使用用户模型时在环回中不断收到 401 错误

Question

我是 loopback 新手，无法正确扩展 User Base 模型。尽管在资源管理器中显示它已扩展，但所有 API 都会给出 401 错误。前任。在正常情况下，我得到 /users 的呼叫..

{
  "error": {
    "name": "Error",
    "status": 401,
    "message": "Authorization Required",
    "statusCode": 401,
    "code": "AUTHORIZATION_REQUIRED",
    "stack": "Error: Authorization Required"
  }
}

我浏览了所有链接和问题，但没有一个对我有用。我已将 public:true 正确放入用户模型扩展模型的模型配置中并编写了 acls 等，但它们都不起作用。我还在 git for strongloop 上提出了一个问题：https://github.com/strongloop/loopback/issues/1809。任何线索都会很棒。谢谢。

User.json 如下：

{
  "name": "user",
  "plural": "users",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "mongodb": {
    "collection": "User"
  },
  "properties": {
    "name": {
      "type": "string",
      "required": true
    },
    "email": {
      "type": "string",
      "required": true
    },
    "password": {
      "type": "string",
      "required": true
    },
    "phone": {
      "type": "string"
    }
  },
  "validations": [],
  "relations": {
    "question": {
      "type": "hasMany",
      "model": "question",
      "foreignKey": ""
    }
  },
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$owner",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "ALLOW"
    }
  ],
  "methods": {}
}

Answer 1

一些值得考虑的注意事项：

1）您正在定义电子邮件、密码、.. 属性，尽管它们已经在父用户模型中以完全相同的方式定义；请看：https://github.com/strongloop/loopback/blob/master/common/models/user.json;

2) 对于 ACL，您缺少访问类型，它们是不正确的，但它们不会破坏任何东西...有关 ACL 的更多信息，请参阅：https://docs.strongloop.com/display/public/LB/Define+access+controls

3）另外，当您登录时，请确保使用您创建的用户（POST 请求）并且它已经在数据库中。

谢谢！

Answer 2

您似乎尚未登录该应用程序。 无论如何，默认情况下，用户父类中的设置无法访问大多数功能。 （这完全是一个关闭）

1. 在登录部分运行代码

   { "用户名":"abc", “密码”：“xyz” }

2. 此操作将返回令牌 ID。

3. 在页面右上角输入这个id，然后点击set token按钮。
4. 现在您可以使用部分用户功能了。

创建模型继承用户

:~/nodejs/lab/user-api$ slc loopback:model
? Enter the model name: customer
? Select the data-source to attach customer to: db (memory)
? Select model's base class: User
? Expose customer via the REST API? Yes
? Custom plural form (used to build REST URL): customers
Let's add some customer properties now.

Enter an empty property name when done.
? Property name: phone
   invoke   loopback:property
? Property type: string
? Required? No

Let's add another customer property.
Enter an empty property name when done.
? Property name: 

授予 ACL 访问权限：

 slc loopback:acl
? Select the model to apply the ACL entry to: customer
? Select the ACL scope: All methods and properties
? Select the access type: All (match all types)
? Select the role: All users
? Select the permission to apply: Explicitly grant access

再次授予 ACL 访问权限：

 slc loopback:acl
? Select the model to apply the ACL entry to: customer
? Select the ACL scope: All methods and properties
? Select the access type: All (match all types)
? Select the role: All users
? Select the permission to apply: Explicitly grant access

当我们两次授予访问权限时，它优先于基类中的 DENY。下次你会得到结果。

带有 ACL 的示例类。您可以在回送项目中尝试它，它会起作用:)

{
  "name": "customer",
  "plural": "customers",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {
    "phone": {
      "type": "string"
    }
  },
  "validations": [],
  "relations": {},
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "ALLOW"
    },
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "ALLOW"
    }
  ],
  "methods": []
}

如果有效，请接受答案。它会。干杯!