How do I implement custom dynamic roles in loopback?

Question

I am trying to create a dynamic role in loopback similar to the one in the example project on access control.

I have two models called Documents and Teams. Each team owns multiple Documents and I have several teams.

I want to restrict CRUD access to only documents that belong to the team. Creating a TeamMember role seems like the way to go but the example in the doc maps only a single model operation (findById) to the custom role. How does one define a role encompassing all CRUD operations?

Also, is custom roles the best way to do this type access control or I am missing something?

Answer 1

I've implemented a solution using operation hooks. Specifically, create a access hook and changed the query object to restrict access using a where clause.