Loopbackjs 如何正确设置环回中的ACL

我在环回中遇到acl问题。 我能够正确地在数据库中创建角色和角色映射集合。 问题是，当管理员试图创建一个新产品时，它说这是未经授权的。有没有人能指引我做错了什么，或者指引我正确的做法

project.json

{
  "name": "product",
  "base": "PersistedModel",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {},
  "validations": [],
  "relations": {

    "admin": {
      "type": "belongsTo",
      "model": "admin",
      "foreignKey": ""
    }
  },
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    },
    {
      "accessType": "READ",
      "principalType": "ROLE",
      "principalId": "$authenticated",
      "permission": "ALLOW"
    },
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "admin",
      "permission": "ALLOW",
      "property": "create"
    }
  ],
  "methods": {}
}

admin.json

    {
  "name": "admin",
  "base": "User",
  "idInjection": true,
  "options": {
    "validateUpsert": true
  },
  "properties": {},
  "validations": [],
  "relations": {
    "products": {
      "type": "hasMany",
      "model": "product",
      "foreignKey": ""
    }
  },
  "acls": [
    {
      "accessType": "*",
      "principalType": "ROLE",
      "principalId": "$everyone",
      "permission": "DENY"
    }
  ],
  "methods": {}
}

admin.js

'use strict';

module.exports = function(Admin) {

Admin.afterRemote('create', function(context, user, next) {

        Admin.app.models.Role.upsertWithWhere({
            name: 'admin'
          },{name:'admin'}, function(err, role) {
            if (err) throw err;

            console.log('Created role:', role);

            role.principals.create({
              principalType: Admin.app.models.RoleMapping.ROLE,
              principalId: user.id
            }, function(err, principal) {
              if (err) throw err;

              console.log('Created principal:', principal);

            });
           });


           next();
    });


};

---

环回文档非常清楚ACL管理，从

Role.create({
名称：'管理员'
}，功能（错误，角色）{
如果（错误）cb（错误）；
role.principals.create({
principalType:RoleMapping.USER，
普林西比：
}，函数（错误，主体）{
cb（err）；
});
});环回文档非常清楚ACL管理，从


Role.create({
名称：'管理员'
}，功能（错误，角色）{
如果（错误）cb（错误）；
role.principals.create({
principalType:RoleMapping.USER，
普林西比：
}，函数（错误，主体）{
cb（err）；
});
});