如何在Meteor应用A中禁止修改远程生产集合，仅保留读取权限

Alright, let's tackle this problem step by step. You want app A to only read data from app B's production collection, with zero ability to modify it—plus, if your note about "even modifications from B's server" means you don't want A to see updates from B either, we'll cover that too.

1. Block All Write Operations from App A #

First, we need to make sure app A can't send any insert, update, remove, or upsert requests to the remote collection. There are two solid ways to do this:

Option 1: Override Write Methods in App A #

In both the client and server code of app A, when you define the remote collection, overwrite its write methods to throw an error immediately. This stops any accidental or intentional write attempts dead in their tracks:

// In App A (client AND server)
const RemoteCollection = new Mongo.Collection('your-collection-name');

// Disable all write operations
RemoteCollection.insert = () => {
  throw new Error('Permission Denied: This collection is read-only for App A');
};

RemoteCollection.update = () => {
  throw new Error('Permission Denied: This collection is read-only for App A');
};

RemoteCollection.remove = () => {
  throw new Error('Permission Denied: This collection is read-only for App A');
};

RemoteCollection.upsert = () => {
  throw new Error('Permission Denied: This collection is read-only for App A');
};

Option 2: Lock Permissions on App B's Server (If You Have Access) #

If you can modify app B's server code, this is the more secure approach—you lock down the collection at the source, so even if app A has a bug, B will reject all write requests. Use Meteor's allow/deny rules:

// In App B's server code
const RemoteCollection = new Mongo.Collection('your-collection-name');

// Allow read access (add user/API key validation here if needed)
RemoteCollection.allow({
  find: (userId) => {
    // Example: Only allow requests from App A's authenticated clients
    return isValidAppAClient(userId); // Replace with your actual check
  }
});

// Deny ALL write operations
RemoteCollection.deny({
  insert: () => true,
  update: () => true,
  remove: () => true
});

This ensures no write requests—from any client, including A—are ever processed by B's server.

2. Stop Receiving Updates from App B (If Required) #

If your goal includes making sure app A never sees changes made to the collection by B's server (i.e., A gets a static snapshot), here's how to do that:

Option 1: One-Time Subscription (No Real-Time Sync) #

In app A's client, subscribe to the collection, then immediately stop the subscription once the initial data loads. This means A only gets the snapshot at subscription time, no future updates:

// In App A's client
const sub = Meteor.subscribe('remote-collection-snapshot', {
  onReady: () => {
    // Data is loaded—stop listening for updates
    sub.stop();
  }
});

And in app B's server, publish the collection data (add filters if you don't need the entire set):

// In App B's server
Meteor.publish('remote-collection-snapshot', function() {
  return RemoteCollection.find(); // Add your query here if needed
});

Option 2: Ignore Local Updates (Less Efficient) #

If you need to keep the subscription active but ignore changes, you can observe the collection and block updates locally:

// In App A's client
RemoteCollection.find().observe({
  added: () => false, // Ignore new documents
  changed: () => false, // Ignore updates to existing docs
  removed: () => false // Ignore deleted docs
});

Note: This still sends update data from B to A—it just doesn't apply them locally, so it's less efficient than stopping the subscription.

Quick Security Tips #

• Never expose B's DB credentials in App A: Always use Meteor's publish/subscribe system instead of direct DB connections—exposing credentials is a huge security risk.
• Validate App A's identity: In B's publish/allow rules, add checks like API keys or OAuth tokens to ensure only your legitimate App A can access the collection.
• Test all edge cases: Double-check that no third-party packages or hidden code paths in App A can trigger write operations on the remote collection.

内容的提问来源于stack exchange，提问作者sonlexqt