Nested document key example about casl-feathersjs-example HOT 1 CLOSED

Answered in gitter, so this may be closed. Thanks for using CASL!

Lets continue discussion in gitter :)

Answer:

Hi @adrianofoschi ,

casl don't manage references on related documents. You need to do it yourself.

So, I see few ways:

1. Retrieve ids of all vehicles when you define rules. This works good in case if amount of vehicles not big (<= 1000)

const vehicleIds = await getVehicleIds(user)

can(['read', 'update'], 'document', { vehicle: { $in: vehicleIds } })

2. Denormalize your scheme. For example, add additional user_id field to vehicle document
3. Think whether you can embed document as subdocument to vechicle, something like this:

vehicle {
  documents: [Document],
  users: [ {type: objectId, ref: 'user'} ]
}

4. Just don't define rule per documents and enforce them in routes (REST or GraphQL doesn't matter).

// app - express app

app.get('/vehicle/:id/documents', async (req, res) => {
   const vehicle = await Vehicle.findById(req.params.id)

   req.ability.throwUnlessCan('read', vehicle)
   const documents = Document.find({ vehicle: vehicle.id })

   res.send({ documents })
})

from casl-feathersjs-example.