&owner for posting new model doesn't work - loopbackjs

Question

Using this ACL for models, I want to prevent creating new models that have owner (userId) for those access-tokens that lead to other users, rather than the actual owner. I don't want userId 4 post a new model, and set that model's owners to 5, another userId. But this doesn't work right now, since there is no model on database to check, so what should I do? This worked for deletion last time I checked. But I need for posting...

Answer 1

I think this will do it.
server/boot/01-add-user.js
module.exports = (server) => {
// Before each create request, assign the userId property to the userId of the accessToken
const addUser = async (ctx) => {
function assignUserId(o) {
o.userId = ctx.req.accessToken.userId;
}
// You can post arrays of objects to loopback
if (Array.isArray(ctx.req.body)){
ctx.req.body.forEach(assignUserId);
} else {
assignUserId(ctx.req.body);
}
};
server.models.MY_MODEL.beforeRemote('create', addUser);
}
For your ACLs try this
"acls": [
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"accessType": "READ",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "WRITE",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"principalType": "ROLE",
"principalId": "$authenticated",
"permission": "ALLOW",
"property": "create"
}
],