javascript - checking query arguments for loopback ACLs to allow `find`ing the user's data only -
i have 2 loopback services running independently in docker containers , talk each other.
one handles users
, other handles userdata
associated user. connected via remote connector on both servers point other server.
when current user
updates details on server needs update userdata on server b. auth done using jwt tokens, , managed server forward token given server b.
the problem having user.data()
on server gets passed remote connector , turned query /api/userdata/find?filter[where][userid]=2
on server b, acls on server b not allow queries on find
because everyone's data changing clause.
is there way create dynamic role lets user filter own data? (ie, can check query params in role resolver somehow?)
the way did create role checks arguments in context.remotingcontext.req
, verifies current user included in arguments.
Comments
Post a Comment