{"action":"created","issue":{"url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/209","repository_url":"https://api.github.com/repos/kahmali/meteor-restivus","labels_url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/209/labels{/name}","comments_url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/209/comments","events_url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/209/events","html_url":"https://github.com/kahmali/meteor-restivus/issues/209","id":154813545,"number":209,"title":"authRequired: true returning \"You must be logged in to do this.\" when valid X-Auth-Token and X-User-Id headers submitted","user":{"login":"leanwebtools","id":16844654,"avatar_url":"https://avatars.githubusercontent.com/u/16844654?v=3","gravatar_id":"","url":"https://api.github.com/users/leanwebtools","html_url":"https://github.com/leanwebtools","followers_url":"https://api.github.com/users/leanwebtools/followers","following_url":"https://api.github.com/users/leanwebtools/following{/other_user}","gists_url":"https://api.github.com/users/leanwebtools/gists{/gist_id}","starred_url":"https://api.github.com/users/leanwebtools/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leanwebtools/subscriptions","organizations_url":"https://api.github.com/users/leanwebtools/orgs","repos_url":"https://api.github.com/users/leanwebtools/repos","events_url":"https://api.github.com/users/leanwebtools/events{/privacy}","received_events_url":"https://api.github.com/users/leanwebtools/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-13T22:38:16Z","updated_at":"2016-05-14T04:58:34Z","closed_at":null,"body":"New to Meteor, getting used to things, like the look of **restivus**. \r\n\r\nI've set up a simple test to try out authenticated access but I seem to run into an issue when adding **authRequired: true** to **routeOptions** or an **endpoint**.\r\n\r\nHere's the code (basically your example added to a new meteor app, with the addition of an Organization collection):\r\n\r\n```js\r\n    import { Meteor } from 'meteor/meteor';\r\n    \r\n    Organizations = new Mongo.Collection('organizations');\r\n    \r\n    Meteor.startup(() => {\r\n    \r\n        if (Meteor.isServer) {\r\n    \r\n            var Api = new Restivus({\r\n                apiPath: 'api/',\r\n                version: 'v1',\r\n                auth: {\r\n                    token: 'auth.apiKey',\r\n                    user: function () {\r\n                        return {\r\n                            userId: this.request.headers['user-id'],\r\n                            token: this.request.headers['login-token']\r\n                        };\r\n                    }\r\n                },\r\n                defaultHeaders: {\r\n                    'Content-Type': 'application/json'\r\n                },\r\n                onLoggedIn: function () {\r\n                    console.log(this.user.username + ' (' + this.userId + ') logged in');\r\n                },\r\n                onLoggedOut: function () {\r\n                    console.log(this.user.username + ' (' + this.userId + ') logged out');\r\n                },\r\n                prettyJson: true,\r\n                useDefaultAuth: true,\r\n                enableCors: true\r\n            });\r\n    \r\n            // Generates: POST on /api/users and GET, DELETE /api/users/:id for\r\n            // Meteor.users collection\r\n            Api.addCollection(Meteor.users, {\r\n                excludedEndpoints: ['getAll', 'put'],\r\n                routeOptions: {\r\n                    authRequired: true\r\n                },\r\n                endpoints: {\r\n                    post: {\r\n                        authRequired: false\r\n                    },\r\n                    delete: {\r\n                        roleRequired: 'admin'\r\n                    }\r\n                }\r\n            });\r\n    \r\n            // Generates: GET, POST on /api/organizations and GET, PUT, DELETE on\r\n            // /api/organizations/:id for the organizations collection\r\n            Api.addCollection(Organizations, {\r\n                excludedEndpoints: ['put', 'post', 'delete'],\r\n                routeOptions: {\r\n                    authRequired: true\r\n                }\r\n            });\r\n    \r\n        }\r\n    \r\n    });\r\n```\r\n\r\nEverything appears to work fine ... I run the app, then use Postman to add a user. \r\n\r\nAll OK so far. \r\n\r\nThen, I go to: **http://localhost:3000/api/v1/login** and make a POST request with the body\r\n```\r\n{\r\n    \"password\": \"password\",\r\n    \"email\": \"user@user.com\"\r\n}\r\n```\r\nThis gives me what I expect to see:\r\n```\r\n{\r\n  \"status\": \"success\",\r\n  \"data\": {\r\n    \"authToken\": \"6Do263Poqthl7kGqrI1AnHsDir9LrrmWhdKIiyCepRs\",\r\n    \"userId\": \"4ETkH9k4pcqGesdie\"\r\n  }\r\n}\r\n```\r\nNext step is where I appear to run into trouble ... when I submit a GET request (via Postman) to **http://localhost:3000/api/v1/organizations** with the following headers:\r\n```\r\nContent-Type: application/json\r\nX-Auth-Token: 6Do263Poqthl7kGqrI1AnHsDir9LrrmWhdKIiyCepRs\r\nX-User-Id: 4ETkH9k4pcqGesdie\r\n```\r\nBut this is what I get back:\r\n```\r\n{\r\n  \"status\": \"error\",\r\n  \"message\": \"You must be logged in to do this.\"\r\n}\r\n```\r\nIf I set authRequired: false I get:\r\n```\r\n{\r\n  \"status\": \"success\",\r\n  \"data\": []\r\n}\r\n```\r\nWhich is what I expect to see after logging in and using the Token / UserId with **authRequired: true** in place.\r\n\r\nI'm probably make a newb mistake but can't quite see what I'm doing wrong. \r\n\r\nIs there an additional header I should be using in Postman, an error in the code somewhere, or something else going on that I need to fix?\r\n\r\nThanks in advance for your help!\r\n"},"comment":{"url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/comments/219200886","html_url":"https://github.com/kahmali/meteor-restivus/issues/209#issuecomment-219200886","issue_url":"https://api.github.com/repos/kahmali/meteor-restivus/issues/209","id":219200886,"user":{"login":"kahmali","id":935297,"avatar_url":"https://avatars.githubusercontent.com/u/935297?v=3","gravatar_id":"","url":"https://api.github.com/users/kahmali","html_url":"https://github.com/kahmali","followers_url":"https://api.github.com/users/kahmali/followers","following_url":"https://api.github.com/users/kahmali/following{/other_user}","gists_url":"https://api.github.com/users/kahmali/gists{/gist_id}","starred_url":"https://api.github.com/users/kahmali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kahmali/subscriptions","organizations_url":"https://api.github.com/users/kahmali/orgs","repos_url":"https://api.github.com/users/kahmali/repos","events_url":"https://api.github.com/users/kahmali/events{/privacy}","received_events_url":"https://api.github.com/users/kahmali/received_events","type":"User","site_admin":false},"created_at":"2016-05-14T04:58:34Z","updated_at":"2016-05-14T04:58:34Z","body":"Hey there! Welcome to Meteor! Hope you're enjoying it as much as I do! 😄 \r\n\r\nPretty easy one to fix. You overrode the default API config with some demo options that I recommend you don't use (I warned against it in the docs right above [the section that code came from](https://github.com/kahmali/meteor-restivus#coffeescript-1), but I should probably make the warning bigger and bolder to make it more conspicuous). Believe it or not, you'd get the configuration you wanted by just doing the following:\r\n\r\n```js\r\nvar Api = new Restivus({\r\n  version: 'v1',\r\n  useDefaultAuth: true\r\n});    \r\n\r\n// ...\r\n// setup your routes/collections\r\n```\r\n\r\n**That's it!** Everything else looks good there. Try that on for size and let me know how it works out."}}