{"action":"created","issue":{"url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/83","repository_url":"https://api.github.com/repos/strongloop/loopback-example-access-control","labels_url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/83/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/83/comments","events_url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/83/events","html_url":"https://github.com/strongloop/loopback-example-access-control/issues/83","id":178960558,"number":83,"title":"restricting access to records in a table","user":{"login":"ORESoftware","id":11139560,"avatar_url":"https://avatars.githubusercontent.com/u/11139560?v=3","gravatar_id":"","url":"https://api.github.com/users/ORESoftware","html_url":"https://github.com/ORESoftware","followers_url":"https://api.github.com/users/ORESoftware/followers","following_url":"https://api.github.com/users/ORESoftware/following{/other_user}","gists_url":"https://api.github.com/users/ORESoftware/gists{/gist_id}","starred_url":"https://api.github.com/users/ORESoftware/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ORESoftware/subscriptions","organizations_url":"https://api.github.com/users/ORESoftware/orgs","repos_url":"https://api.github.com/users/ORESoftware/repos","events_url":"https://api.github.com/users/ORESoftware/events{/privacy}","received_events_url":"https://api.github.com/users/ORESoftware/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-23T19:54:48Z","updated_at":"2016-09-30T20:13:30Z","closed_at":null,"body":"We use Loopback :) Say we have two tables like so (in Postgres):\r\n\r\n```\r\ncontracts\r\n| id | name | manager_id |\r\n|----|------|-------------|\r\n| 1  | a    | 4           |\r\n| 2  | b    | 5           |\r\n| 3  | c    | 6           |\r\n\r\ncontract_managers\r\n| id | name |\r\n|----|------|\r\n| 4  | e    |\r\n| 5  | f    |\r\n| 6  | g    |\r\n\r\n```\r\nwhat we want is to implement low level access control to the contracts table - restricting user access to only certain records. Given the docs, it's not yet clear if we can restrict access to particular records, using ACLs alone.\r\n\r\nIf someone is logged into our application and they are a contract_manager, we want them to only be able to read records from the contracts table for records where the manager_id is the logged in user id. For example, if I am logged in and my user id = 4, I am thus a contract_manager, and I should only be able to read from the contracts table where the manager_id = 4.\r\n\r\nIs there a way to implement this simple logic with ACLs? Or do we need to create custom logic?"},"comment":{"url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/comments/250841156","html_url":"https://github.com/strongloop/loopback-example-access-control/issues/83#issuecomment-250841156","issue_url":"https://api.github.com/repos/strongloop/loopback-example-access-control/issues/83","id":250841156,"user":{"login":"the1mills","id":2148448,"avatar_url":"https://avatars.githubusercontent.com/u/2148448?v=3","gravatar_id":"","url":"https://api.github.com/users/the1mills","html_url":"https://github.com/the1mills","followers_url":"https://api.github.com/users/the1mills/followers","following_url":"https://api.github.com/users/the1mills/following{/other_user}","gists_url":"https://api.github.com/users/the1mills/gists{/gist_id}","starred_url":"https://api.github.com/users/the1mills/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the1mills/subscriptions","organizations_url":"https://api.github.com/users/the1mills/orgs","repos_url":"https://api.github.com/users/the1mills/repos","events_url":"https://api.github.com/users/the1mills/events{/privacy}","received_events_url":"https://api.github.com/users/the1mills/received_events","type":"User","site_admin":false},"created_at":"2016-09-30T20:13:30Z","updated_at":"2016-09-30T20:13:30Z","body":"I asked the same question on SO and got an answer, hopefully this is more or less correct:\r\n\r\nhttp://stackoverflow.com/questions/39668855/using-access-control-lists-in-loopback-for-restricting-access-to-table-records/39679210#39679210\r\n\r\nthanks "}}
{"actor":{"display_login":"the1mills"}}