How do field restrictions work in rule definition?

ability = [
  {
    "actions": ["create", "read", "update", "delete"],
    "subject": "Post",
     "fields" : ['title'],
    "conditions": {
      "author": "${user.id}"
    }
  },
  {
    "actions": ["read", "update"],
    "subject": "User",
"fields" : ['UserName','phoneNo'],
    "conditions": {
      "id": "${user.id}"
    }
  }
]

What would be expected behavior from the above Rules for an ability ? Does it restrict a user from updating the field ‘title’ in Task or does it allow only that field to be edited ?

I am trying to find a working example for ability.define(). Yes, there is one available for ability.can(). Can i have more information on this please ?

[stalniy]

All properties in conditions are logically AND-ed and rules with the same pair of action and object are logically OR-ed

That’s why the 1st definitions doesn’t work

[stalniy]

fields are just additional flags which you can use to enforce permissions. So, in your case:

ability.can('read', 'Post') // true
ability.can('read', 'Post', 'title') // true
ability.can('read', 'Post', 'description') // false

class Post {
  constructor(props) {
    Object.assign(this, props)
  }
}

ability.can('read', new Post({ userId: 1, title: 'test', description: 'test' })) // true
ability.can('read', new Post({ userId: 1, title: 'test', description: 'test' }), 'description') // false

Also you can use some useful helpers methods for @casl/ability/extra subpackage. You can find info about it here - https://github.com/stalniy/casl/tree/master/packages/casl-ability#4-extra