casl Infer subject types from @nestjs/mongoose models

Fr, 04.02.2022 20:21 Describe the bug If you cast ability.can(Action, object) with a mongoose model it returns false but it should return true. the error is that it dosnt infer the subject correctly.

I referring to this part of the docs: https://casl.js.org/v5/en/guide/subject-type-detection#how-does-casl-detect-subject-type

Its says it takes it from object.constructor.modelName if its defined

with the defineSubjectType function it should work with classes like described here: https://casl.js.org/v5/en/guide/subject-type-detection#use-classes-as-subject-types

and with typescript you have to pass second argument as true on InferSubjects https://casl.js.org/v5/en/advanced/typescript#infer-subject-types-from-interfaces-and-classes

To Reproduce Steps to reproduce the behavior: I made a github repo: https://github.com/Wenish/nestjs-mongoose-casl

1. clone the repo
2. run command npm ci
3. run command npm test

you will see the test ‘user should be able to read specific offer’ fails: https://github.com/Wenish/nestjs-mongoose-casl/blob/main/src/casl/casl-ability.factory.spec.ts#L51

Expected behavior I would expect that this return true: https://github.com/Wenish/nestjs-mongoose-casl/blob/main/src/casl/casl-ability.factory.spec.ts#L62

Interactive example (optional, but highly desirable) https://github.com/Wenish/nestjs-mongoose-casl

CASL Version

@casl/ability - v5.4.3

Environment: node - v16.13.0 TypeScript - 4.3.5

[Justinio99]

I have exactly the same problem using nestjs…

[Wenish]

@mathibla @Justinio99 hey guys this is the solution i came up with.

@stalniy and thanks very much with pointing that out that i should use the mongoose model as ref

the key with nestjs is to inject the model in the factory and use the injected model

no idea if there is away to simplify the definitions since atm wrote them 2 times.

import { InferSubjects, Ability, AbilityBuilder, AbilityClass, ExtractSubjectType } from "@casl/ability";
import { Injectable } from "@nestjs/common";
import { InjectModel } from "@nestjs/mongoose";
import { Model } from "mongoose";
import { Offer, OfferDocument, OfferStatus } from "../database/schemas/offer.schema";

export enum Action {
    Manage = 'manage',
    Create = 'create',
    Read = 'read',
    Update = 'update',
    Delete = 'delete',
}

@Injectable()
export class CaslAbilityFactory {
    constructor(
        @InjectModel(Offer.name)
        private offerModel: Model<OfferDocument>,
    ) { }
    
    createForUser(user: any) {
        const { can, cannot, build } = new AbilityBuilder(Ability as AbilityClass<Ability<[Action, InferSubjects<typeof this.offerModel> | 'all']>>);

        can(Action.Read, this.offerModel, {
            publishDate: { $lte: new Date() },
            status: { $in: [OfferStatus.Approved] },
        });

        can(Action.Create, this.offerModel);

        if (user) {
            if (user?.uid) {
                can(Action.Manage, this.offerModel, { creator: user.uid });
            }

            const userRoles: Role[] = user?.roles || [];

            if (userRoles.includes(Role.CONTENT_MANAGER)) {
                can(Action.Manage, this.offerModel);
            }

            if (userRoles.includes(Role.SYSTEM_ADMIN)) {
                can(Action.Manage, 'all');
            }
        }

        return build({
            // Read https://casl.js.org/v5/en/guide/subject-type-detection#use-classes-as-subject-types for details
            detectSubjectType: object => {
                return object.constructor as ExtractSubjectType<InferSubjects<typeof this.offerModel> | 'all'>
            }
        });
    }
}

export enum Role {
    CONTENT_MANAGER = 'ContentManager',
    SYSTEM_ADMIN = 'SystemAdmin',
}

also that how the controller looks where i use the factory

import { Controller, Delete, Get, NotFoundException, Param, Patch, Post, UnauthorizedException } from '@nestjs/common';
import { ApiResponse } from '@nestjs/swagger';
import { Action, CaslAbilityFactory } from '../casl/casl-ability.factory';
import { OffersService } from './offers.service';
import { Offer, OfferDocument } from '../database/schemas/offer.schema';
import { Model } from 'mongoose';
import { InjectModel } from '@nestjs/mongoose';

@Controller('offers')
export class OffersController {
    constructor(
        @InjectModel(Offer.name)
        private offerModel: Model<OfferDocument>,
        private readonly offersService: OffersService,
        private readonly caslAbilityFactory: CaslAbilityFactory
    ) { }

    @Post()
    @ApiResponse({ type: Offer })
    create() {
        const user = {}
        const ability = this.caslAbilityFactory.createForUser(user);
        const canCreateOffers = ability.can(Action.Create, this.offerModel);
        console.log(this.timeString(),'can create offer', canCreateOffers)

        if (!canCreateOffers) throw new UnauthorizedException();

        return this.offersService.create();
    }

    @Get()
    @ApiResponse({ type: Offer, isArray: true })
    async readAll() {
        const user = {
            // roles: ['SystemAdmin']
        }
        const ability = this.caslAbilityFactory.createForUser(user);
        const canReadOffers = ability.can(Action.Read, this.offerModel);
        console.log(this.timeString(), 'can read offers', canReadOffers)

        if (!canReadOffers) throw new UnauthorizedException();

        return (await this.offersService.findAll()).filter((offer) => {
            const canReadOffer = ability.can(Action.Read, offer)
            console.log(offer.id)
            console.log(this.timeString(),'can read offer', canReadOffer)
            return canReadOffer
        });
    }

    @Get(':id')
    @ApiResponse({ type: Offer })
    async read(@Param('id') id: string) {
        const user = {}
        const ability = this.caslAbilityFactory.createForUser(user);
        const offer = await this.offersService.findOne(id)
        const canReadOffer = ability.can(Action.Read, offer)
        console.log(this.timeString(),'can read offer', canReadOffer)

        if (!canReadOffer) throw new UnauthorizedException();
        if (!offer) throw new NotFoundException();

        return offer;
    }

    @Patch(':id')
    @ApiResponse({ type: Offer })
    async update(@Param('id') id: string) {
        const user = {}
        const ability = this.caslAbilityFactory.createForUser(user);
        const offer = await this.offersService.findOne(id)
        const canUpdateOffer = ability.can(Action.Update, offer)
        console.log(this.timeString(),'can update offer', canUpdateOffer)

        if (!canUpdateOffer) throw new UnauthorizedException();
        if (!offer) throw new NotFoundException();
        
        return this.offersService.update(id)
    }

    @Delete(':id')
    @ApiResponse({ type: Offer })
    async delete(@Param('id') id: string) {
        const user = {}
        const ability = this.caslAbilityFactory.createForUser(user);
        const offer = await this.offersService.findOne(id)
        const canDeleteOffer = ability.can(Action.Delete, offer)
        console.log(this.timeString(),'can delete offer', canDeleteOffer)

        if (!canDeleteOffer) throw new UnauthorizedException();
        if (!offer) throw new NotFoundException();

        return this.offersService.delete(id);
    }

    private timeString() {
        const date = new Date()
        return `[${date.getHours()}:${date.getMinutes()}:${date.getSeconds()}]`
    }
}

the schema is in a seperate database module else offers module and the casl module would have circular dependencies