Using CASL Prisma with persisted permissions

[jbeckton]

Working from the following example...

type AppAbility = PureAbility<[string, Subjects<{
  User: User,
  Post: Post
}>], PrismaQuery>;
const { can, cannot, build } = new AbilityBuilder<AppAbility>(createPrismaAbility);

can('read', 'Post', { authorId: 1 });
cannot('read', 'Post', { title: { startsWith: '[WIP]:' } });

const ability = build();

ability.can('read', 'Post');
ability.can('read', subject('Post', { title: '...', authorId: 1 })));

Given that my rules are coming in from the user session I cannot hard code them. If I try to use forEach loop them I must know the model type for each.

export const createPrismaClientAbilities = (rules: RawRuleOf<AppAbility>[]): PrismaAppAbility => {
  const { can, cannot, build } = new AbilityBuilder<PrismaAppAbility>(createPrismaAbility);

  rules.forEach((rule) => {
    const { action, subject, conditions} = rule;
    can(action, subject, conditions); // <-- this does not work
  });

  return build();
};

The Docs only cover a single use case when providing an example and that use case won't work for me. Is there another example somewhere?

Another issue I am having is that I need to use CASL in my router guards and with Prisma but I am finding it difficult to share any code between the two use cases. I have to maintain two sets of subjects and I cannot figure out how to generate the Prisma rules from the same rules I used for the router guards.

export const actions = ['manage', 'create', 'read', 'update', 'delete'] as const;
export const subjects = ['User', 'UserProfile', 'UserRole', 'Role', 'Permission', 'all'] as const;
export type Abilities = [(typeof actions)[number], (typeof subjects)[number] | ForcedSubject<Exclude<(typeof subjects)[number], 'all'>>];
export type AppAbility = MongoAbility<Abilities>;
export const createGuardAbilities = (rules: RawRuleOf<AppAbility>[]): AppAbility => {
  return createMongoAbility<AppAbility>(rules);
};

export type PrismaSubjects =
  | 'all'
  | Subjects<{
      User: User;
      UserProfile: UserProfile;
      UserRole: UserRole;
      Role: Role;
      Permission: Permission;
    }>;

export type PrismaAppAbility = PureAbility<[string, PrismaSubjects], PrismaQuery>;

export const createPrismaClientAbilities = (rules: RawRuleOf<AppAbility>[]): PrismaAppAbility => {
  const { can, cannot, build } = new AbilityBuilder<PrismaAppAbility>(createPrismaAbility);

  rules.forEach((rule) => {
    const { action, subject, conditions} = rule;
    can(action, subject, conditions);
  });

  return build();
};

[stalniy]

First of all, if you have rules in array no need to use AbilityBuilder. Just pass them to createPrismaAbility function

also check example app https://github.com/stalniy/casl-examples/tree/master/packages/fastify-prisma-blog

you should have one set of subjects. Subject type is your app entity type. So if you have a blog app, your models or entities are: BlogPost, User, Comment, etc

[jbeckton]

Ok, I think I'm starting to come around. It appears that I don't even need the createMongoAbility. I'm not using mongo query for anything because I have prisma, and I don't use fields or conditions in my route guards. I'm thinking my createPrismaClientAbilities result will cover both use cases.

[stalniy]

Yes, if you work with Prisma you don’t need mongo related stuff. That is the default implementation for permission check. But it may be substituted with any implementation.

In Prisma case, I wrote Prisma query interpreter, so devs can use well known Prisma queries everywhere in app

[jbeckton]

Thanks, your fastify example really helped.

one last question. When I use createPrismaAbility, the result from that provides an object with a .can() method which I think I can use in my route guards. But I noticed that the input for that .can() method does not allow for conditions. Maybe I have my generic type set up wrong or something? I don't know if I plan to check for conditions anyways in the route guards but in some cases, it makes sense to avoid the database hit that occurs with prisma in order to determine if the user is allowed to do something. In my guard I have access to the request args so I can tell that the request wants to perform a specific operation on a specific model.

export type PrismaSubjects =
  | 'all'
  | Subjects<{
      User: User;
      UserProfile: UserProfile;
      UserRole: UserRole;
      Role: Role;
      Permission: Permission;
    }>;

export type PrismaAppAbility = PureAbility<[(typeof actions)[number], PrismaSubjects], PrismaQuery>;

const userPermissions: RawRuleOf<PrismaAppAbility>[] = [
  // Example non-admin permission, restricts read to rows where profileId = 2.
  { action: 'read', subject: 'User', conditions: { profileId: { equals: 2 } } },
  // Example admin permission, no conditions
  { action: 'read', subject: 'User' },
  { action: 'read', subject: 'UserProfile', conditions: { email: { contains: '@gmail.com' } } },
  { action: 'read', subject: 'UserProfile', conditions: { email: { contains: '@fastmail.com' } } },
  { action: 'read', subject: 'Role', conditions: { name: { endsWith: 'nuts' } } },
];

export const createPrismaClientAbilities = (rules: RawRuleOf<PrismaAppAbility>[]): PrismaAppAbility => {
  return createPrismaAbility(rules);
};

const prismaClientAbilities = createPrismaClientAbilities(userPermissions);

// This produces the Prisma WhereInput to go with the query.
const enhancedWhereInput = accessibleBy(prismaClientAbilities).UserProfile;
// This will be the auth check for the route guard.
const canResult = prismaClientAbilities.can('read', 'UserProfile'); // <-- cannot pass conditions here.

console.log('enhancedWhereInput %o', enhancedWhereInput);
console.log('canResult %o', canResult);

see prismaClientAbilities.can('read', 'UserProfile'); code hint below...

Thanks!

[jbeckton]

@stalniy Disregard my last question, I figured it out. It's working great now. Thank you for all your effort in providing this library.