LoopBack and an admin user

2
votes

I'm working through the LoopBack docs found here. I'm not following the docs to build the apps covered, rather, I'm applying the concepts to something of my own.

I have the following models:

  1. SuperUser => extends the built in User model
  2. Profile => extends the built in User model
  3. Account => a LoopBack PersistedModel
  4. Transaction => a

Brief:

I do not want an authenticated instance Profile to be able to to access the endpoint Profile GET /Profiles. I do not want Profile to be able to have access to information about all of the Profile(s). So, I've proposed SuperUser, which should be able to access the endpoint Profile GET /Profiles through the implementation of a Role.

Standing:

This is what I have so far:

A function to create SuperUser, and a Role with name of admin. That role is then assigned to the created SuperUser.

function createSuperUser(){
  SuperUser.create([
    {email: "[email protected]", username:"reubs", password: 'password'}
  ], function(err, users) {
    if (err) throw err;

    console.log('Created user:', users);

    //create the admin role
    Role.create({
      name: 'admin'
    }, function(err, role) {
      if (err) throw err;

      console.log('Created role:', role);

      role.principals.create({
        principalType: RoleMapping.USER,
        principalId: users[0].id
      }, function(err, principal) {
        if (err) throw err;

        console.log('Created principal:', principal);
      });
    });
  });
}

My profile.json where the dynamic role $owner is used in the acls to try and make sure that Profile can only get what it owns. Not also the inclusion of the admin rule in the acls.

{
  "name": "Profile",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {},
  "validations": [],
  "relations": {
    "accounts": {
      "type": "hasMany",
      "model": "Account",
      "foreignKey": "profileId"
    }
  },
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    },
    {
      "accessType": "EXECUTE",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW",
      "property": "find"
    }
  ],
  "methods": {}
}

Issue:

This setup is allowing an authenticated Profile to access the endpoint Profile GET /Profiles

Goal:

I only want SuperUser to be able to really have complete control over the Projects API endpoint. I.e. SuperUser should be able to get all Profiles etc.

Thanks in advance, Reubs

1
loopbackjsloopback

1 Answers

0
votes

In your Profile.js file you should implement some method that accepts the current/source profile id that is attempting to make a request (which you would get from the current context). Compare the profile id being requested and the current profile id. If they match, send back the data.

Be sure to add the name of the validation method in your json. For example: "property": "[find, yourProfileValidationMethod]". In addition, you can add the "model": "Profile" property within your json to make this rule specific to this model.

I hope this answers most of your questions. If you would like more help, please let me know.