HasMany relation entry point unauthorized on Loopback

Question

New to Loopback, I tried to make a simple API with a user model and a todo model.

The user model, named Todoer,is based on the built-in User model. create a todoer, login, logout, etc. works like a charm. The Todo model is based on PersistedModel with no special ACLs on it for the moment.

I made a Belongs To relation from Todo model to Todoer model to have an ownership. I made also a HasMany relation from Todoer to Todo to be able to retrieve all the todos of a user through the endpoint GET /Todoer/{id}/todos

With a todoer logged in, with the good token and id, I can easily have responses from Todoer endpoints reserved for logged users, like GET /Todoer/{id} for example, so I'm sure the authentication mechanism is working well.

But each time I want to hit GET /Todoer/{id}/todos, I only obtain a error message telling I'm not authorized. I'm always sure I gave the good token and Todoer Id obtained at login.

Even if I make a big ACL telling OK to everything to all on the Todoer model, it happens the same.

What did I miss ? I can't figure it out...

Thank you for your help...

Can you share your ACLs or even whole Todoer.json, Todo.json files? It looks fine on a first sight. When accessing a related model, the active ACL is still the one for the model you are calling. Therefore allowing all on Todoer should open related Todos completely. — Ivan Schwarz
Ok. Here is the todoer.json :{ ` "name": "Todoer",` ` "base": "User",` ` "idInjection": true,` ` "options": {` ` "validateUpsert": true` ` },` ` "properties": {},` ` "validations": [],` ` "relations": {` ` "todos": {` ` "type": "hasMany",` ` "model": "Todo",` ` "foreignKey": "todoerId"` ` }` ` },` ` "acls": [` ` {` ` "accessType": "*",` ` "principalType": "ROLE",` ` "principalId": "$everyone",` ` "permission": "ALLOW"` ` }` ` ],` ` "methods": {}` } — stefsouron
And here is the todo.json : { "name": "Todo", "base": "PersistedModel", "idInjection": true, "options": { "validateUpsert": true }, "properties": { "text": { "type": "string", "required": true }, "done": { "type": "boolean", "default": false } }, "validations": [], "relations": { "todoer": { "type": "belongsTo", "model": "Todoer", "foreignKey": "todoerId" } }, "acls": [], "methods": {} } — stefsouron
In order to try to understand, you can see in the ACLs I've opened everything on todoer model. But when I hit GET todoer/Id/todos, I still obtain this : { "error": { "statusCode": 401, "name": "Error", "message": "Autorisation requise", "code": "AUTHORIZATION_REQUIRED", "stack": "Error: Autorisation requise\n [...] } } — stefsouron
You could've also edit your question to get a code formatting, but thank you! I've posted my answer. I hope it helps! — Ivan Schwarz

Ivan Schwarz Ivan Schwarz · Accepted Answer · 2017-08-02T14:41:49

You need to take into account ACLs of a built-in Usermodel. You are actually running into its general DENY ACL rule. It takes priority over your general ALLOW ACL rule (docs on ACL rule precedence).

You can write more specific ACL rule to get pass it (docs on Accessing related models).

{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$everyone",
  "permission": "ALLOW",
  "property": "__get__todos"
}

Another option, which might be in this case more convenient and safe, is to use a dynamic $owner role on Todo itself (docs on Dynamic roles).

{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$owner",
  "permission": "ALLOW"
}

If you want to understand what is happening regarding to ACLs in your application, it's very useful to set a DEBUG environment variable to loopback:security:* to enable quite extensive security logging.

HasMany relation entry point unauthorized on Loopback

1 Answers