如何设置ACL以允许每个人列出REST API中的所有用户

Question

我试图使用REST API列出我的loopback 2.0应用程序中的所有用户,我收到以下错误:

{
  "error": {
    "name": "Error",
    "status": 401,
    "message": "Authorization Required",
    "statusCode": 401,
    "stack": "...."
  }
}

我手动将ACL添加到model-config.json文件中:

"User": {
    "dataSource": "db",
    "acls": [
        {
            "principalType": "ROLE",
            "principalId": "$everyone",
            "permission": "ALLOW",
            "accessType": "*"
        }
    ]
},

由于失败,我创建了一个基于User内置模型的模型:

{
    "name": "Admin",
    "base": "User",
    "properties": {},
    "validations": [],
    "relations": {},
    "acls": [
        {
            "principalType": "ROLE",
            "principalId": "$everyone",
            "permission": "ALLOW",
            "accessType": "*"
        }
    ],
    "methods": []
}

但是在REST API中我仍然遇到同样的问题:

{
  "error": {
    "name": "Error",
    "status": 401,
    "message": "Authorization Required",
    "statusCode": 401,
    "stack": "....."
  }
}

我感谢任何帮助.=)

Answer 1

1. 我们应该允许您使用其他ACL进一步配置内置模型.这是LoopBack的待办事项.

2. 您可以在common/user.json中对内置User模型进行子类化,如图所示.

   {"name":"user","base":"User","plural":"users"}

然后,您需要通过向server/model-config.json添加条目将其公开给REST,例如:

"user": {
    "dataSource": "db",
    "public": true
  },