How to use Loopback ACL model/table?

Question

I'm trying to setup access control for my rest API. Loopback provides a great starting point for handling access based on user/role/principals.

But what if I want anything more than provided, e.g. multiple owners for a model instance? Would adding entries to the ACL table be enough? Or should I create a new role/resolver, and if so, can/should I reuse the existing ACL model/table or roll my own?

Loopback is awesome, but documentation lacks depth, ending you up reading the source code.

Farid Nouri Neshat Farid Nouri Neshat · Accepted Answer · 2016-09-24T17:23:03

Well in this particular case I suggest creating a custom role resolver.

Something like this:

Role.registerResolver('$inOwners', function (role, ctx, callback) {
  ctx.model.count({
    id: ctx.modelId,

    // This only works for mongo db...
    owners: ctx.accessToken.userId
  }, function(err, count) {
    if (err) {
      callback(err);
    } else if (count) {
      callback();
    } else {
      callback(new Error('Not Owner'));
    }
  });
});

And then you can either add this to the acls(Either in the models static acls, in the json file, or add it to the ACL table):

{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$inOwners",
  "permission": "ALLOW",
  "property": "*",
  "model": "*"
}

Do remember, that whenever the access to a loopback method depends on what's inside a document/row then you can only use role resolvers to define ACL for it, else you have to make your own ACL system.

How to use Loopback ACL model/table?

1 Answers