Created
February 19, 2015 18:33
-
-
Save blainsmith/40d304416b8e576a6fe1 to your computer and use it in GitHub Desktop.
LoopBack ACL with $owner
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "name": "Book", | |
| "base": "PersistedModel", | |
| "idInjection": true, | |
| "properties": { | |
| "title": { | |
| "type": "string", | |
| "required": true | |
| }, | |
| "value": { | |
| "type": [ | |
| "object" | |
| ], | |
| "required": true | |
| } | |
| }, | |
| "validations": [], | |
| "relations": { | |
| "member": { | |
| "type": "belongsTo", | |
| "model": "Member", | |
| "foreignKey": "memberId" | |
| } | |
| }, | |
| "acls": [ | |
| { | |
| "accessType": "*", | |
| "principalType": "ROLE", | |
| "principalId": "$owner", | |
| "permission": "ALLOW" | |
| } | |
| ], | |
| "methods": [] | |
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "name": "Member", | |
| "base": "User", | |
| "idInjection": true, | |
| "properties": {}, | |
| "validations": [], | |
| "relations": { | |
| "books": { | |
| "type": "hasMany", | |
| "model": "Book", | |
| "foreignKey": "memberId" | |
| } | |
| }, | |
| "acls": [], | |
| "methods": [] | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I thought that when posting with an access token that would get translated and automatically used on all the CRUD methods.
So if I had a access token XXX that was for Member with ID: 5 then...
POST /books -H 'Authorization: XXX' -d '{ "title": "Book Title" }would create a book that looks like{ "id": 1, "memberId": 5, "title": "Book Title" }Then if I were to perform
GET /books -H 'Authorization: XXX'I would get ONLY the books with"memberId": 5since they were the owner of the object and created it initially with their own access token.