ACL Allows Relation access even though DENY *

[ritch]

@raymondfeng

See strongloop/loopback-example-access-control#2 (comment)

For a reproducible case.

Connect to #1362

[bajtos]

@superkhau could you help us here and check if strongloop/loopback-example-access-control#2 can be still reproduced in loopback 2.x?

[superkhau]

@bajtos it is reproducible. say we have two models, customers and reviews. if you create an acl that:

1. denies access to reviews only = you can still see reviews via a curl request to /api/customers/1/reviews, meaning the acl on relations are not enforced
2. denies access to customers and review = acl works properly and does not let the user access to api/customers/1 or /api/customers/1/reviews

[raymondfeng]

What is your ACL?

[superkhau]

1. deny all for reviews, allow all for customers
2. deny all for reviews, deny all for customers

[hotaru355]

I have just bumped into this issue and it is a major roadblock for us to get our server into production. I tried to track down the problem and would greatly appreciate your help. All I can say is that the before.** event is never fired for second level endpoints (/model/:id/relatedModel). Since the
application.js calls Model.checkAccess on this event, the entire ACL evaluation is disabled for those remotes. Clearly, those second level remotes must be setup differently than the first level remotes. Are those second level remotes maybe created after the eventhandler is registered?
Any hint would be greatly appreciated.

[ritch]

I have just bumped into this issue and it is a major roadblock for us to get our server into production. I tried to track down the problem and would greatly appreciate your help. All I can say is that the before.** event is never fired for second level endpoints (/model/:id/relatedModel).

I don't think this is correct. Or to be specific I don't think you are attaching your before hook to the correct model. Consider this endpoint:

/customers/1/reviews

This calls the Customers.prototype.__get__reviews method. It triggers the Customers before hook (not the Reviews). I have just confirmed this with loopback@2.17.2.

A potential issue (depending on how you expect ACL to work) is that the set of Review access controls are not applied when accessing Review through a relation. Only the Customer ACL is enforced.

[ritch]

I'm closing this as its no longer an issue.

Improvements will come to relation access control. Keep an eye on #1362