title: Restrict feathers service method to user for external but allow any queries for internal calls
body: <p>I want to restrict calls to a Feathers service method for externals calls with associateCurrentUser.</p>
  
  <p>I also want to allow the server to call this service method without restricting it.</p>
  
  <p>The use case is that through this service then clients use a lock table, all clients can see all locks, and occasionally the server should clear out abandoned rows in this table. Row abandonment can happen on network failures etc. When the server removes data then the normal Feathers remove events should be emitted to the clients.</p>
  
  <p>I would imagine that this should be a mix of associateCurrentUser and disallow hooks but I can't even begin to experiment with this as I don't see how it would be put together.</p>
  
  <p>How would one implement this, please?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I found this answer <a href="https://stackoverflow.com/questions/47487195/users-permissions-in-feathers-js-api">User&#39;s permissions in feathers.js API</a> from Daff which implies that if the hook's context.params.provider is null then the call is internal, otherwise external. Can anyone confirm if this is really so in all cases, please?</p>
  
  <p>It seems to be so from my own tests but I don't know if there are any special cases out there that might come and bite me down the line.</p>