Fine grained permissions in Loopback

Question

I am using Loopback for a REST API and am trying to configure more fine grained permission than just assigning users to app wide groups. Something like this is what I have in mind for the client side:

USER: Bob ID: 123

MODEL    |   READ | WRITE | EXECUTE
-----------------------------------
Projects |    Y   |   Y    |   N
Changes  |    N   |   N    |   N
Companies|    Y   |   Y    |   Y
ThingOne |    Y   |   N    |   N
ThingTwo |    Y   |   Y    |   N

Where an admin can toggle permission for a single user for single models.

One idea I've tried is adding individual ACL groups for every model, ie for model Projects

"acls": [
{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$everyone",
  "permission": "DENY",
  "property": "find"
},
{
  "accessType": "READ",
  "principalType": "ROLE",
  "principalId": "projects-read-access",
  "permission": "ALLOW",
  "property": "find"
},
{
  "accessType": "WRITE",
  "principalType": "ROLE",
  "principalId": "projects-write-access",
  "permission": "ALLOW",
  "property": "find"
},
{
  "accessType": "EXECUTE",
  "principalType": "ROLE",
  "principalId": "projects-execute-access",
  "permission": "ALLOW",
  "property": "find"
}
],

and then matching Roles with RoleMapping, but this seems wrong and cumbersome. Any advice on the best way to go about this is appreaciated, Thanks

Antonio Trapani Antonio Trapani · Accepted Answer · 2018-01-17T00:41:44

Because an admin can toggle permission for a single user for single models, you need a database table to store permissions for users. Then, you can create a dynamic role that checks for the right permissions: http://loopback.io/doc/en/lb3/Defining-and-using-roles.html#dynamic-roles

Fine grained permissions in Loopback

1 Answers