0

i defined a user model that inherits from the built-in User model of loopback and i defined a hasMany relation to another model. The problem i am facing is that no matter what i do, when i am trying to access the relation from the rest api i am getting unauthorized error, even when i defined the following ACL to the user model: json { "accessType": "READ", "principalType": "ROLE", "principalId": "$everyone", "permission": "ALLOW" }

Any idea?

How can I expose some methods of the user model that I would like to be accessible to user? On other model (which don't inherit from the User model) i don't face this problem.

Thanks

Jordan Kasper
  • 13,153
  • 3
  • 36
  • 55
Roi Ezra
  • 506
  • 1
  • 5
  • 11

1 Answers1

1

The relation injects a method into the object and thus it need access to execute that method. When you give it access to READ it only applies to the properties of that model and not to the methods which need EXECUTE permissions. Try this:

{
  "accessType": "EXECUTE",
  "principalType": "ROLE",
  "principalId": "$everyone",
  "permission": "ALLOW",
  "property": "__get_relation"
}

Replace in the property param the "relation" with the actual relation name and "get" with the actual http method you want this ACL to give access to.

You can also debug the ACLs by starting you application like this:

$ DEBUG=loopback:security:acl slc run
Alexandru Savin
  • 636
  • 5
  • 11