{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/125","repository_url":"https://api.github.com/repos/strongloop/loopback-sdk-angular","labels_url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/125/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/125/comments","events_url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/125/events","html_url":"https://github.com/strongloop/loopback-sdk-angular/issues/125","id":56140373,"number":125,"title":"user can't update its own data (401)","user":{"login":"Morriz","id":941865,"avatar_url":"https://avatars.githubusercontent.com/u/941865?v=3","gravatar_id":"","url":"https://api.github.com/users/Morriz","html_url":"https://github.com/Morriz","followers_url":"https://api.github.com/users/Morriz/followers","following_url":"https://api.github.com/users/Morriz/following{/other_user}","gists_url":"https://api.github.com/users/Morriz/gists{/gist_id}","starred_url":"https://api.github.com/users/Morriz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Morriz/subscriptions","organizations_url":"https://api.github.com/users/Morriz/orgs","repos_url":"https://api.github.com/users/Morriz/repos","events_url":"https://api.github.com/users/Morriz/events{/privacy}","received_events_url":"https://api.github.com/users/Morriz/received_events","type":"User","site_admin":false},"labels":[{"id":169326403,"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/labels/%23tob","name":"#tob","color":"eeeeee","default":false},{"id":74075402,"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/labels/bug","name":"bug","color":"e11d21","default":true},{"id":138583895,"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/labels/doc","name":"doc","color":"bfe5bf","default":false},{"id":172082122,"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/labels/major","name":"major","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":{"login":"davidcheung","id":1787590,"avatar_url":"https://avatars.githubusercontent.com/u/1787590?v=3","gravatar_id":"","url":"https://api.github.com/users/davidcheung","html_url":"https://github.com/davidcheung","followers_url":"https://api.github.com/users/davidcheung/followers","following_url":"https://api.github.com/users/davidcheung/following{/other_user}","gists_url":"https://api.github.com/users/davidcheung/gists{/gist_id}","starred_url":"https://api.github.com/users/davidcheung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidcheung/subscriptions","organizations_url":"https://api.github.com/users/davidcheung/orgs","repos_url":"https://api.github.com/users/davidcheung/repos","events_url":"https://api.github.com/users/davidcheung/events{/privacy}","received_events_url":"https://api.github.com/users/davidcheung/received_events","type":"User","site_admin":false},"assignees":[{"login":"bajtos","id":1140553,"avatar_url":"https://avatars.githubusercontent.com/u/1140553?v=3","gravatar_id":"","url":"https://api.github.com/users/bajtos","html_url":"https://github.com/bajtos","followers_url":"https://api.github.com/users/bajtos/followers","following_url":"https://api.github.com/users/bajtos/following{/other_user}","gists_url":"https://api.github.com/users/bajtos/gists{/gist_id}","starred_url":"https://api.github.com/users/bajtos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bajtos/subscriptions","organizations_url":"https://api.github.com/users/bajtos/orgs","repos_url":"https://api.github.com/users/bajtos/repos","events_url":"https://api.github.com/users/bajtos/events{/privacy}","received_events_url":"https://api.github.com/users/bajtos/received_events","type":"User","site_admin":false},{"login":"davidcheung","id":1787590,"avatar_url":"https://avatars.githubusercontent.com/u/1787590?v=3","gravatar_id":"","url":"https://api.github.com/users/davidcheung","html_url":"https://github.com/davidcheung","followers_url":"https://api.github.com/users/davidcheung/followers","following_url":"https://api.github.com/users/davidcheung/following{/other_user}","gists_url":"https://api.github.com/users/davidcheung/gists{/gist_id}","starred_url":"https://api.github.com/users/davidcheung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidcheung/subscriptions","organizations_url":"https://api.github.com/users/davidcheung/orgs","repos_url":"https://api.github.com/users/davidcheung/repos","events_url":"https://api.github.com/users/davidcheung/events{/privacy}","received_events_url":"https://api.github.com/users/davidcheung/received_events","type":"User","site_admin":false}],"milestone":null,"comments":15,"created_at":"2015-01-31T21:32:35Z","updated_at":"2016-11-21T22:43:55Z","closed_at":null,"body":"The loopback angular model.$save (or Model.update for that matter) defaults to $upsert, which tries a batch update on the server, which is not allowed for just the $owner. The PUT method for a logged in user in the explorer works though.\n\nDifference in calls is (while using same body payload):\n\nexplorer PUT: /api/Users/someid (allowed)\nloopback-services.js PUT: /api/Users?id=someid (not allowed because of reason mentioned)\n\noutput after call from loopback-services.js:\n\n```\nloopback:security:role isInRole(): $everyone +0ms\n  loopback:security:access-context ---AccessContext--- +1ms\n  loopback:security:access-context principals: +0ms\n  loopback:security:access-context principal: {\"type\":\"USER\",\"id\":1} +0ms\n  loopback:security:access-context modelName User +0ms\n  loopback:security:access-context modelId 1 +0ms\n  loopback:security:access-context property upsert +0ms\n  loopback:security:access-context method upsert +0ms\n  loopback:security:access-context accessType WRITE +0ms\n  loopback:security:access-context accessToken: +0ms\n  loopback:security:access-context   id \"KCXtsjtfaDpwMh2IExPFHCS3DgIAF1oL56hW7mWCbCvVoFcExbzJAWW6DAkVSQAZ\" +0ms\n  loopback:security:access-context   ttl 1209600 +0ms\n  loopback:security:access-context getUserId() 1 +1ms\n  loopback:security:access-context isAuthenticated() true +0ms\n  loopback:security:role Custom resolver found for role $everyone +0ms\n  loopback:security:acl The following ACLs were searched:  +0ms\n  loopback:security:acl ---ACL--- +0ms\n  loopback:security:acl model User +0ms\n  loopback:security:acl property * +0ms\n  loopback:security:acl principalType ROLE +0ms\n  loopback:security:acl principalId $everyone +0ms\n  loopback:security:acl accessType * +0ms\n  loopback:security:acl permission DENY +0ms\n  loopback:security:acl with score: +0ms 7495\n  loopback:security:acl ---Resolved--- +0ms\n  loopback:security:access-context ---AccessRequest--- +0ms\n  loopback:security:access-context  model User +1ms\n  loopback:security:access-context  property upsert +0ms\n  loopback:security:access-context  accessType WRITE +0ms\n  loopback:security:access-context  permission DENY +0ms\n  loopback:security:access-context  isWildcard() false +0ms\n  loopback:security:access-context  isAllowed() false +0ms\n```\n"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/comments/262091291","html_url":"https://github.com/strongloop/loopback-sdk-angular/issues/125#issuecomment-262091291","issue_url":"https://api.github.com/repos/strongloop/loopback-sdk-angular/issues/125","id":262091291,"user":{"login":"davidcheung","id":1787590,"avatar_url":"https://avatars.githubusercontent.com/u/1787590?v=3","gravatar_id":"","url":"https://api.github.com/users/davidcheung","html_url":"https://github.com/davidcheung","followers_url":"https://api.github.com/users/davidcheung/followers","following_url":"https://api.github.com/users/davidcheung/following{/other_user}","gists_url":"https://api.github.com/users/davidcheung/gists{/gist_id}","starred_url":"https://api.github.com/users/davidcheung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidcheung/subscriptions","organizations_url":"https://api.github.com/users/davidcheung/orgs","repos_url":"https://api.github.com/users/davidcheung/repos","events_url":"https://api.github.com/users/davidcheung/events{/privacy}","received_events_url":"https://api.github.com/users/davidcheung/received_events","type":"User","site_admin":false},"created_at":"2016-11-21T22:43:55Z","updated_at":"2016-11-21T22:43:55Z","body":"yeah this is still a problem, will add to my backlog \r\ncan reproduce via : https://github.com/strongloop/loopback-sdk-angular/compare/user-cannot-save"}}
{"actor":{"display_login":"davidcheung"}}