Loopback allowing all users to access something that only the owner should see

Question

In my loopback app I have two models: user and thing.

Basically thing belongs to user and only the owner can access thing. This is what my thing.json file looks like:

{
  "name": "thing",
  "base": "PersistedModel",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {
    "name": {
      "type": "string",
      "required": true
    }
  },
  "validations": [],
  "relations": {
    "user": {
      "type": "belongsTo",
      "model": "user",
      "foreignKey": "userId",
      "primaryKey": "id"
    }
  },
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$unauthenticated",
      "permission": "DENY"
    }
  ],
  "methods": {}
}

What is happening is if I deny everyone like I am doing now before allowing certain roles, no one is allowed to access or create things, but if I remove that line all users are able to access all things. Did I miss something? I would like just the owner to be able to access their own things.

Thanks!

Answer 1

From Loopback documentation

To qualify a $owner, the target model needs to have a belongsTo relation to the User model (or a model that extends User) and property matching the foreign key of the target model instance. The check for $owner is performed only for a remote method that has ‘:id’ on the path, for example, GET /api/users/:id.