Loopback protect nested relations

Question

I am having an issue protecting nested relations. I have three models:

1. User
   • has many Addresses
   • has many Users through Contacts
2. Address
   • belongs to User
3. Contacts (User-to-User link table)
   • belongs to User
   • has one User

A User can get their Address information:

/users/{user_id}/address.

A User can also get there Contacts:

/users/{user_id}/contacts.

But a User can also get there Contacts Addresses:

/users/{user_id}/contacts?filter={"include":"addresses"}

I would like to restrict the Addresses relation to the $owner.

---

Temporary solution:

for now i am manually checking to see if the owner is the one accessing the relation:

Address.observe('access', function restrict(ctx, next) {

  if(_.isObject(ctx.query.where) && ctx.query.where.user_id && ctx.query.where.user_id.inq){
    var id = app.models.user.getCurrentUserId();
    if(validate(ctx.query.where.user_id.inq[0] === id, 'Unauthorization Access', "UNAUTHORIZATION_ACCESS", 403, next)){return;}
  }

  next();

});

Answer 1

There is an issue in loopback created to fix it and track all related discussions: https://github.com/strongloop/loopback/issues/1362