Strongloop/Loopback - Override User model via boot script

01-override-User-model.js

module.exports = function(app) {
  var User = app.models.User;

  // TODO: (1) find an example of how to add new "properties" to the built-in User mode via boot script

  // (2) This is how you can add a "relationship" to the built-in User model via boot script
  var SomeOtherModel = app.models.SomeOtherModel;
  User.hasMany(SomeOtherModel, {as: 'someOtherModels', foreignKey: 'someOtherModelId'});

  // (3) This is how you can add "remote methods" to the built-in User model via boot script
  // (3a) either
  User.greet = function(msg, cb) {
    cb(null, 'Greetings... ' + msg);
  }
  // (3a) or
  User.remoteMethod(
    'greet',
    {
      accepts: {arg: 'msg', type: 'string'},
      returns: {arg: 'greeting', type: 'string'}
    }
  );

  // (4) This is a low-level/dynamic way to add "remoting" for any of the built-in models via boot script
  //     reference: https://groups.google.com/forum/#!topic/loopbackjs/0yHzU7PR19U
  //     *** UN-TESTED BY THE ORIGINAL AUTHOR OF THIS GIST ***
  /*var remotes = app.remotes();
  remotes.after('**', function(ctx, next, method) {
    var req = ctx.req;
    var Model = method.ctor;
    var modelInstance = ctx.instance;
    if (Model.modelName === 'MyModel') {
      // ...
    }
    next();
  });*/

  // (5) This is how you can add "hooks" to the built-in User model via boot script
  User.beforeCreate = function(next, modelInstance) {
    console.log('inside User.beforeCreate');
    // your code goes here
    next();
  };

  // (6) This is how you can add "event observers" to the built-in User model via boot script
  User.on('resetPasswordRequest', function (info) {
    console.log('inside User.on.resetPasswordRequest');
    // your code goes here
  });
};

@coox I'm not sure which one si better but I do like that :

User.settings.acls.push({
  accessType: 'READ',
  principalType: 'ROLE',
  principalId: '$owner',
  permission: 'ALLOW',
  property: '__get__someOtherModels',
});

PS: it seems that loopback does the same way to apply the ACL specified in model.json