I would like to see an even more advanced ACL implementation in Loopback.next, that supports ACL's on a object-level.
LB v.2/3 has great ways of applying ACL's to an entire model and it's methods, but in many use-cases I want objects/instances only to be accessible to specific users, which has been explicitly granted permission by the client upon creation (pending issue at Loopback repo here).
When the client requests an authenticated GET request, the response will only contain objects that the client has permission to read.
I've made my own mixin to add this feature, which basically manipulates the query at every 'access' event of the datasource.
I'd be happy to help implement this feature into native Loopback.next, should it be considered beneficial for the framework.
I would like to see an even more advanced ACL implementation in Loopback.next, that supports ACL's on a object-level.
LB v.2/3 has great ways of applying ACL's to an entire model and it's methods, but in many use-cases I want objects/instances only to be accessible to specific users, which has been explicitly granted permission by the client upon creation (pending issue at Loopback repo here).
When the client requests an authenticated
GETrequest, the response will only contain objects that the client has permission to read.I've made my own mixin to add this feature, which basically manipulates the query at every 'access' event of the datasource.
I'd be happy to help implement this feature into native Loopback.next, should it be considered beneficial for the framework.