Read only properties

[ritch]

I've heard this requested a couple of times now. Creating an issue so people can discuss details. I'd like to have something like:

{"readOnly": {"propertyName": true}}

We could also make this a setting on the property itself... The version above allows us to implement it outside the scope of properties...

[arjan123]

would be a very handy feature. Maybe in combination with dynamic, calculated properties

[mrfelton]

Also very interested in this. My use case is to lock down properties that are used to define relationships so that the relationships can't be changed. For example, an address belongs to a person and is related to it through a personId property. I don't want to allow the address to be assigned to a different user by simply changing the personId value.

[violet-day]

+1

[mrfelton]

I've implemented this as a mixin, available at https://www.npmjs.com/package/loopback-ds-readonly-mixin

[snapjay]

Yes, this seems like a huge security issue. I feel like I'm missing something that this can't be done out of the box.

Many thanks @mrfelton. Your mixin works great for now!

[bebop23]

+1

[ffflabs]

If the acting user has write privileges on a given entity, I don't see why wouldn't he be able to update its properties.

If the underlaying database engine had a FK on the field, then the only restricción would be to point to a valid master id. I don't agree on adding model behavior that doesn't map to a native behavior on the database engine. It breaks separation of concerns and introduces an unnecesary coupling between app and db.

Since this restricción doesn't belong to the model itself, it can only exist as a middleware or as a custom rule among the business logic, which in this case would be a remote hook.

[csvan]

I would very much like this.

In our usecase, all model instances are associated with a Team, and on the basis of this association we derive both access rights as well as relations. This team association is set once when the instance is created, and by spec must never change after that (not even the user who owns the instance is able to change it). The association needs to be exposed via REST, however, since we use it on the client-side to query related data.

Currently we are solving this using mixins, but this almost certainly is a clumsy solution and it would be much more convenient to simply be able to mark the property as immutable.

[dotlouis]

+1 Would also like to see a readOnly property.
My use case is that we store a number of followers as a property to avoid having to compute it each time from a hasAndBelongsToMany relation wich can be intensive.
But we don't want the user to be able to change the followersCount himself.

[barocsi]

@amenadiel an user would be able to abuse its own profile :)