug Meteor React interfaces","Use when building or debugging React interfaces in Meteor 3: meteor create --react, createRoot, JSX or TSX entry points, Rspack React detection, Fast Refresh, react-meteor-data, useTracker, useSubscribe, useFind, withTracker, Suspense, and Tracker.withComputation. Triggers on isLoading being treated as a boolean, useFind receiving fetch(), stale closure inputs, duplicate tracker side effects, unstable Suspense keys, lost reactivity after await, state reset after refresh, or React tests leaking computations. Use this skill when the user asks about a React skeleton, React-specific rspack.config rules, reactive data hooks, or classic versus Suspense integration. Route general bundler configuration to meteor-modern-build-stack and Meteor 2 upgrades to migrate-to-meteor-3.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2333,2334,2335,2338],{"name":2225,"slug":2226,"type":15},{"name":9,"slug":8,"type":15},{"name":2336,"slug":2337,"type":15},"React","react",{"name":2229,"slug":2230,"type":15},"2026-08-28T15:09:37.193947",{"slug":4,"name":4,"fn":5,"description":6,"org":2341,"tags":2342,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2343,2344,2345,2346],{"name":17,"slug":18,"type":15},{"name":21,"slug":22,"type":15},{"name":9,"slug":8,"type":15},{"name":13,"slug":14,"type":15},{"slug":2348,"name":2348,"fn":2349,"description":2350,"org":2351,"tags":2352,"stars":23,"repoUrl":24,"updatedAt":2360},"meteor-testing","write and repair Meteor test harnesses","Use when setting up, designing, writing, or repairing tests and test harnesses in a Meteor 3 app. Triggers on meteortesting:mocha, --driver-package, TEST_WATCH, TEST_BROWSER_DRIVER, MOCHA_GREP, meteor.testModule, focused tests, .only, Meteor.server.method_handlers, Meteor.server.publish_handlers, DDP.connect, --full-app integration mode, sinon, async test signatures, Playwright\u002FCypress E2E. Use this skill when the user asks about test runners, asks about testing publications, or asks about Jest vs Mocha in Meteor. For a failing, hanging, or flaky test whose failing layer or root cause is unknown, use meteor-debugging before changing the test or app.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2353,2354,2357],{"name":9,"slug":8,"type":15},{"name":2355,"slug":2356,"type":15},"QA","qa",{"name":2358,"slug":2359,"type":15},"Testing","testing","2026-08-28T15:09:38.330724",14,{"items":2363,"total":2361},[2364,2371,2377,2382,2388,2395,2401],{"slug":2194,"name":2194,"fn":2205,"description":2206,"org":2365,"tags":2366,"stars":23,"repoUrl":24,"updatedAt":2217},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2367,2368,2369,2370],{"name":17,"slug":18,"type":15},{"name":2211,"slug":2212,"type":15},{"name":9,"slug":8,"type":15},{"name":2215,"slug":2216,"type":15},{"slug":2219,"name":2219,"fn":2220,"description":2221,"org":2372,"tags":2373,"stars":23,"repoUrl":24,"updatedAt":2231},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2374,2375,2376],{"name":2225,"slug":2226,"type":15},{"name":9,"slug":8,"type":15},{"name":2229,"slug":2230,"type":15},{"slug":2233,"name":2233,"fn":2234,"description":2235,"org":2378,"tags":2379,"stars":23,"repoUrl":24,"updatedAt":2242},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2380,2381],{"name":2239,"slug":2240,"type":15},{"name":9,"slug":8,"type":15},{"slug":2244,"name":2244,"fn":2245,"description":2246,"org":2383,"tags":2384,"stars":23,"repoUrl":24,"updatedAt":2256},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2385,2386,2387],{"name":2250,"slug":2251,"type":15},{"name":9,"slug":8,"type":15},{"name":2254,"slug":2255,"type":15},{"slug":2258,"name":2258,"fn":2259,"description":2260,"org":2389,"tags":2390,"stars":23,"repoUrl":24,"updatedAt":2273},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2391,2392,2393,2394],{"name":2264,"slug":2265,"type":15},{"name":2267,"slug":2268,"type":15},{"name":2270,"slug":2271,"type":15},{"name":9,"slug":8,"type":15},{"slug":2180,"name":2180,"fn":2275,"description":2276,"org":2396,"tags":2397,"stars":23,"repoUrl":24,"updatedAt":2286},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2398,2399,2400],{"name":2280,"slug":2281,"type":15},{"name":2283,"slug":2284,"type":15},{"name":9,"slug":8,"type":15},{"slug":2288,"name":2288,"fn":2289,"description":2290,"org":2402,"tags":2403,"stars":23,"repoUrl":24,"updatedAt":2300},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2404,2405,2406],{"name":2294,"slug":2295,"type":15},{"name":9,"slug":8,"type":15},{"name":2298,"slug":2299,"type":15}]