Loopback: ACL wildcard in property for related Models?

[psi-4ward]

Hi there,
i often have ACL like:

[
    {
      "accessType": "*",
      "permission": "ALLOW",
      "principalType": "ROLE",
      "principalId": "editor",
      "property": "__get__questions"
    },
    {
      "accessType": "*",
      "permission": "ALLOW",
      "principalType": "ROLE",
      "principalId": "editor",
      "property": "__updateById__questions"
    },
    {
      "accessType": "*",
      "permission": "ALLOW",
      "principalType": "ROLE",
      "principalId": "editor",
      "property": "__create__questions"
    }
// ......
]

Grant full access to the related model Question for the role editor. Sadly i have to explicitly define every method here. Probably we could support something like __*__questions ?
Or is there another ay to grant access to related models?

[superkhau]

Would you like to submit a pull request?

[psi-4ward]

Dont know if i find time to dig this deep in the ACL implementation. Im not there for next 5 weeks

[gausie]

At the very least, you could define the property as an array, although it would still be good to use wildcards!

[kussberg]

So is now the wildcard in the property available? I had the same issue now, wanted to allow only GET and deny all other methods.

[danielrvt]

+1

[doublemarked]

It's not a wildcard, but you can merge all of those into a single object using an array for the property:

// ...
"property": ["__get__questions", "__updateById__questions", "__create__questions"]

[pthieu]

@psi-4ward: Do you still require this? As mentioned in https://github.com/strongloop/loopback/issues/1121#issuecomment-157172284, you can put your method names into an array.

This might take a while for us to get to. To speed up the process, you can do one of two things:

1. If you still require this, open a new issue using the New issue button and fill in the template provided to you
2. Open a PR adding this functionality yourself and we will review and merge.

Will close this issue now as it's been over a year. Please use option #1 if you still require this.

[psi-4ward]

Rather old Topic...

No I don't need it anymore, switched to FeathersJS. Thanks!

[joeybenenati]

this feature would be awesome. restricting relation methods is tedious and susceptible to vulnerabilities . Either the wildcard or the array option would help a lot.