用户无法在 LoopBackJS 中访问或编辑自己

Question

谁能帮帮我？

我创建了一个管理员用户和一个简单用户，管理员可以做任何事情都可以，但我正在尝试使用他自己的经过身份验证的令牌编辑简单用户，即使使用 get、post、放置或删除，这里是我的 user.json：

{
"name": "User",
"properties": {
"realm": {
"type": "string"
},
"username": {
"type": "string"
},
"realName": {
"type": "string",
"required": true
},
"timezone": {
"type": "string",
"required": false
},
"language": {
"type": "string",
"required": false
},
"password": {
"type": "string",
"required": true
},
"credentials": {
"type": "object",
"deprecated": true
},
"challenges": {
"type": "object",
"deprecated": true
},
"email": {
"type": "string",
"required": true
},
"ownerId": {
"type": "number",
"required": true
},
"emailVerified": "boolean",
"verificationToken": "string",
"status": "boolean",
"created": "date",
"lastUpdated": "date"
},
"hidden": ["password"],
"acls": [
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "create"
},
{
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW",
"property": "deleteById"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "login"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "logout"
},
{
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW",
"property": "findById"
},
{
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW",
"property": "upsert"
},
{
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW",
"property": "updateAttributes"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "activation"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "confirm"
},
{
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "resetPassword",
"accessType": "EXECUTE"
}
],
"relations": {
"accessTokens": {
"type": "hasMany",
"model": "AccessToken",
"foreignKey": "userId",
"options": {
"disableInclude": true
}
}
}
}

Answer 1

好的，让我们解释一下解决方案。

使用安全调试命令行，我可以看到 Loopback 如何解析权限：

# DEBUG=loopback:security:role node .
loopback:security:role isInRole(): $everyone +0ms
  loopback:security:role Custom resolver found for role $everyone +1ms
  loopback:security:role isInRole(): $owner +0ms
  loopback:security:role Custom resolver found for role $owner +0ms
  loopback:security:role isOwner(): User 11 userId: 11 +1ms
  loopback:security:role Model found: {"realm":null,"username":"...","id":11} +4ms
  loopback:security:role No matching belongsTo relation found for model "11" and user: 11 +1ms

使用这些数据，我在 User 表中创建了一个名为“userId”的字段，并在它自己的文件 (user.json) 中为该字段指定了一个 belongsTo 指令。

"user": {
      "type": "belongsTo",
      "model": "User",
      "foreignKey": "userId"
    }

现在用户 11 可以编辑您自己的个人资料，但不能查看或更改任何其他用户注册。

这不是一个漂亮的解决方案，实际上环回应该在 ACL 逻辑中有这个自相关的指令，但它确实有效。

问候

Answer 2

您打算覆盖基本用户模型吗？如果是这样，您应该将其命名为 MyUser 并将基础设置为“用户”。在 server/model-config.json 中，为“User”设置“public”为 false，为“MyUser”设置为 true。