{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/2211","repository_url":"https://api.github.com/repos/strongloop/loopback","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/2211/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/2211/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/2211/events","html_url":"https://github.com/strongloop/loopback/issues/2211","id":146647189,"number":2211,"title":"Filter on relation doesn't respect id constraint ","user":{"login":"mneil","id":1605808,"avatar_url":"https://avatars.githubusercontent.com/u/1605808?v=3","gravatar_id":"","url":"https://api.github.com/users/mneil","html_url":"https://github.com/mneil","followers_url":"https://api.github.com/users/mneil/followers","following_url":"https://api.github.com/users/mneil/following{/other_user}","gists_url":"https://api.github.com/users/mneil/gists{/gist_id}","starred_url":"https://api.github.com/users/mneil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mneil/subscriptions","organizations_url":"https://api.github.com/users/mneil/orgs","repos_url":"https://api.github.com/users/mneil/repos","events_url":"https://api.github.com/users/mneil/events{/privacy}","received_events_url":"https://api.github.com/users/mneil/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/triage","name":"triage","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"0candy","id":14314570,"avatar_url":"https://avatars.githubusercontent.com/u/14314570?v=3","gravatar_id":"","url":"https://api.github.com/users/0candy","html_url":"https://github.com/0candy","followers_url":"https://api.github.com/users/0candy/followers","following_url":"https://api.github.com/users/0candy/following{/other_user}","gists_url":"https://api.github.com/users/0candy/gists{/gist_id}","starred_url":"https://api.github.com/users/0candy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0candy/subscriptions","organizations_url":"https://api.github.com/users/0candy/orgs","repos_url":"https://api.github.com/users/0candy/repos","events_url":"https://api.github.com/users/0candy/events{/privacy}","received_events_url":"https://api.github.com/users/0candy/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2016-04-07T14:44:35Z","updated_at":"2016-05-03T03:03:00Z","closed_at":"2016-04-28T02:53:43Z","body":"**The setup**\r\n\r\nUser hasMany through accounts\r\nAccounts hasMany through users\r\n\r\n**The problem**\r\nRetrieving users from accounts by id fails to correctly constrain the result set.\r\n\r\nI expect `/api/accounts/1/users?filter={\"where\":{\"id\":2}}` to return 1 result - the user by id belonging to account id 1.\r\n\r\n**What happens**\r\nI receive 2 users, both myself and the user of id 2\r\n\r\nWhat is happening is that the ctx.query.where is coerced from `{\"where\":{\"id\":2}}` to `{\"where\":{\"id\":{\"inq\":[1,2]}}}` where 1 is the owner of the access token being used. If I authenticate as user id 5 then the query is coerced to `{\"where\":{\"id\":{\"inq\":[5,2]}}}`\r\n\r\n**How to reproduce**\r\nI am using Ubuntu 14.04 trusty\r\nInstall Postgres 9.3.11\r\nCreate an empty database and edit `server/datasources.json` to authenticate and use that database.\r\n\r\nDo the following:\r\n```\r\ngit clone git@github.com:mneil/loopback-sandbox.git\r\nnpm install\r\nslc run\r\n```\r\n\r\nOn boot you should see 2 messages after strongloop connects \r\n```\r\nauto migrate  undefined\r\ndatabase filled\r\n```\r\n\r\nThis creates 2 users, roles, and an account. Open your browser to http://localhost:3000/explorer\r\n\r\nAuthenticate the explorer with \r\n```\r\n{\"username\":\"admin\",\"password\":\"admin\"}\r\n```\r\n\r\nNow GET `/api/accounts/1?filter={\"include\":\"users\"}` and see that 2 users return. < correct\r\n\r\n**The following are incorrect**\r\nGET `/api/accounts/1?filter={\"include\":\"users\",\"where\":{\"id\":2}}` returns 2 users\r\nGET `/api/accounts/1/users?filter={\"where\":{\"id\":2}}` returns 2 users\r\n\r\nOn another note I opened this ticket in the postgre connector repo initially. This morning I switched to the mysql connector and the same issue happens.\r\n\r\nEither I'm doing something wrong or this issue isn't related to the two connectors but something else in loopback. "},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/216424706","html_url":"https://github.com/strongloop/loopback/issues/2211#issuecomment-216424706","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/2211","id":216424706,"user":{"login":"mneil","id":1605808,"avatar_url":"https://avatars.githubusercontent.com/u/1605808?v=3","gravatar_id":"","url":"https://api.github.com/users/mneil","html_url":"https://github.com/mneil","followers_url":"https://api.github.com/users/mneil/followers","following_url":"https://api.github.com/users/mneil/following{/other_user}","gists_url":"https://api.github.com/users/mneil/gists{/gist_id}","starred_url":"https://api.github.com/users/mneil/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mneil/subscriptions","organizations_url":"https://api.github.com/users/mneil/orgs","repos_url":"https://api.github.com/users/mneil/repos","events_url":"https://api.github.com/users/mneil/events{/privacy}","received_events_url":"https://api.github.com/users/mneil/received_events","type":"User","site_admin":false},"created_at":"2016-05-03T03:03:00Z","updated_at":"2016-05-03T03:03:00Z","body":"Are these two issues the same? That issue is asking for support for nested properties - not relations. I believe issue 517 is asking for queries on complex types like postgres lists, bson/json fields or mongo subdocuments. I'm asking for filtering direct on a model when finding them through a relation (another model)."}}