Loopback ACL hide 'apikey' column

0
votes

I have a user model with one of the columns is 'apikey'. I just want that 'apikey' can be accessed only by its user.
Should I use a different model such as 'Account' which columns are 'apikey' and its id, and make ACL to that model?
Or, should I tweak the remote method?
Any suggestions on how to do that?

1
loopbackjs

1 Answers

0
votes

I would delete the property apikey before giving the response to the client, based on user permissions.

This is a code example, you should adapt it to your needs.

User.afterRemote('findById', (context, user, next) => {
  let userId = context.req.accessToken.userId
  
  if (!userId || user.id !== userId) {
    context.result.apykey = undefined
  }

  next()
})