{"action":"created","issue":{"url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/9","labels_url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/9/comments","events_url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/9/events","html_url":"https://github.com/sandstorm-io/meteor-accounts-sandstorm/issues/9","id":111324699,"number":9,"title":"Does not work with anonymous user permissions","user":{"login":"rchrd2","id":182479,"avatar_url":"https://avatars.githubusercontent.com/u/182479?v=3","gravatar_id":"","url":"https://api.github.com/users/rchrd2","html_url":"https://github.com/rchrd2","followers_url":"https://api.github.com/users/rchrd2/followers","following_url":"https://api.github.com/users/rchrd2/following{/other_user}","gists_url":"https://api.github.com/users/rchrd2/gists{/gist_id}","starred_url":"https://api.github.com/users/rchrd2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rchrd2/subscriptions","organizations_url":"https://api.github.com/users/rchrd2/orgs","repos_url":"https://api.github.com/users/rchrd2/repos","events_url":"https://api.github.com/users/rchrd2/events{/privacy}","received_events_url":"https://api.github.com/users/rchrd2/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-10-14T05:09:35Z","updated_at":"2015-12-28T18:14:42Z","closed_at":null,"body":"I noticed that this doesn't work with anonymous users. For example, my app is receiving the following headers, but the library takes no action, because there isn't a sandstorm-user-id (see https://github.com/sandstorm-io/meteor-accounts-sandstorm/blob/master/server.js#L48).\r\n\r\n```\r\n{ connection: 'close',\r\n  'accept-encoding': 'gzip',\r\n  'accept-language': 'en-US,en;q=0.5',\r\n  'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:41.0) Gecko/20100101 Firefox/41.0',\r\n  'x-sandstorm-username': 'Anonymous%20User',\r\n  'x-sandstorm-permissions': 'modify',\r\n  'x-sandstorm-base-path': 'http://35bea8c9f81f01acf2b0ee2914c81cbd.local.sandstorm.io:6080',\r\n  host: '35bea8c9f81f01acf2b0ee2914c81cbd.local.sandstorm.io:6080',\r\n  'x-forwarded-proto': 'http',\r\n  'x-sandstorm-session-id': '0',\r\n  accept: '*/*' }\r\n```\r\n\r\nI noticed this bug when I shared an edit link to a TextEditor grain, but the user who received the link could not edit the text.\r\n\r\nAs I think about this, ideally there wouldn't have to be a new User doc for every anonymous user. So maybe it is better for apps that want to support anonymous users to just check the headers manually. \r\n\r\nI'm not really sure how to proceed. If there are no code changes, a note in the README about anonymous users would be great. \r\n\r\nDo you have any ideas? \r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/comments/167618310","html_url":"https://github.com/sandstorm-io/meteor-accounts-sandstorm/issues/9#issuecomment-167618310","issue_url":"https://api.github.com/repos/sandstorm-io/meteor-accounts-sandstorm/issues/9","id":167618310,"user":{"login":"rchrd2","id":182479,"avatar_url":"https://avatars.githubusercontent.com/u/182479?v=3","gravatar_id":"","url":"https://api.github.com/users/rchrd2","html_url":"https://github.com/rchrd2","followers_url":"https://api.github.com/users/rchrd2/followers","following_url":"https://api.github.com/users/rchrd2/following{/other_user}","gists_url":"https://api.github.com/users/rchrd2/gists{/gist_id}","starred_url":"https://api.github.com/users/rchrd2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rchrd2/subscriptions","organizations_url":"https://api.github.com/users/rchrd2/orgs","repos_url":"https://api.github.com/users/rchrd2/repos","events_url":"https://api.github.com/users/rchrd2/events{/privacy}","received_events_url":"https://api.github.com/users/rchrd2/received_events","type":"User","site_admin":false},"created_at":"2015-12-28T18:14:42Z","updated_at":"2015-12-28T18:14:42Z","body":"I dug into this problem and also tried Meteor Headers. Unfortunately, the Headers provided by Meteor headers are only available during the first DDP connection. If the client disconnects and reconnects and forms a new DDP connection, those headers are no longer available. \r\n\r\nThe permissions need to be stored in some sort of session object, and it turns out the built-in user model is the easiest place to store this, because it is global variable that's available in many functions. \r\n\r\nFor my solution, I did end up generating an Anonymous User. I store this user ID in local storage, so that only one Anonymous User is created per connected user. I then store the permissions in this user model, and update these permissions everytime they connect to the application.\r\n\r\nHere you can see what is happening on the server:\r\nhttps://github.com/rchrd2/TextEditor/blob/polymer/server/sandstorm_helpers.js\r\n\r\nHere is example client code (apologies is it is confusing, because it is using Polymer with Meteor). Just search for \"localStorage\":\r\nhttps://github.com/rchrd2/TextEditor/blob/polymer/public/components/x-main.html\r\n\r\nThis solution has worked well so far. Perhaps something like this can be ported into this library.\r\n\r\n"}}