LoopBack ACL not working

0
votes

I created a model MyUser inherited from LoopBack User model. In boot script I created a user in MyUser model, custom role and mapped that role to it. But the ACL is not working after assigning in MyUser.json file.

Bootscript.js

'use strict';

module.exports = function(app) {

var User = app.models.MyUser;
var Role = app.models.Role;
var RoleMapping = app.models.RoleMapping;
User.findOrCreate({ name: "Administrator", email: "[email protected]", username: "admin", password: "12345" }, function(err, succ) {
    if (err) {
        console.log(err);
    } else {
        Role.create({ name: "superUser" }, function(err, role) {
            if (err) {
                console.log(err);
            } else {
                console.log("Role created successfuly");
                role.principals.create({ principalType: RoleMapping.USER, principalId: succ.id }, function(err, success) {
                    if (err) {
                        console.log(err);
                    } else {
                        console.log("role mapped successfuly");
                    }
                });
            }
        });
    }
});

};

MyUser.json

"acls": [
{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "superUser",
  "permission": "ALLOW"
}
]

But when I access MyUser.find (get all users) method in api explorer it says

{
"error": {
"statusCode": 401,
"name": "Error",
"message": "Authorization Required",
"code": "AUTHORIZATION_REQUIRED",
"stack": "Error: Authorization Required\n    at ...
}
}

What am I doing wrong?

2
javascriptjsonnode.jsloopbackjsstrongloop

2 Answers

0
votes

I think 401 returns, Because the findOrCreate does't return the created instance id.

Try to console the succ.id and if this is the case use upsert instead

0
votes

User have few ACLs by default. You need first to clear it. They store here

  app.models.User.settings.acls = [];

Try this in boot