Loopback - ACL - 'property' default value in DB table?

Question

I am maintaining my ACL data(My model's ACL list) in mysql database. It is working fine with what role i mention for the remote methods(property column).

For some models, i have to deny access for all remote methods of a model. For these usecase's, what shall I mention in property column for that model in Table?

Normally in case, if we maintain the ACL of models in its json, and if we need to deny all remote methods access for that specific model, then we just dont need to mention the 'property' value. It will deny access for all remote methods.

Denying all remote methods:

{
  "accessType": "*",
  "principalType": "ROLE",
  "principalId": "$unauthenticated",
  "permission": "DENY"
}

Denying particular Remote method 'getDistrict':

{
  "accessType": "READ",
  "principalType": "ROLE",
  "principalId": "$unauthenticated",
  "permission": "DENY",
  "property": "getDistrict"
}

However, in case of Database table, what i have to mention in property column if i need to deny access to all remote methods of a model ? ('ALL' , or '*' or left blank ?)

Also, Please correct me if i am wrong anywhere.

Thank you

Unknown Unknown · Accepted Answer · 2018-03-21T13:51:22

https://loopback.io/doc/en/lb3/Controlling-data-access.html#user-access-types

For other methods, the default access type is EXECUTE;

for example, a custom method maps to the EXECUTE access type.

So to deny use of all remote methods

{
  "accessType": "EXECUTE",
  "principalType": "ROLE",
  "principalId": "$everyone",
  "permission": "DENY"
}

EDIT: To actually answer the question, you don't store anything because accessType: "EXECUTE" covers all custom remote methods.

This line in the acl source suggests they don't do wildcard matching for properties

var isMatchingMethodName = props[i] === 'property' &&
        req.methodNames.indexOf(ruleValue) !== -1;

Loopback - ACL - 'property' default value in DB table?

1 Answers