Only allow users on a given email domain to log in to your meteor app.

meteor-account-verify.js

/* 
Only allow users with a verified email address on a pre-verified domain to log in.

We're getting people to authenticate and only authorising those that have an email we recognise.

Assumes a Meteor.settings like:
  { adminDomains: ['tableflip.io', 'meteor.com'] }

...and meteor-developer accounts, but other login mechanisms (email, twitter) would work too.
*/

// Only allow logins for `adminDomain` users
Accounts.validateLoginAttempt(function (info) {
  return canHasAccess(info.user)
})

function canHasAccess (user) {
  if (!user) return false
  if (!user.services['meteor-developer'].emails) return false
  return user.services['meteor-developer'].emails.some(verifyEmail)
}

// Check the email is part of a domain configured with admin rights
function verifyEmail (email) {
  if (!email.verified) return false

  var emailDomain = email.address.split('@')[1]

  var adminDomains = Meteor.settings.adminDomains

  return adminDomains.some(function (adminDomain) {
    return emailDomain === adminDomain
  })
}