Function legacyOwnershipCheck

common/models/role.js:309–348

(inst)

    // ownership check induced the whole isOwner() to resolve as false.
    // This behaviour will be pruned at next LoopBack major release.
    function legacyOwnershipCheck(inst) {
      const ownerId = inst.userId || inst.owner;
      if (principalType === Principal.USER && ownerId && 'function' !== typeof ownerId) {
        return callback(null, matches(ownerId, userId));
      }

      // Try to follow belongsTo
      for (const r in modelClass.relations) {
        const rel = modelClass.relations[r];
        // relation should be belongsTo and target a User based class
        const belongsToUser = rel.type === 'belongsTo' && isUserClass(rel.modelTo);
        if (!belongsToUser) {
          continue;
        }

        // checking related user
        const relatedUser = rel.modelTo;
        const userModelName = relatedUser.modelName;
        const isMultipleUsers = _isMultipleUsers(relatedUser);
        // a relation can be considered for isOwner resolution if:
        // 1. the app has a single user model and principalType is 'USER'
        // 2. the app has multiple user models and principalType is the related user model name
        if ((!isMultipleUsers && principalType === Principal.USER) ||
            (isMultipleUsers && principalType === userModelName)) {
          debug('Checking relation %s to %s: %j', r, userModelName, rel);
          inst[r](processRelatedUser);
          return;
        }
      }
      debug('No matching belongsTo relation found for model %j - user %j principalType %j',
        modelId, userId, principalType);
      callback(null, false);

      function processRelatedUser(err, user) {
        if (err || !user) return callback(err, false);

        debug('User found: %j', user.id);
        callback(null, matches(user.id, userId));
      }
    }

    function checkOwnership(inst) {
      const ownerRelations = inst.constructor.settings.ownerRelations;