node.js - Loopback - 具有 "hasMany"关系的 $owner 角色

Question

我一直在阅读有关角色的环回文档。他们声明如下:

To qualify a $owner, the target model needs to have a belongsTo relation to the User model (or a model extends from User) and property matching the foreign key of the target model instance. The check for $owner is only performed for a remote method that has ':id' on the path, for example, GET /api/users/:id.

但是，当我有一个“hasMany”关系并想对这样的某个对象执行操作时会发生什么:

PUT myusers/123/news/456

这将是我的 user.json:

{
  "name": "MyUser",
  "plural": "myusers",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {},
  "validations": [],
  "relations": {
    "news": {
      "type": "hasMany",
      "model": "News",
      "foreignKey": ""
    }
  },
  "acls": [],
  "methods": []
}

Answer 1

基于 this 、 this 和 this 。我已将 MyUser 实体更改为 Writer 实体，因为我喜欢它。

由于 Writer 实体有很多 News，News 关系和 ACL 应该是这样的(news.json)。

"relations": {
  "writer": {
    "type":"belongsTo",
    "model":"Writer",
    "foreignKey":"writer_id"
  }
},
"acls": [
  { // Nobody has access to nothing
    "accessType": "*",
    "principalType": "ROLE",
    "principalId": "$everyone",
    "permission": "DENY"
  },
  { // But everyone can read everything
    "accessType": "READ",
    "principalType": "ROLE",
    "principalId": "$everyone",
    "permission": "ALLOW"
  },
  { // And authenticated users can create news
    "accessType": "EXECUTE",
    "principalType": "ROLE",
    "principalId": "$authenticated",
    "permission": "ALLOW",
    "property": "create"
  },
  { // And the owner of a news can update it
    "accessType": "WRITE",
    "principalType": "ROLE",
    "principalId": "$owner",
    "permission": "ALLOW"
  }
],

Writer实体有相同的ACL规则但是这个关系(writer.json)

"relations": {
  "news": {
    "type": "hasMany",
    "model": "News",
    "foreignKey": "writer_id"
  }
}

这里真正发生的是，当你创建一个Writer时，你必须指定email和password，因为他继承自用户模型。所以如果你想执行

PUT writers/123/news/456

您必须登录有一个Writer，这可以在这个端点完成:/api/writers/login(使用email+password ).此端点将为您提供 Writer token ，然后如果您拥有 $owner，您将能够对 News 执行更新> header 、网址或表单上的标记。

另一方面，您还可以获得正在执行 HTTP 请求 的用户，并让该用户拥有带有 hook 的新闻所有者。

希望对您有所帮助。问候。