loopback bug acl not working?

Question

i m try to implement acl for model(named as company)

      "relations": {
       "user": {
       "type": "belongsTo",
       "model": "user",
       "foreignKey": "company_id"
     }
   },
      "acls": [
           {
          "accessType": "*",
          "principalType": "ROLE",
          "principalId": "$everyone",
          "permission": "DENY"
        },
     {
         "accessType": "*",
         "principalType": "ROLE",
         "principalId": "$owner",
          "permission": "ALLOW"
      }
   ],

deny all user and access only to authenticated user owner of that object . here i m also try to add permission for super user who have all permission in short admin and owner of objec(data) can do crud is there any soultion for this please help

Anouar Kacem Anouar Kacem · Accepted Answer · 2018-03-11T10:24:35

You can deny all unauthenticated users then deny everyone and allow only the owner like below :

{
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$unauthenticated",
      "permission": "DENY"
},

{
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
},   

{
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
}

you need only CRUD for the $owner, you can assign the properties needed for your user as below :

    {
              "accessType": "*",
              "principalType": "ROLE",
              "principalId": "$owner",
              "permission": "ALLOW",
              "property": [
                 "find",
                 "create",
                 "updateAll",
                 "delete"
          ]
    }

For the super user you should create this Role and assign it to one of your users.

{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "superuser",
  "permission": "ALLOW"
}

How to create a ROLE ? you can follow the documentation here.

And make sure that you have this file /server/boot/autentication.jsand authetication is enabled : server.enableAuth()

'use strict';

module.exports = function enableAuthentication(server) {
  // enable authentication
  server.enableAuth();
};

For more ACL tricks please read the official documentation here.

loopback bug acl not working?

1 Answers