From 44dfe346475071ee491313ee6b5d5256d00d3b69 Mon Sep 17 00:00:00 2001
From: Raymond Feng <raymond@strongloop.com>
Date: Fri, 15 Nov 2013 10:08:49 -0800
Subject: [PATCH] Allow ACLs for methods/relations

---
 lib/models/acl.js | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/models/acl.js b/lib/models/acl.js
index 61fe4453..028c1ead 100644
--- a/lib/models/acl.js
+++ b/lib/models/acl.js
@@ -165,7 +165,7 @@ ACL.checkPermission = function (principalType, principalId, model, property, acc
       modelClass.settings.acls.forEach(function(acl) {
         staticACLs.push({
           model: model,
-          property: ACL.ALL,
+          property: acl.property || ACL.ALL,
           principalType: acl.principalType,
           principalId: acl.principalId, // TODO: Should it be a name?
           accessType: acl.accessType,
@@ -173,7 +173,11 @@ ACL.checkPermission = function (principalType, principalId, model, property, acc
         });
       });
     }
-    var prop = modelClass && modelClass.definition.properties[property];
+    var prop = modelClass &&
+      (modelClass.definition.properties[property] // regular property
+      || (modelClass._scopeMeta && modelClass._scopeMeta[property]) // relation/scope
+      || modelClass[property] // static method
+      || modelClass.prototype[property]); // prototype method
     if(prop && prop.acls) {
       prop.acls.forEach(function(acl) {
         staticACLs.push({