loopback api returning error AUTHORIZATION_REQUIRED - node.js

Question

I am having two models : user and car
user acl :
"acls": [
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "admin",
"permission": "ALLOW",
"property": "find"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "ALLOW",
"property": "login"
},
{
"accessType": "READ",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "admin",
"permission": "ALLOW"
}
car acl :
"acls": [
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$everyone",
"permission": "DENY"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW",
"property": "find"
},
{
"accessType": "*",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "READ",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "EXECUTE",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "WRITE",
"principalType": "ROLE",
"principalId": "$owner",
"permission": "ALLOW"
},
{
"accessType": "WRITE",
"principalType": "ROLE",
"principalId": "$authenticated",
"permission": "ALLOW"
}
I am able to add car using api /cars but unable to get list of cars using api /cars , during get it is returning AUTHORIZATION_REQUIRED error code.
note : i am logged in as a user then i am trying to get list of cars owned by user.

Answer 1

It's possible that you're missing to add the model relation in agreement with Loopback documentation:
To qualify a $owner, the target model needs to have a belongsTo relation
to the User model (or a model extends from User) and property matching
the foreign key of the target model instance. The check for $owner is
only performed for a remote method that has ‘:id’ on the path, for
example, GET /api/users/:id.
Also I believe it would be a good idea change the default setting aclErrorStatus from 401 to 403. This way it would be easier to understand if it's an issue with authentication or authorization.