Ownership of an in direct model

I have a user which own a house (several of users can own the house), the house can have several of furnitures.

CustomUser.json relation:

"houses": {
   "type": "hasAndBelongsToMany",
   "model": "House",
   "foreignKey": "houseId"
}

House.json relations:

"furnitures": {
   "type": "hasAndBelongsToMany",
   "model": "Furniture",
   "foreignKey": ""
},
"customUsers": {
   "type": "hasAndBelongsToMany",
   "model": "CustomUser",
   "foreignKey": ""
}

My ACL is simple and looks like this for both House and Furniture:

"acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    }
]

Now, accessing houses for the users works fine, but the users won't get their furnitures listed since they belong to a house (the house is the owner). How do I fix this the easiest way possible? Best would be to somehow define that User owns furnitures through the house? The furnitures must belong to the house, though (since multiple users can have a house).

Solution

Writing my own role resolver made this quite flexible, in the role resolver I had to make logic to find the original parent and also make sure there were no dead relationships (since LB doesn't have support for cascade yet).

I recommend starting with this to get going:

https://loopback.io/doc/en/lb3/Defining-and-using-roles.html