{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/2149","repository_url":"https://api.github.com/repos/strongloop/loopback","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/2149/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/2149/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/2149/events","html_url":"https://github.com/strongloop/loopback/issues/2149","id":141403820,"number":2149,"title":"Authorization header is not acceptable for resolving $owner role in ACLs?","user":{"login":"jubbens","id":1747256,"avatar_url":"https://avatars.githubusercontent.com/u/1747256?v=3","gravatar_id":"","url":"https://api.github.com/users/jubbens","html_url":"https://github.com/jubbens","followers_url":"https://api.github.com/users/jubbens/followers","following_url":"https://api.github.com/users/jubbens/following{/other_user}","gists_url":"https://api.github.com/users/jubbens/gists{/gist_id}","starred_url":"https://api.github.com/users/jubbens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jubbens/subscriptions","organizations_url":"https://api.github.com/users/jubbens/orgs","repos_url":"https://api.github.com/users/jubbens/repos","events_url":"https://api.github.com/users/jubbens/events{/privacy}","received_events_url":"https://api.github.com/users/jubbens/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/triage","name":"triage","color":"eb6420"},{"url":"https://api.github.com/repos/strongloop/loopback/labels/waiting","name":"waiting","color":"eeeeee"}],"state":"open","locked":false,"assignee":{"login":"richardpringle","id":3286504,"avatar_url":"https://avatars.githubusercontent.com/u/3286504?v=3","gravatar_id":"","url":"https://api.github.com/users/richardpringle","html_url":"https://github.com/richardpringle","followers_url":"https://api.github.com/users/richardpringle/followers","following_url":"https://api.github.com/users/richardpringle/following{/other_user}","gists_url":"https://api.github.com/users/richardpringle/gists{/gist_id}","starred_url":"https://api.github.com/users/richardpringle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/richardpringle/subscriptions","organizations_url":"https://api.github.com/users/richardpringle/orgs","repos_url":"https://api.github.com/users/richardpringle/repos","events_url":"https://api.github.com/users/richardpringle/events{/privacy}","received_events_url":"https://api.github.com/users/richardpringle/received_events","type":"User","site_admin":false},"milestone":null,"comments":6,"created_at":"2016-03-16T21:10:59Z","updated_at":"2016-03-18T18:24:27Z","closed_at":null,"body":"I am testing my API using Supertest and Mocha. I'm having problems getting a test to pass which involves logging in as a user, creating a new instance, and then deleting that instance. The purpose of this test is to verify that authenticated users are able to delete their own instances but I'm getting `401 UNAUTHORIZED` on the `DELETE` command.\r\n\r\nI have a feeling that passing the access token via the `Authorization` header does not result in successfully resolving the token as the $owner. I've verified that the correct User Id is set in `ownerId` for the created instance.\r\n\r\nHere is my test:\r\n\r\n```\r\n  it('should respond 200 on authenticated DELETE requests to Cars owned by the user', function(done) {\r\n    agent\r\n    .post('/api/users/login')\r\n    .send({ email: 'test@email.com', password: 'myTestPassword', ttl: '1209600000' })\r\n    .set('Accept', 'application/json')\r\n    .set('Content-Type', 'application/json')\r\n    .expect(200)\r\n    .end(function(err, authRes) {\r\n      if (err) {\r\n        return done(err);\r\n      }\r\n\r\n      var token = authRes.body.id;\r\n\r\n      agent\r\n      .post('/api/Cars')\r\n      .set('Authorization', token)\r\n      .expect(200)\r\n      .expect('Content-Type', /json/)\r\n      .end(function(err, res) {\r\n        if (err) {\r\n          return done(err);\r\n        }\r\n\r\n        agent\r\n        .delete('/api/Cars/1')\r\n        .set('Authorization', token)\r\n        .expect(200)\r\n        .end(function(err, res) {\r\n          if (err) {\r\n            return done(err);\r\n          } else {\r\n            return done();\r\n          }\r\n        });\r\n      });\r\n    });\r\n  });\r\n```\r\n\r\nAnd here is the ACL configuration for `Cars`:\r\n\r\n```\r\n  \"acls\": [\r\n    {\r\n      \"accessType\": \"*\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$everyone\",\r\n      \"permission\": \"DENY\"\r\n    },\r\n    {\r\n      \"accessType\": \"READ\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$everyone\",\r\n      \"permission\": \"ALLOW\"\r\n    },\r\n    {\r\n      \"accessType\": \"EXECUTE\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"content-provider\",\r\n      \"permission\": \"ALLOW\",\r\n      \"property\": \"create\"\r\n    },\r\n    {\r\n      \"accessType\": \"*\",\r\n      \"principalType\": \"ROLE\",\r\n      \"principalId\": \"$owner\",\r\n      \"permission\": \"ALLOW\"\r\n    }\r\n  ],\r\n```"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback/issues/comments/198482295","html_url":"https://github.com/strongloop/loopback/issues/2149#issuecomment-198482295","issue_url":"https://api.github.com/repos/strongloop/loopback/issues/2149","id":198482295,"user":{"login":"jubbens","id":1747256,"avatar_url":"https://avatars.githubusercontent.com/u/1747256?v=3","gravatar_id":"","url":"https://api.github.com/users/jubbens","html_url":"https://github.com/jubbens","followers_url":"https://api.github.com/users/jubbens/followers","following_url":"https://api.github.com/users/jubbens/following{/other_user}","gists_url":"https://api.github.com/users/jubbens/gists{/gist_id}","starred_url":"https://api.github.com/users/jubbens/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jubbens/subscriptions","organizations_url":"https://api.github.com/users/jubbens/orgs","repos_url":"https://api.github.com/users/jubbens/repos","events_url":"https://api.github.com/users/jubbens/events{/privacy}","received_events_url":"https://api.github.com/users/jubbens/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T18:24:27Z","updated_at":"2016-03-18T18:24:27Z","body":"@richardpringle Thanks for your help, I simply changed the injected id from ownerId to userId and the test passes for me now. My fault, I owe you a beer. :)"}}