Disable passthrough access with access filtering on static methods

Author: Tom Kirkpatrick

lib/index.js

@@ -26,7 +26,10 @@ module.exports = function loopbackComponentAccess(app, options) {
 
   // Set up role resolvers.
   accessUtils.setupRoleResolvers();
+
+  // TODO: Rethink wether access filtering can be applied safely.
   // Set up model opertion hooks
-  accessUtils.setupModels();
-// TODO: Create Group Access model automatically if one hasn't been specified
+  // accessUtils.setupModels();
+
+  // TODO: Create Group Access model automatically if one hasn't been specified
 };

lib/utils.js

@@ -287,9 +287,9 @@ module.exports = class AccessUtils {
 
       if (!context || !context.model || !context.modelId) {
         process.nextTick(() => {
-          debug('Allow passthrough access (context: %s, context.model: %s, context.modelId: %s)',
+          debug('Deny access (context: %s, context.model: %s, context.modelId: %s)',
             !!context, !!context.model, !!context.modelId);
-          if (cb) cb(null, true);
+          if (cb) cb(null, false);
         });
         return;
       }