Why does hyperledger composer acl file not take ef

Question

EDIT: rest-server gives the option "Specify if you want the generated REST API to be secured: (y/N)", is this to enforce the acl?

I've been trying to setup a simple test using hyperledger-composer node js client. In my config I have the following:

      "connection-info" : {
 "participantId" : "gk1",
 "participantPwd" :"CjysyeLjriRT",
 "businessNetworkIdentifier" : "myBizNetwork",
 "connectionProfile" : "defaultProfile"}

In my business network definition I have the following:

rule Default {
description: "DENY all participants access to all resources"
participant: "ANY"
operation: ALL
resource: "net.name.myBizNetwork"
action: DENY }

When I call the following code in node js app, I can still see the resources:

this.bizNetworkConnection.getAssetRegistry('net.name.myBizNetwork.TestAsset');
            }).then((registry) => {
                return registry.find('testAssetId = ' + id);

Obviously I'd like to do more scenarios with access control, but in my understanding this should work.

Answer 1

A good first point of call is to try out your model, acl, and script files in the online playground here https://composer-playground.mybluemix.net/

Note - you are an admin by default, to simulate being a participant you can do so by:

1. Clicking 'admin' in the top right of the playground '+ Issue New ID'

2. Supply a User ID (whatever you like) and participant (will be one you created earlier) and then press 'Create New'

3. Select Option 2: '+ Add to my Wallet' (This will allow you to then use the identity and you will 'be' that participant

From looking at your code, the resource you deny is "net.name.myBizNetwork". Following the documentation here https://hyperledger.github.io/composer/reference/acl_language.html I think that to deny access to the resources within your network you will need to add a '*' wildcard (see the Examples section in the link). If that doesn't work it may have something to do with identities.

Another note, from my understanding, you need to secure the API if you want to use identities. However, you also need to create/bind identities to existing participants, and then use those identities to 'be' that participant. See the article here https://hyperledger.github.io/composer/managing/identity-issue.html By default, you are a Null participant (you can see what participant you currently 'are' by pinging the network)