Users can't view non-owner api

[marla-singer]

Users can't view the api page, which they are not the owners. Is it bug or feature?

Step to reproduce:

1. Create the new user without administrator roles
2. Go to [https://nightly.apinf.io/api/AfYunEcjD3QaEb5D7](my api view)

Found result: Spinner always switch on and api view isn't showed

Expected Result: Api view must be showed

[bajiat]

@frenchbread Would you be interested in this task?

[frenchbread]

@bajiat self-assigned

[frenchbread]

This issue happening for a reason not being able to fetch ProxyBackend document since it contains user privileges check.

Here is a publication that causes this bug:

Meteor.publish('apiProxySettings', function (apiId) {
  // TODO: determine how to use 'api.userCanEdit()' helper
  // which uses 'Meteor.userId()' instead of 'this.userId'

  // Placeholders for manager and admin checks
  let userIsManager, userIsAdmin;

  // Get current userId
  const userId = this.userId;

  // Check that user is logged in
  if (userId) {
    // Get API document
    const api = Apis.findOne(apiId);

    // Check if user is API manager
    userIsManager = _.includes(api.managerIds, userId);

    // Check if user is administrator
    userIsAdmin = Roles.userIsInRole(userId, ['admin']);

    // Check if user is authorized to access API proxy settings
    if (userIsManager || userIsAdmin) {
      return ProxyBackends.find({ apiId });
    }
  }
});

@brylie What can you suggest here? I think it's okay to return proxy backend data no-matter how's viewing it (authorised or non-authorised user). If we don't want to share this publication to non-authorised user, we'll have to block access to the entire API page (e.g. to redirect user or rise 404 page)

[brylie]

@frenchbread we may need to call this.ready() in the else statement, so that the publication tells any waiting subscriptions that it has completed:

...
// Check that user is logged in
if (userId) {
  ...
} else {
  // Tell awaiting subscriptions that publication is done
  return this.ready();
}


See, Meteor Guide: [Publications and Data Loading - Complex authorization](https://guide.meteor.com/data-loading.html#complex-auth)