CODEWITHSUNDEEP
javascriptnode.jsstronglooploopback
Shmulinson
Shmulinson

Reputation: 421

Loopback how to overwrite Role ACL?

How to open loopback build-in model Role only for admin? If I set "public":true in model-config.json then anyone can query Role methods.

"Role": {
    "dataSource": "db",
    "public": true
  },

I need only user with role "admin" to CRUD.

Upvotes: 1

Views: 140

Answers (1)

Shmulinson
Shmulinson

Reputation: 421

This is how I solved this issue. in root.js

Promise.all([
    ACL.findOrCreate({
      model: Role.modelName,
      accessType: ACL.ALL,
      principalType: ACL.ROLE,
      principalId: '$everyone',
      permission: ACL.DENY,
      property: ACL.ALL
    })
    , ACL.findOrCreate({
      model: Role.modelName,
      accessType: ACL.ALL,
      principalType: ACL.ROLE,
      principalId: 'admin',
      permission: ACL.ALLOW,
      property: ACL.ALL
    })
  ]);

Upvotes: 1

Related Questions