title: Get user access tokens and authenticate request
body: <p>I believe to have spent many hours on decoding this box of pendora by <a href="https://strongloop.com/" rel="nofollow noreferrer">strongloop</a> REST framework for NodeJS. I have successfully managed to setup a <a href="https://strongloop.com/strongblog/two-factor-authentication-with-loopback/" rel="nofollow noreferrer">two factor authentication</a> module following the tutorial. That is working fine, with <code>mongo</code> setup as datasource for users. </p>
  
  <p>I have 2 questions to ask:</p>
  
  <p>1) Once the <code>User.Create()</code> is executed, the following model structure is stored in database and sent as a response to client. </p>
  
  <pre><code>{
    "id": "RMQ1dC03Ws8swaxPNvqKLPXEbOw6PcKYPisjsQgOuPmqmqJ0hEJKNzsjROppQAHy",
    "ttl": 86400,
    "created": "2015-08-17T18:18:56.158Z",
    "userId": "55d2259032786ce55eeed0fca",
    "user": {
      "email": "somemail@gmail.com",
      "id": "55d2259032786ce55eeed0fca"
    }
  }
  </code></pre>
  
  <p>The <code>id</code> field is <code>accessToken</code> and <code>userId</code> is identifier against the user. <code>ttl</code> specifies the expiration time for the token, by default its 2 weeks, but if I <code>User.login()</code> anytime, a different accessToken is generated.</p>
  
  <p>How should I validate any user request against any accessToken provided in the URL?</p>
  
  <p>2) I want to create a <code>superUser</code> or <code>admin</code> user to access all the accessTokens against any user, the permission is denied by default. To do this I have created a user with <code>role admin</code> in the boot script:</p>
  
  <pre><code>module.exports = function(app) {
      var role = app.models.Role;
      var roleMapping = app.models.RoleMapping;
      app.models.User.login({email: 'somemail@gmail.com', password: '124154'}, function(err, accessToken) {
                      if (err) return console.error(err);
                      console.log(accessToken);
                      role.create({
                          name:'admin'
                      }, function(err, rtnRole){
                          if (err) {
                            console.log('role error');
                            return console.error(err);
                        }
                        rtnRole.principals.create({
                            principalType: roleMapping.USER,
                            principalId: accessToken.userId
                        }, function(err, principal){
                            if (err) return console.error(err);
                            console.dir(principal);
                        });
                      });
                  });
  
  };
  </code></pre>
  
  <p>Output:</p>
  
  <pre><code>{ principalType: 'USER',
    principalId: '55d168c82de07a275c07921f',
    roleId: 1,
    id: 1 }
  </code></pre>
  
  <p>...Still this user is not authorized for accesstokens.. How should I get admin control? And authenticate any user request with tokens?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Having followed the steps provided by @Thibault, I am able to generate <code>acl</code> for admin. This is what my <code>model.json</code> looks like now:</p>
  
  <pre><code>{
    "name": "BudUser",
    "base": "User",
    "idInjection": true,
    "options": {
      "validateUpsert": true
    },
    "properties": {
      "email": {
        "type": "string",
        "required": true,
        "index": {
          "unique": true
        }
      },
      "number": {
        "type": "string"
      }
    },
    "validations": [],
    "relations": {},
    "acls": [
      {
        "accessType": "*",
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "requestCode"
      },
      {
        "accessType": "*",
        "principalType": "ROLE",
        "principalId": "$everyone",
        "permission": "ALLOW",
        "property": "loginWithCode"
      },
      {
        "accessType": "*",
        "principalType": "ROLE",
        "principalId": "admin",
        "permission": "ALLOW"
      }
    ],
    "methods": {}
  }
  </code></pre>
  
  <p>How to query <code>https://nodews-somedomain.c9.io:443/api/BudUsers/id/accessTokens</code> to get all <code>accessToken</code> of the user? And how to authenticate a user request that looks like:</p>
  
  <p><code>https://nodews-faizanjehangir.c9.io:443/api/BudUsers/getList?accessToken=214392174214jh21hgj12g4</code></p>
  
  <p>Also, should I be worried about tokens generation and expiration? Should I store them in database?</p>
  
  <p><a href="https://i.stack.imgur.com/kvimN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/kvimN.png" alt="User not authorized"></a></p>