loopback.io model, acl principalId, $owner

Question

I need to limit data access in a model only to the loopback user that created it.

I saw this in the docs:

http://loopback.io/doc/en/lb2/Model-definition-JSON-file.html#acls

$owner - Owner of the object

Does that mean the logged in user who created that object?

When a model runs create, is loopback.io storing the user id of the current logged in user inside it's own ACL?

Or will I need to do something like this, which is to create new properties on my model with relations to the user model:

ACL troubles with loopback.io

Answer 1

Got it:

http://loopback.io/doc/en/lb2/Defining-and-using-roles.html#dynamic-roles

To qualify a $owner, the target model needs to have a belongsTo relation to the User model (or a model extends from User) and property matching the foreign key of the target model instance. The check for $owner is only performed for a remote method that has ‘:id’ on the path, for example, GET /api/users/:id.