Loopback has a powerful access control feature that encompasses filtering capabilities

Question

Loopback has a powerful access control feature that encompasses filtering capabilities

I have three models set up in Loopback: Reader, Book, and Note. The Reader model is essentially an instance of User and has the ability to log in. Here are the relationships between the models:

Reader has many Books
Reader has many Notes
Book has many Notes
Note belongs to Reader
Note belongs to Book

My goal is to query all Books belonging to a logged-in Reader with populated Notes that belong to both the Book and the Reader.

The API call would look something like this:

/api/reader/me/books?filter[include]=notes

However, the issue is that this call returns all notes associated with the Book, regardless of whether they belong to the specific Reader. I could add another filter to the API call, but I need to enforce note filtering on the server side to ensure that Readers do not have access to other Readers' notes.

I attempted to implement access control on the Book model as follows:

{
  "principalType": "ROLE",
  "principalId": "$owner",
  "permission": "ALLOW",
  "property": "__get__notes"
}

And applied this ACL to the Note model:

[
    {
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    }, {
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW",
      "property": "*"
    }
]

This setup works correctly for API calls like:

/api/reader/me/books/<bookId>/notes

But it does not work for the initial call with the include filter. What steps should I take to only populate the Reader's notes within the books?

Any assistance would be greatly appreciated.

angularjs node.js loopbackjs strongloop

Answer 1

Answer №1

If you want to accomplish this task, you need to create remote methods and apply filters at the application level.

Assume that user details are stored in the User model.

module.exports = function(Reader){

    var async = require('async');
    Reader.fetchBooks = function(userId, callback){
        var app = this.app;
        var updatedReaderList = [];
        Reader.find({
            where: {userId: userId },
            include: {relation: "books"} 
        }, function(err, readerList){
            if(err){
                return callback(err);
            }
            if(readerList){
                if(readerList.length){
                   var series = []; 
                   readerList.forEach(function(reader){
                      var readerObj = reader.toJSON();
                      updatedReaderList.push(readerObj);
                      if(readerObj.books){
                          readerObj.books.forEach(function(book){
                              series.push(function(callback){
                                fetchNotes(app, book, readerObj.id, callback);
                              });
                          } 
                      }
                   });

                  //Now save the data in series..
                  async.series(series, function(err){
                      if(err){
                          callback(err);
                      }else{

                          //Now send the callback
                          callback(null, updatedReaderList);
                      }
                  });

                }else{
                  callback(null, [])
                }
            }else{
              callback(null, [])
            }
        });


    };

    var fetchNotes = function(app, book, readerId, callback){
        var Note = app.models.Note;
        //Fetch only those note whose reader id belongs to current reader and book belongs to same one.
        Note.find({
          where: {
            readerId: readerId,
            bookId: book.id
          }
        }, function(err, noteList){
          if(err){
            return callback(err);
          }else{
            if(noteList){
              book.notes = noteList;
            }
          }
        });
    };
}

Now you can restrict all other methods and simply allow this remote method.

{
  "principalType": "ROLE",
  "principalId": "$owner",
  "permission": "ALLOW",
  "property": "fetchBooks"
}

Note: Consider using promises to avoid nested callbacks.

Answer 2

If you want to accomplish this task, you need to create remote methods and apply filters at the application level.

Assume that user details are stored in the User model.

module.exports = function(Reader){

    var async = require('async');
    Reader.fetchBooks = function(userId, callback){
        var app = this.app;
        var updatedReaderList = [];
        Reader.find({
            where: {userId: userId },
            include: {relation: "books"} 
        }, function(err, readerList){
            if(err){
                return callback(err);
            }
            if(readerList){
                if(readerList.length){
                   var series = []; 
                   readerList.forEach(function(reader){
                      var readerObj = reader.toJSON();
                      updatedReaderList.push(readerObj);
                      if(readerObj.books){
                          readerObj.books.forEach(function(book){
                              series.push(function(callback){
                                fetchNotes(app, book, readerObj.id, callback);
                              });
                          } 
                      }
                   });

                  //Now save the data in series..
                  async.series(series, function(err){
                      if(err){
                          callback(err);
                      }else{

                          //Now send the callback
                          callback(null, updatedReaderList);
                      }
                  });

                }else{
                  callback(null, [])
                }
            }else{
              callback(null, [])
            }
        });


    };

    var fetchNotes = function(app, book, readerId, callback){
        var Note = app.models.Note;
        //Fetch only those note whose reader id belongs to current reader and book belongs to same one.
        Note.find({
          where: {
            readerId: readerId,
            bookId: book.id
          }
        }, function(err, noteList){
          if(err){
            return callback(err);
          }else{
            if(noteList){
              book.notes = noteList;
            }
          }
        });
    };
}

Now you can restrict all other methods and simply allow this remote method.

{
  "principalType": "ROLE",
  "principalId": "$owner",
  "permission": "ALLOW",
  "property": "fetchBooks"
}

Note: Consider using promises to avoid nested callbacks.

Loopback has a powerful access control feature that encompasses filtering capabilities

Answer №1

Similar questions

Resolving duplicated controller code in Angular using UI.Router

Angular Jasmine Test produces incorrect ng-class result

Using Node.js to convert a file name to a timestamp

Combine two objects and discard any duplicate keys

`In AngularJS, the same URL ('/') can display different templates depending on the user's login status.`

Is there a way to use npx with a parameter like `--registry https://registry.npmjs.org` during an npm install to bypass the need for artifactory?

Adding a function call from a C library into my custom npm module

Exploring the intricacies of .$on() in AngularJS

Select the radio button upon input alteration

Can someone guide me on implementing Node.js clusters in my basic Express application?

What is the process for exporting data from MongoDB?

Angular facilitates the seamless uploading of files to S3

Unit Testing in Angular with spyOn().and.callThrough() does not execute the actual function

Guide to setting up Firebase Admin to initialize application based on request environment

The controller in my template is not being passed by the $routeProvider

The most efficient method for searching and deleting elements from an array in Mongoose

Retrieve an array of objects using the Handlebars Helper

Having difficulty adding a custom library from a repository into an Ember project as a dependency

How can one effectively extract data from a database in a React application?

angularJS equivalent of whenDOMReady