The roles aren't getting into the Coded ACL. about loopback-example-access-control

[BuchyOne]

Not sure of your POST request, but this from the docs may help:

If a model has a DENY ALL permission (for example a built-in model such as the User model), but related models have no ACLs,the related models will still not be accessible through the User model. So, for example, even if the books model’s default ACL is ALLOW $authenticated for GET /books, the route GET /user/{id}/books default will still be DENY AL

https://loopback.io/doc/en/lb3/Accessing-related-models.html

[Nygma297]

Here are some files

Advertisement.json

{
  "name": "Advertisement",
  "base": "PersistedModel",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {
    "adType": {
      "type": "string",
      "required": true
    },
    "name": {
      "type": "string",
      "required": true
    },
    "expiry": {
      "type": "number",
      "required": false
    }
  },
  "validations": [],
  "relations": {},
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "Admin",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "SuperAdmin",
      "permission": "ALLOW"
    },
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$authenticated",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "Admin",
      "permission": "ALLOW",
      "property": ["create", "update", "insert", "deleteById"]
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "SuperAdmin",
      "permission": "ALLOW",
      "property": ["create", "update", "insert", "deleteById"]
    }
  ],
  "methods": {}
}

AppUser.json

{
  "name": "AppUser",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {
    "imageURL": {
      "type": "String"
    },
    "isApproved": {
      "type": "Boolean",
      "required": true,
      "default": false
    },
    "gender": {
      "type": "String",
      "required": true
    }
  },
  "validations": [],
  "relations": {
    "bloodRequests": {
      "type": "hasMany",
      "model": "BloodRequest",
      "foreignKey": "userId"
    }
  },
  "acls": [
    {
      "accessType": "WRITE",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "Admin",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "SuperAdmin",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY",
      "property": "create"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "Admin",
      "permission": "ALLOW",
      "property": ["create", "update", "insert", "deleteById"]
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "SuperAdmin",
      "permission": "ALLOW",
      "property": ["create", "update", "insert", "deleteById"]
    }
  ],
  "methods": {}
}

Script.js

s.AppUser;
	var Role = app.models.Role;
	var RoleMapping = app.models.RoleMapping;

	AppUser.create([
		{ isApproved: false, gender: 'Male', username: 'John', email: '[email protected]', password: 'admin' },
		{ isApproved: false, gender: 'Male', username: 'Jane', email: '[email protected]', password: 'superadmin' }
	], function (err, AppUsers) {
		if (err) throw err;

		Role.create({
			name: 'Admin'
		}, function (err, role) {
			if (err) throw err;

			// Make 1st entry as an admin
			role.principals.create({
				principalType: RoleMapping.USER,
				principalId: AppUsers[0].id
			}, function (err, principal) {
				if (err) throw err;
			});
		});
		Role.create({
			name: 'SuperAdmin'
		}, function (err, role) {
			if (err) throw err;

			// Make 2nd entry as an admin
			role.principals.create({
				principalType: RoleMapping.USER,
				principalId: AppUsers[1].id
			}, function (err, principal) {
				if (err) throw err;
			});
		});
	});

[Nygma297]

@BuchyOne

Not sure What you're trying to say, could you please explain

[Nygma297]

@BuchyOne

Done! But the problem still persists. I found out that there was no relation between the roleMapping model and My AppUser model(base: User) due to which the principalId field in roleMapping model doesn't return an object just a string containing the ID of User. I've fixed it temporarily by assigning relations.

I hope it works 👍

Gonna keep this thread open if I get any further queries.

[kristojorg]

@Nygma297 could you please explain what you did here? I'm having this same issue and can't seem to resolve it. I created an admin role, added a AppUser extended from User to it, and created an acl similar to yours to allow admins to access full api. The admin user is still being denied access however.

I also have a relation from AppUser to Role through RoleMapping:

  "relations": {
    "roles": {
      "type": "hasMany",
      "model": "Role",
      "foreignKey": "principalId",
      "through": "RoleMapping"
    }
  }

Do I need to register a resolver for this static role? Any help would be appreciated.

[stale]

This issue has been closed due to continued inactivity. Thank you for your understanding. If you believe this to be in error, please contact one of the code owners, listed in the CODEOWNERS file at the top-level of this repository.