Role.isOwner() does not support polymorphic belongsTo relations to multiple User models

[lehni]

Description/Steps to reproduce

See this comment by @ebarault outlining the problem and how to reproduce it by activating a currently skipped test in multiple-user-principal-types.test.js:

This test currently fails, see the inlined comments, support for polymorphic belongsTo should be added to isOwner() to solve this issue.
I shook my head for almost an hour on this, trying to find a solution as-is or wondering if it could just be solved at all, before realizing this was a design issue. Using standard belongsTo relations between persisted models and user when using multiple user models in an app just won't do it, expect under particular circumstances.

Let's address belongsTo + polymorphic in a follow-up PR.
I marked the faulty tests as skipped to keep track

Link to reproduction sandbox

Simply activate this test by changing it.skip to it here:

loopback/test/multiple-user-principal-types.test.js

Line 479 in 8488da2

it.skip('resolves the owner using the corrent belongsTo relation',

Expected result

The owner should be resolved using the correct belongsTo relation

Additional information

Related issues:

• Fix OWNER role to handle multiple relations #3140

I believe as of v3.14.0, this situation is now triggering the following warning on the console:

The app configuration follows the multiple user models setup as described in http://ibm.biz/setup-loopback-auth The built-in role resolver $owner is not currently compatible with this configuration and should not be used in production

Once this issue is resolved, this warning can be removed.

[louie007]

Any updates ?

[lehni]

If there were updates, they would be listed in this issue... I personally don't know how to fix this, I just created the issue to make sure it does not get forgotten.

[L-David]

sorry, I don't quite understand the warning, does it means we can't have two CustomUserModels having an ownership relationship to the same model instance or we should not use any of the built-in role resolver at all. Or shouldn't be using multiple user config in production and try to supercharge a simple user config.

[shaheero]

Since 3.13.0 has broken even the current working $owner relations and introduced "ownerRelations" as per ef7175a and now that this warning appears:

The app configuration follows the multiple user models setup as described in http://ibm.biz/setup-loopback-auth The built-in role resolver $owner is not currently compatible with this configuration and should not be used in production

Is there any documentation on how and where to use "ownerRelations"?

In order for the warning to go away, where should {ownerRelations: true} be placed?

I have tried placing it in every User extended model in various parts of the mode.json file but seems to do nothing.

@raymondfeng
@pierreclr
@bajtos

[bajtos]

@shaheero @L-David

Is there any documentation on how and where to use "ownerRelations"?

I guess this doc page would be the place where to document "ownerRelations", but AFAICT there is no mention there :( http://loopback.io/doc/en/lb3/Managing-users.html

Since 3.13.0 has broken even the current working $owner relations

We definitely did not want to break existing applications, that's why we introduced the new model setting ownerRelations that's turned off by default to preserve backwards compatibility. If there is a situation where an existing app used to work but breaks after update, then please open a new issue and describe how to reproduce the problem (see http://loopback.io/doc/en/contrib/Reporting-issues.html#bug-report). A pull request to fix the problem would be more than welcome!

where should {ownerRelations: true} be placed?

If you are using the built-in User model as-is, then you need to define a new user model (inheriting from the built-in User model) first, see Extending built-in models. Then add "ownerRelations": true to your new model JSON file, e.g.

{
  "name": "MyUser",
  "base": "User",
  "ownerRelations": true
}

If this does not work for you, then please open a new issue and provide us with a small app reproducing the problem.

Thank you!

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[shaheero]

Last time I tried, this was still persisting.