mongoose `.orFail()` does not work when permissions are implicitly denied

I ran into this issue accidentally today, but the way my application is set up, it expends models not found to throw an error.

ex:

    var user = await User.findById(req.params.id)
      .accessibleBy(req.ability)
      .orFail();

    res.json({ user });

When the permission to view users is set, it works fine and dandy. The conditions for this query were { _id: '5d600d0ea21964033b4fc1bb', '$and': [ {} ] }.

But if the permission is implicitly denied, the conditions are { _id: '5d600d0ea21964033b4fc1bb', __forbiddenByCasl__: 1 }. The problem is though that the user variable is returning null, and not throwing an exception.

[stalniy]

fixed in @casl/mongoose@2.3.2.

Thanks for the issue!

[stalniy]

Thanks, I didn’t know about orFail method of mongoose Query 😃

I think this is a bug but I’ll need some time to confirm this.