feat: define custom access scopes for built-in relations

lib/model.js

@@ -548,6 +548,8 @@ module.exports = function(registry) {
     modelName = modelName || 'PersistedModel';
     const fn = this.prototype[relationName];
     const pathName = (relation.options.http && relation.options.http.path) || relationName;
+    const remoting = relation.options.remoting;
+
     define('__get__' + relationName, {
       isStatic: false,
       http: {verb: 'get', path: '/' + pathName},
@@ -556,6 +558,7 @@ module.exports = function(registry) {
         {arg: 'options', type: 'object', http: 'optionsFromRequest'},
       ],
       accessType: 'READ',
+      accessScopes: getDefaultAccessScopes(remoting, 'get'),
       description: g.f('Fetches belongsTo relation %s.', relationName),
       returns: {arg: relationName, type: modelName, root: true},
     }, fn);
@@ -574,8 +577,13 @@ module.exports = function(registry) {
     cb(error);
   }
 
+  function getDefaultAccessScopes(remoting, name) {
+    return remoting && remoting[name] && remoting[name].accessScopes || undefined;
+  }
+
   Model.hasOneRemoting = function(relationName, relation, define) {
     const pathName = (relation.options.http && relation.options.http.path) || relationName;
+    const remoting = relation.options.remoting;
     const toModelName = relation.modelTo.modelName;
 
     define('__get__' + relationName, {
@@ -587,6 +595,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Fetches hasOne relation %s.', relationName),
       accessType: 'READ',
+      accessScopes: getDefaultAccessScopes(remoting, 'get'),
       returns: {arg: relationName, type: relation.modelTo.modelName, root: true},
       rest: {after: convertNullToNotFoundError.bind(null, toModelName)},
     });
@@ -603,6 +612,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Creates a new instance in %s of this model.', relationName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'create'),
       returns: {arg: 'data', type: toModelName, root: true},
     });
 
@@ -618,6 +628,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Update %s of this model.', relationName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'update'),
       returns: {arg: 'data', type: toModelName, root: true},
     });
 
@@ -629,11 +640,13 @@ module.exports = function(registry) {
       ],
       description: g.f('Deletes %s of this model.', relationName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'destroy'),
     });
   };
 
   Model.hasManyRemoting = function(relationName, relation, define) {
     const pathName = (relation.options.http && relation.options.http.path) || relationName;
+    const remoting = relation.options.remoting;
     const toModelName = relation.modelTo.modelName;
 
     const findByIdFunc = this.prototype['__findById__' + relationName];
@@ -651,6 +664,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Find a related item by id for %s.', relationName),
       accessType: 'READ',
+      accessScopes: getDefaultAccessScopes(remoting, 'findById'),
       returns: {arg: 'result', type: toModelName, root: true},
       rest: {after: convertNullToNotFoundError.bind(null, toModelName)},
     }, findByIdFunc);
@@ -670,6 +684,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Delete a related item by id for %s.', relationName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'destroyById'),
       returns: [],
     }, destroyByIdFunc);
 
@@ -687,6 +702,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Update a related item by id for %s.', relationName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'updateById'),
       returns: {arg: 'result', type: toModelName, root: true},
     }, updateByIdFunc);
 
@@ -715,6 +731,7 @@ module.exports = function(registry) {
         ]),
         description: g.f('Add a related item by id for %s.', relationName),
         accessType: 'WRITE',
+        accessScopes: getDefaultAccessScopes(remoting, 'link'),
         returns: {arg: relationName, type: modelThrough.modelName, root: true},
       }, addFunc);
 
@@ -733,6 +750,7 @@ module.exports = function(registry) {
         ],
         description: g.f('Remove the %s relation to an item by id.', relationName),
         accessType: 'WRITE',
+        accessScopes: getDefaultAccessScopes(remoting, 'unlink'),
         returns: [],
       }, removeFunc);
 
@@ -753,6 +771,7 @@ module.exports = function(registry) {
         ],
         description: g.f('Check the existence of %s relation to an item by id.', relationName),
         accessType: 'READ',
+        accessScopes: getDefaultAccessScopes(remoting, 'exists'),
         returns: {arg: 'exists', type: 'boolean', root: true},
         rest: {
           // After hook to map exists to 200/404 for HEAD
@@ -777,6 +796,8 @@ module.exports = function(registry) {
   Model.scopeRemoting = function(scopeName, scope, define) {
     const pathName =
       (scope.options && scope.options.http && scope.options.http.path) || scopeName;
+    const remoting = (scope.options && scope.options.remoting);
+
 
     let modelTo = scope.modelTo;
 
@@ -809,6 +830,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Queries %s of %s.', scopeName, this.modelName),
       accessType: 'READ',
+      accessScopes: getDefaultAccessScopes(remoting, 'get'),
       returns: {arg: scopeName, type: [toModelName], root: true},
     });
 
@@ -828,6 +850,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Creates a new instance in %s of this model.', scopeName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'create'),
       returns: {arg: 'data', type: toModelName, root: true},
     });
 
@@ -846,6 +869,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Deletes all %s of this model.', scopeName),
       accessType: 'WRITE',
+      accessScopes: getDefaultAccessScopes(remoting, 'delete'),
     });
 
     define('__count__' + scopeName, {
@@ -860,6 +884,7 @@ module.exports = function(registry) {
       ],
       description: g.f('Counts %s of %s.', scopeName, this.modelName),
       accessType: 'READ',
+      accessScopes: getDefaultAccessScopes(remoting, 'count'),
       returns: {arg: 'count', type: 'number'},
     });
   };