How to set up ACLs to allow users to access only specific records?

Question

I'm planning to use Loopback to create an application where users will be able to access only specific records.

Let's say we have a Projects model, with 2 records:

{
    "projects": [
        {
            "project_name": "foo",
            "project_start_date": "2012-10-29T18:25:43.511Z"
        },
        {
            "project_name": "bar",
            "project_start_date": "2012-10-30T18:25:43.511Z"
        }
    ]
}

and that I have 2 users, joe and katie.

I want joe to be able to access only project foo, and katie to be able to access only project bar.

Is this possible at all? If so, how should I go about setting up the ACLs?

Answer 1

At the moment, the declarative ACL doesn't support your use case. You need to create afterRemote hook to further check the response. See http://docs.strongloop.com/display/LB/Remote+hooks.

Answer 2

You can also play with dynamic roles. See http://docs.strongloop.com/display/public/LB/Defining+and+using+roles#Definingandusingroles-Dynamicroles and similar loopback example: https://github.com/strongloop/loopback-example-access-control/blob/master/common/models/project.json