async authenticateWithPassword(root, args, context) {
      if (context && context.userId) {
        throw new Error('User already logged in');
      }
      const { input } = args;
      if (!input) {
        throw new Error('Empty input');
      }
      const { email, password } = input;
      if (!(password && typeof password === 'string')) {
        throw new Error('Invalid password');
      }
      if (!email) {
        throw new Error('Invalid email');
      }
      const authResult = await authenticateWithPassword(email, password);
      // set an HTTP-only cookie so the user is authenticated
      const { /*userId,*/ token } = authResult;
      const tokenCookie = {
        path: '/',
        httpOnly: true,
        secure: process.env.NODE_ENV === 'development' ? false : true,
        // expires: //
        //sameSite: ''
      };
      context.req.res.cookie('meteor_login_token', token, tokenCookie);
      return authResult;
    }
Mutation for the user to manage its own account.

Note: we don't have impersonating features yet, nor user enrollment or user email validation.