Merge pull request #1381 from bbc/fix/meteor-allow-deny

jstarpl · web-flow · commit 2addb105e6f1 · 2025-03-20T16:17:05.000+01:00
fix(Core): simplify meteor collection auth checks
diff --git a/.github/actions/setup-meteor/action.yaml b/.github/actions/setup-meteor/action.yaml
@@ -3,5 +3,5 @@ description: "Setup Meteor"
 runs:
   using: "composite"
   steps:
-    - run: curl "https://install.meteor.com/?release=3.1" | sh
+    - run: curl "https://install.meteor.com/?release=3.1.2" | sh
       shell: bash
diff --git a/.node-version b/.node-version
@@ -1 +1 @@
-22.11
+22.13.1
diff --git a/meteor/.meteor/packages b/meteor/.meteor/packages
@@ -8,14 +8,14 @@
 
 # but you can also edit it by hand.
 
-meteor@2.0.1
-webapp@2.0.3
+meteor@2.1.0
+webapp@2.0.5
 ddp@1.4.2
 
-mongo@2.0.2 # The database Meteor supports right now
+mongo@2.1.0 # The database Meteor supports right now
 
-ecmascript@0.16.9 # Enable ECMAScript2015+ syntax in app code
-typescript@5.4.3 # Enable TypeScript syntax in .ts and .tsx modules
+ecmascript@0.16.10 # Enable ECMAScript2015+ syntax in app code
+typescript@5.6.3 # Enable TypeScript syntax in .ts and .tsx modules
 
 tracker@1.3.4 # Meteor's client-side reactive programming library
 
diff --git a/meteor/.meteor/release b/meteor/.meteor/release
@@ -1 +1 @@
-METEOR@3.1
+METEOR@3.1.2
diff --git a/meteor/.meteor/versions b/meteor/.meteor/versions
@@ -1,5 +1,5 @@
-allow-deny@2.0.0
-babel-compiler@7.11.2
+allow-deny@2.1.0
+babel-compiler@7.11.3
 babel-runtime@1.5.2
 base64@1.0.13
 binary-heap@1.0.12
@@ -8,9 +8,9 @@ callback-hook@1.6.0
 check@1.4.4
 core-runtime@1.0.0
 ddp@1.4.2
-ddp-client@3.0.3
+ddp-client@3.1.0
 ddp-common@1.4.4
-ddp-server@3.0.3
+ddp-server@3.1.0
 diff-sequence@1.1.3
 dynamic-import@0.7.4
 ecmascript@0.16.10
@@ -24,26 +24,26 @@ geojson-utils@1.0.12
 id-map@1.2.0
 inter-process-messaging@0.1.2
 logging@1.3.5
-meteor@2.0.2
+meteor@2.1.0
 minimongo@2.0.2
-modern-browsers@0.1.11
+modern-browsers@0.2.0
 modules@0.20.3
 modules-runtime@0.13.2
-mongo@2.0.3
+mongo@2.1.0
 mongo-decimal@0.2.0
 mongo-dev-server@1.1.1
 mongo-id@1.0.9
-npm-mongo@6.10.0
+npm-mongo@6.10.2
 ordered-dict@1.2.0
 promise@1.0.0
 random@1.2.2
 react-fast-refresh@0.2.9
 reload@1.3.2
 retry@1.1.1
 routepolicy@1.1.2
-socket-stream-client@0.5.3
+socket-stream-client@0.6.0
 tracker@1.3.4
 typescript@5.6.3
-webapp@2.0.4
+webapp@2.0.5
 webapp-hashing@1.1.2
 zodern:types@1.0.13
diff --git a/meteor/Dockerfile b/meteor/Dockerfile
@@ -15,7 +15,7 @@ RUN yarn install && yarn build
 
 # BUILD IMAGE
 FROM node:22
-RUN curl "https://install.meteor.com/?release=3.1" | sh
+RUN curl "https://install.meteor.com/?release=3.1.2" | sh
 
 # Temporary change the NODE_ENV env variable, so that all libraries are installed:
 ENV NODE_ENV_TMP $NODE_ENV
diff --git a/meteor/package.json b/meteor/package.json
@@ -3,7 +3,7 @@
 	"version": "1.53.0-in-development",
 	"private": true,
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"scripts": {
 		"preinstall": "node -v",
diff --git a/meteor/server/collections/collection.ts b/meteor/server/collections/collection.ts
@@ -112,13 +112,10 @@ function setupCollectionAllowRules<DBInterface extends { _id: ProtectedString<an
 
 	const { /* insert: origInsert,*/ update: origUpdate /*remove: origRemove*/ } = args
 
-	// These methods behave weirdly, we need to mangle this a bit.
-	// See https://github.com/meteor/meteor/issues/13444 for a full explanation
-	const options: any /*Parameters<Mongo.Collection<DBInterface>['allow']>[0]*/ = {
-		update: () => false,
-		updateAsync: origUpdate
-			? (userId: string | null, doc: DBInterface, fieldNames: string[], modifier: any) =>
-					origUpdate(protectString(userId), doc, fieldNames as any, modifier) as any
+	const options: Parameters<Mongo.Collection<DBInterface>['allow']>[0] = {
+		update: origUpdate
+			? async (userId: string | null, doc: DBInterface, fieldNames: string[], modifier: any) =>
+					origUpdate(protectString(userId), doc, fieldNames as any, modifier)
 			: () => false,
 	}
 
diff --git a/package.json b/package.json
@@ -4,7 +4,7 @@
 	"license": "MIT",
 	"private": true,
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"scripts": {
 		"postinstall": "run install:packages && run install:meteor",
diff --git a/packages/blueprints-integration/package.json b/packages/blueprints-integration/package.json
@@ -29,7 +29,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/corelib/package.json b/packages/corelib/package.json
@@ -30,7 +30,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/documentation/package.json b/packages/documentation/package.json
@@ -15,7 +15,7 @@
 		"write-heading-ids": "docusaurus write-heading-ids"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"devDependencies": {
 		"@docusaurus/core": "3.7.0",
diff --git a/packages/job-worker/package.json b/packages/job-worker/package.json
@@ -31,7 +31,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/live-status-gateway/package.json b/packages/live-status-gateway/package.json
@@ -37,7 +37,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"keywords": [
 		"broadcast",
diff --git a/packages/meteor-lib/package.json b/packages/meteor-lib/package.json
@@ -30,7 +30,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/mos-gateway/package.json b/packages/mos-gateway/package.json
@@ -48,7 +48,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"keywords": [
 		"mos",
diff --git a/packages/playout-gateway/package.json b/packages/playout-gateway/package.json
@@ -40,7 +40,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"keywords": [
 		"broadcast",
diff --git a/packages/server-core-integration/package.json b/packages/server-core-integration/package.json
@@ -48,7 +48,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/shared-lib/package.json b/packages/shared-lib/package.json
@@ -29,7 +29,7 @@
 		"license-validate": "run -T sofie-licensecheck"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	},
 	"files": [
 		"/dist",
diff --git a/packages/webui/package.json b/packages/webui/package.json
@@ -114,6 +114,6 @@
 		"xml2js": "^0.6.2"
 	},
 	"engines": {
-		"node": ">=22.11"
+		"node": ">=22.13.1"
 	}
 }
diff --git a/packages/webui/vite.config.mts b/packages/webui/vite.config.mts
@@ -55,6 +55,7 @@ export default defineConfig({
 	},
 
 	server: {
+		allowedHosts: true,
 		proxy: {
 			'/api': 'http://127.0.0.1:3000',
 			'/site.webmanifest': 'http://127.0.0.1:3000',

-Original file line number
+Diff line change
 # but you can also edit it by hand.
 -meteor@2.0.1
 -[email protected].3
 +meteor@2.1.0
 +[email protected].5
 [email protected]
 -mongo@2.0.2 # The database Meteor supports right now
 +mongo@2.1.0 # The database Meteor supports right now
 -[email protected].9 # Enable ECMAScript2015+ syntax in app code
 -typescript@5.4.3 # Enable TypeScript syntax in .ts and .tsx modules
 +[email protected].10 # Enable ECMAScript2015+ syntax in app code
 +typescript@5.6.3 # Enable TypeScript syntax in .ts and .tsx modules
 [email protected] # Meteor's client-side reactive programming library
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-[email protected]`
	`1`	`+[email protected].2`