Related objects from different collections/tables in can, cannot

[ghost]

My problem is I am trying to set the delete clause for messages, i.e. a message can be delete only when it has been created by the user.

The message/post classes look something like this

Message { id: int, text: string, createdBy: int, belongsToPost: int (belongsToPost foreign key to post) }

Post { id: int, createdBy: int, content: string, (createdBy foreign key to users) }

Now I want to add functionality that a message can be deleted only when it has been created by the user.

can('delete', 'Message', { belongsToPost : {createdBy: user.id}})

It doesn't work because belongsToPost is only the foreign key and it throws an error that the statement {createdBy: user.id} is not defined for this type.

I could solve the problem by adding the field createdBy to message as well, but is there a way to achieve this without repetitive data?

Thanks for your help!

[stalniy]

Hello

Thanks for the issue. I’ll check it on weekend. Don’t have enough free time during working week :)

[stalniy]

I'm not sure whether I correctly understand everything because as far as I see createdBy is present on both Message and Post. So, this case you can do:

can('delete', 'Message', { createdBy: user.id })

But if you want to define rules based on fields of related entities, than CASL can't help you. Here you need to help him. You need to prepopulate your Message object with related Post object, so the Post instance is available under message.belongsToPost. When you do this, you will be able to check permissions in memory (on application level).

If you want to query all messages from database which can be deleted by some user based on related object field, you will need to improve functionality of @casl/mongoose or if implement by your own functionality for SQL dbs (read my comment in #8). Currently there are no plans to implement this in CASL but strategically yes, I'd like this to be implemented.

[stalniy]

@AlexGoranov does it clarify your question?

[stalniy]

Close due to inactivity