Strongloop/Loopback - Override User model via boot script

01-override-User-model.js

module.exports = function(app) {
  var User = app.models.User;

  // TODO: (1) find an example of how to add new "properties" to the built-in User mode via boot script

  // (2) This is how you can add a "relationship" to the built-in User model via boot script
  var SomeOtherModel = app.models.SomeOtherModel;
  User.hasMany(SomeOtherModel, {as: 'someOtherModels', foreignKey: 'someOtherModelId'});

  // (3) This is how you can add "remote methods" to the built-in User model via boot script
  // (3a) either
  User.greet = function(msg, cb) {
    cb(null, 'Greetings... ' + msg);
  }
  // (3a) or
  User.remoteMethod(
    'greet',
    {
      accepts: {arg: 'msg', type: 'string'},
      returns: {arg: 'greeting', type: 'string'}
    }
  );

  // (4) This is a low-level/dynamic way to add "remoting" for any of the built-in models via boot script
  //     reference: https://groups.google.com/forum/#!topic/loopbackjs/0yHzU7PR19U
  //     *** UN-TESTED BY THE ORIGINAL AUTHOR OF THIS GIST ***
  /*var remotes = app.remotes();
  remotes.after('**', function(ctx, next, method) {
    var req = ctx.req;
    var Model = method.ctor;
    var modelInstance = ctx.instance;
    if (Model.modelName === 'MyModel') {
      // ...
    }
    next();
  });*/

  // (5) This is how you can add "hooks" to the built-in User model via boot script
  User.beforeCreate = function(next, modelInstance) {
    console.log('inside User.beforeCreate');
    // your code goes here
    next();
  };

  // (6) This is how you can add "event observers" to the built-in User model via boot script
  User.on('resetPasswordRequest', function (info) {
    console.log('inside User.on.resetPasswordRequest');
    // your code goes here
  });
};

Thanks a bunch for this Gist.

In practice, I found that extending the ACLs quickly becomes a requirement as soon as you do any kind of other customization on the built-in model.

There is a project to allow ACLs to be overriden in model-config.json that is being worked on and tracked in loopback issue #669, but in the meantime, I would suggest the approach below. In this example, read access is granted to a related model (as defined in section (2)):

// (7) This is how you can add ACLs to the built-in User model via boot script
var ACL = app.models.ACL;
ACL.create({
  model: 'User',
  accessType: 'READ',
  principalType: 'ROLE',
  principalId: '$owner',
  permission: 'ALLOW',
  property: '__get__someOtherModels',
}, function (err, acl) {
  console.log('ACL entry created: %j', acl);
});

If for any reason, this could be considered a bad idea, or if there is a better, sanctioned alternative, please let me know.

@coox I'm not sure which one si better but I do like that :

User.settings.acls.push({
  accessType: 'READ',
  principalType: 'ROLE',
  principalId: '$owner',
  permission: 'ALLOW',
  property: '__get__someOtherModels',
});

PS: it seems that loopback does the same way to apply the ACL specified in model.json