How to hide base classes from RestAPI / Explorer?

It appears that when User is inherited - by a user defined class (e.g. Customer) - both Customer and User are visible by default in the Explorer -- how can the User path be removed from the Explorer and or the Rest interface without affecting Customer class?

@tbrannam

Hi @tbrannam, I believe the REST API and Explorer include only models that are configured in the application (typically via model-config.json). When your application has a Customer model replacing the built-in User model, you should remove the User entry from your model-config.json.

@bajtos

@bajtos Will Customer model then take place of the User model entirely?

I mean, when the User entry has been removed from model-config.json, User model won't be setup during loopback app booting, hence there is no User model in the loopback app (app.models['User'] === undefined). And does loopback know that:

now the Customer model have taken the role of User model, and all models that used to relate with User model should relate with Customer model now?

Try this to hide the methods you don't want to be exposed

// in server/boot/user_extended.js
User.sharedClass.find('count', true).shared = false;

After that, although you will still see that method in API explorer, but try invoking it via curl will return "method not found" error, which means the method is hidden.

Any ways to actually remove it from the explorer as well?

@frankcarey

@frankcarey in model-config.json, remove it or set "public": false

That will remove the entire model no? What if I just want to hide a particular method (/User/login for instance) I'd be fine with hiding everything, then just enabling the routes that I actually wanted to use.. Sails basically does that.

@frankcarey

@clarkorz now the Customer model have taken the role of User model, and all models that used to relate with User model should relate with Customer model now?

No.

LoopBack authentication uses loopback.getModelByType(loopback.User) to get the user model, thus it will use the correct class.

However, relations are not that smart, you have to reconfigure their targets manually. This can be done in server/model-config.json:

{
  "AccessToken": {
    "dataSource": "db",
    "relations": {
      "user": { "model": "Customer" }
    }
}

@frankcarey You can hide a particular method using a recently added API Model.disableRemoteMethod(name, isStatic). That should remove the method from the explorer too. Unless you hide it after the swagger metadata was constructed, which happens on the first request for swagger metadata.

I am closing this issue as answered, please open a new issue or send a message to our mailing list if you have more questions.

I can put this at user.js, model extends from build-in user, which hidden count API from API explorer and probably disable
user.sharedClass.find('count', true).shared = false

But I want to hide and disable reset API but have type error

user.sharedClass.find('reset', true).shared = false

TypeError: Cannot set property 'shared' of null

Anyway, these API should be in document somewhere.

Many Thanks

@crandmck

@crandmck ^

@mike-aungsan

Parts of the above are documented:

sharedClass.find()
sharedMethod - I notice that the shared class property does not have a description--I will add that.

AFAIK, there is no reset method of user, but there is a resetPassword method, so @mike-aungsan maybe you should use that instead:

user.sharedClass.find('resetPassword', true).shared = false

But I think the "best practice" way to do this is:

User.disableRemoteMethod("resetPassword", true);

@crandmck

@crandmck
What is the different between those two?

For example,

// does not work
user.disableRemoteMethod('update', true)
user.disableRemoteMethod('destroyById', true)

// it work
user.sharedClass.find('update', true).shared = false
user.sharedClass.find('destroyById', true).shared = false

Thanks.

Where is this code running? Normally, it's User (not user), because you do

var User = app.models.User;

I extend User model and the name is user.

  module.exports = function(user) {
    user.disableRemoteMethod('createChangeStream', true)

    // Update or insert a model instance
    user.disableRemoteMethod('upsert', true)
    user.disableRemoteMethod('create', true)
    user.disableRemoteMethod('resetPassword', true)

    user.sharedClass.find('update', true).shared = false
    user.sharedClass.find('destroyById', true).shared = false
    user.sharedClass.find('find', true).shared = false
  };

I just want to know the different between those two since I don't know what is sharedClass.
Anyway, I will wait your description

Many Thanks

Check this solution from ericpietro.

Navigation Menu

Repository navigation

How to hide base classes from RestAPI / Explorer? #465

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

How to hide base classes from RestAPI / Explorer? #465

Description

Activity

bajtos commented on Aug 13, 2014

clark0x commented on Aug 13, 2014

coodoo commented on Aug 15, 2014

frankcarey commented on Sep 7, 2014

clark0x commented on Sep 7, 2014

frankcarey commented on Sep 8, 2014

bajtos commented on Oct 23, 2014

mike-aungsan commented on Oct 27, 2015

superkhau commented on Oct 27, 2015

crandmck commented on Oct 28, 2015

mike-aungsan commented on Oct 29, 2015

crandmck commented on Oct 29, 2015

mike-aungsan commented on Nov 2, 2015

Edudjr commented on Jul 15, 2016

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions