add token authentication, only admin can use api

server/authentication.js

@@ -0,0 +1,21 @@
+Meteor.startup(() => {
+  Authentication = {};
+
+  Authentication.checkUserId = function (userId) {
+    if (userId === undefined) {
+      const error = new Meteor.Error('Unauthorized', 'Unauthorized');
+      error.statusCode = 401;
+      throw error;
+    }
+    const admin = Users.findOne({ _id: userId, isAdmin: true });
+
+    if (admin === undefined) {
+      const error = new Meteor.Error('Forbidden', 'Forbidden');
+      error.statusCode = 403;
+      throw error;
+    }
+
+  };
+
+});
+