How to set up ACLs to allow users to access only specific records?

问题

I'm planning to use Loopback to create an application where users will be able to access only specific records.

Let's say we have a Projects model, with 2 records:

{
    "projects": [
        {
            "project_name": "foo",
            "project_start_date": "2012-10-29T18:25:43.511Z"
        },
        {
            "project_name": "bar",
            "project_start_date": "2012-10-30T18:25:43.511Z"
        }
    ]
}

and that I have 2 users, joe and katie.

I want joe to be able to access only project foo, and katie to be able to access only project bar.

Is this possible at all? If so, how should I go about setting up the ACLs?

回答1:

At the moment, the declarative ACL doesn't support your use case. You need to create afterRemote hook to further check the response. See http://docs.strongloop.com/display/LB/Remote+hooks.

回答2:

You can also play with dynamic roles. See http://docs.strongloop.com/display/public/LB/Defining+and+using+roles#Definingandusingroles-Dynamicroles and similar loopback example: https://github.com/strongloop/loopback-example-access-control/blob/master/common/models/project.json

来源：https://stackoverflow.com/questions/26661968/how-to-set-up-acls-to-allow-users-to-access-only-specific-records