Rules with empty field array

The following might be a far-fetched use case (I tried it as a workaround when implementing it into our current project), but I’d be really interested in some feedback.

I define rules which permit the admin to access a/some fields in the article subject. For the normal user role I defined an empty array, which should mean: “Do not allow to access any fields” (I realize, that it would be more appropriate to simply give no permissions at all, but it was needed as workaround in our environment).

function defineAbilities(role: 'user' | 'admin') {
  const { can, rules } = new AbilityBuilder<Ability>();
  can('get', 'article', []);
  if (role === 'admin') {
    can('get', 'article', ['secret']);
  }
  return new Ability(rules);
}

When I check the permitted fields for the user type, I get an empty array as expected:

const abilities = defineAbilities('user');
permittedFieldsOf(abilities, 'get', 'article'); // []

… but when I check my ability to get the secret field, this returns true:

abilities.can('get', 'article', 'secret'); // true

I’d appreciate any feedback!

Complete test case:

import { Ability, AbilityBuilder } from '@casl/ability';
import { permittedFieldsOf } from '@casl/ability/extra';

describe('abilities', () => {
  function defineAbilities(role: 'user' | 'admin') {
    const { can, rules } = new AbilityBuilder<Ability>();
    can('get', 'article', []);
    if (role === 'admin') {
      can('get', 'article', ['secret']);
    }
    return new Ability(rules);
  }

  describe('as admin', () => {
    const abilities = defineAbilities('admin');
    it('has permitted field secret', () => {
      expect(permittedFieldsOf(abilities, 'get', 'article')).toEqual(['secret']);
    });
    it('can get article secret', () => {
      expect(abilities.can('get', 'article', 'secret')).toBeTrue();
    });
  });

  describe('as user', () => {
    const abilities = defineAbilities('user');
    it('has not permitted fields', () => {
      expect(permittedFieldsOf(abilities, 'get', 'article')).toEqual([]);
    });
    it('cannot get article secret', () => {
      expect(abilities.can('get', 'article', 'secret')).toBeFalse(); // <-- fails
    });
  });
});

[cyrus-za]

I know the issue is a few months old, but I believe it’s worth pointing out that, the result here is helping me a lot. It might seem strange to pass in an empty array as it seems nonsensical, but with a data-driven solution, one requires an ‘all’ value and defaulting to an empty array to allow all fields is great.

[stalniy]

will change to error in the next major version