"shared" property on User model not working

[coodoo]

I'm having a look at loopback-example-app and playing around location.js, trying to block one method from being accessed via REST API:

1. Setting RentalLocation.find.shared = false;
2. Try to access that method in explorer and expect it to be hidden or not accessible, but it still returns result.

Thought that was the correct way to hide a method from showing up in REST end point?

[sam-artuso]

same problem here.

[ritch]

What version of loopback?

[sam-artuso]

2.0 for me. I've posted more info here http://stackoverflow.com/questions/25002104/how-to-hide-rest-api-methods-in-loopback-2-0

[coodoo]

v2.

[kontza]

Ditto here, running version 2. Any workarounds available?

[raymondfeng]

@ritch is working on a fix.

Thanks,

---

Raymond Feng
Co-Founder and Architect @ StrongLoop, Inc.

StrongLoop makes it easy to develop APIs in Node, plus get DevOps capabilities like monitoring, debugging and clustering.

On Jul 30, 2014, at 3:12 AM, Juha Ruotsalainen notifications@github.com wrote:

Ditto here, running version 2. Any workarounds available?

—
Reply to this email directly or view it on GitHub.

[ritch]

In 2.0, I'm trying to encourage people to use the strong remoting objects directly. Here is an example.

module.exports = function(MyModel) {
  var isStatic = true;
  MyModel
    .sharedClass
    .find('find', isStatic)
    .shared = false;
}

Take a look at the SharedClass documentation for more.

Edit: find is a static method

[coodoo]

This would work, thanks for the tips.

Btw, should this go into documentation somewhere?

[johnsoftek]

I am a little confused by the example. Isn't 'find' a static method? What does isStatic = false mean?

[raymondfeng]

Each remote model has a sharedClass property representing the remoting metadata. The find method allows you to look up the SharedMethod by name so that you can change the shared flag. The isStatic controls if the remote method is a static or prototype method.

IMO, we should provide a helper method, such as:

Model.disableRemoteMethod(name, isStatic)

[nvdnkpr]

What about the shared status of related models ? How can I (taking the mentioned User model as example) disable the find/deleteById/update method for the user's access tokens ??

[raymondfeng]

At this moment, relation methods are internally added to the model prototype, for example,

User.prototype.__get__accessTokens
User.prototype.__create__accessTokens
User.prototype.__delete__accessTokens

You can use these names to disable the remoting.

[lchenay]

I'm still unable to disable shared method with sharedClass:

    var method = User
        .sharedClass
        .find('login', true);

    method.shared = false;

Method is still accessible.

[nvdnkpr]

Hello Raymond,
I know that they are internally added and that I can disable them by setting this methods to .shared = false. Problem is : There aren't any on that Models prototype 😄 . If you wan't to reproduce, try it in the loopback-example app: Add a customer.js and log out the Prototype.
e.g.

module.exports = function(Customer){
  console.log(Customer.prototype);
  console.log(Customer.super_.prototype);
};

[lchenay]

Try it inside a
Customer.on('dataSourceAttached', function (obj) {});
to be sure that all data are attached.