Loopback - How to assign an access token to a role? - loopbackjs

Question

New to loopback and I'm confused about loopback's access token system...
I have a couple of models extended from the base User model.
When i use the default route to login to each of them (admin, user, owner), i get an access_token.
Is it true that loopback automatically maps the access_token to the $authenticated role through rolemapping when you login?
How do i make it so the access_token that I get when i login is mapped to the "admin" role?
Also, what exactly is a "principalId" in the context of the RoleMapping model?
Thank you.

Answer 1

Both the model AccessToken and the model RoleMapping store a reference to the model User (or its extended model).
The access token is just a reference for the currently logged-in user, it doesn't contain any information about the role of the user. You do not associate access tokens to roles, and Loopback doesn't do that for you.
Indeed, you create ACL policies inside your models specifying when a user can access a resource, based on the user role. This is a typical example of admin role usage:
// table Role
id: 1
name: admin
description: Administrators have full read/write access to the content
// table User
id: 1
...
// Add this record to the table RoleMapping if you want to give the role admin to the above user
id: [auto-incremental]
principalType: "USER"
principalId: 1
roleId: 1
// ACL example: only admins can access the model
"acls": [
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "admin",
"permission": "ALLOW"
}
]
principalType refers to a resource and principalId refers to a specific resource object. This is a common way to reference objects of different resources.