Built-in models not affected by acl generator

[duckontheweb]

Using scl loopback:acl on built-in model Role has no effect on remote restrictions. I am trying to make Roles accessible only to a superuser admin and started by making it public and then attempted to restrict access to all using:

$ slc loopback:acl
? Select the model to apply the ACL entry to: Role
? Select the ACL scope: All methods and properties
? Select the access type: All (match all types)
? Select the role: All users
? Select the permission to apply: Explicitly deny access

However, I still have unauthenticated acces to the model's REST API for all methods.

Modifying server/model-config.json does the trick, but the documentation seemed to suggest that I could do this with the generator instead.

I'm new to this, so it's possible I've just missed something small. I appreciate the help.

Jon

[superkhau]

You cannot modify built-in models using the ACL generator.

@crandmck Can we update the docs? @jduckworth seems to think the docs suggest you can do this.

[raymondfeng]

We probably should fix the generator so that acls go into server/model-config.json. This way, it will work with all models.

[superkhau]

@raymondfeng +1 TOB?

[crandmck]

Can we update the docs?

I added a note to http://docs.strongloop.com/display/LB/ACL+generator

... the documentation seemed to suggest that I could do this with the generator instead.

@jduckworth What doc are you referring to? Please let me know so I can update it.

[duckontheweb]

Hi Rand-

Thanks for the quick response. The doc I was referring to is here:
http://docs.strongloop.com/display/public/LB/Managing+users. It describes
how to edit the ACL within server/model-config.json, but then at the bottom
it also suggests that you can use the slc tool to do the same thing as
well. Now that I read it again, I guess it does say "other models," so I
guess that makes sense, but maybe it's worth being explicit about the fact
that the slc won't alter built-in models.

Very appreciative of everything you all do to maintain this!

Jon

On Tue, Aug 11, 2015 at 3:24 PM, Rand McKinney notifications@github.com
wrote:

Can we update the docs?

I added a note to http://docs.strongloop.com/display/LB/ACL+generator

... the documentation seemed to suggest that I could do this with the
generator instead.

@jduckworth https://github.com/jduckworth What doc are you referring
to? Please let me know so I can update it.

—
Reply to this email directly or view it on GitHub
#1582 (comment)
.

[crandmck]

Thanks @jduckworth... that sentence about using the tool to modify other models seemed superfluous, so I just deleted it and added a note that you can't use the ACL generator.

[duckontheweb]

Great, you guys rock!

[crandmck]

Aw, thanks! :-)

[superkhau]

@crandmck leaving this issue open as raymond suggested we add the feature above

[faridnsh]

@crandmck Actually it seems like we can't override user acl from model-config.json or models.json

[ritch]

@crandmck Actually it seems like we can't override user acl from model-config.json or models.json

This is right. You should be able to do this. Below is a simple work around you can do from a boot script.

var defaultACL = server.models.User.settings.acls;

console.log(defaultACL); // output the defaults

// create an entirely new list (or modify a copy of the defaultACL)
server.models.User.settings.acls = [];