Accessing a distant relation using $owner in loopback

0
votes

I just started using loopback, and I am stuck with ACL. My database has a relation like so:

  • User has many tests and tests have many users ( many to many, in loopback I am using hasmanythrough).
  • Each test has several sections (one to many)
  • Each section has several question(one to many)

Now, I want to get all sections that a user has , or all questions that a user has. I know that using $owner needs a belongsTo in the respective model, but in my case that is not possible. Is there any way to achieve this without having to completely write my own queries ?

1
loopbackjs
Why is belongsTo in the respective model not possible? Anyway, you could write something similar to $owner yourself using a dynamic role resolver. Would that work for you? - Ivan Schwarz

1 Answers

0
votes

Unfortunately the $owner role doesn't work as a filter, but as security access to end-points when an instance ID is specified; basically it only works when you perform a findById, but not when you perform a find.

Example:

GET /api/tests/ does nothing. The current user sees ALL The tests. No filtering is performed

GET /api/tests/{id} checks that the currently logged in userId corresponds to the userId in the test you are trying to retrieve. If the userIds match, then the user can view this particular test. if they do not match then you get an AUTHORIZATION_REQUIRED or ACCESS_DENIED error (I can't remember which).

as I just wrote in this question, you might want to look at creating a Mixin.