How to set up ACLs to allow users to access only s

Question

I'm planning to use Loopback to create an application where users will be able to access only specific records.

Let's say we have a Projects model, with 2 records:

{
    "projects": [
        {
            "project_name": "foo",
            "project_start_date": "2012-10-29T18:25:43.511Z"
        },
        {
            "project_name": "bar",
            "project_start_date": "2012-10-30T18:25:43.511Z"
        }
    ]
}

and that I have 2 users, joe and katie.

I want joe to be able to access only project foo, and katie to be able to access only project bar.

Is this possible at all? If so, how should I go about setting up the ACLs?

Answer 1

You can also play with dynamic roles. See http://docs.strongloop.com/display/public/LB/Defining+and+using+roles#Definingandusingroles-Dynamicroles and similar loopback example: https://github.com/strongloop/loopback-example-access-control/blob/master/common/models/project.json

Answer 2

At the moment, the declarative ACL doesn't support your use case. You need to create afterRemote hook to further check the response. See http://docs.strongloop.com/display/LB/Remote+hooks.