Can not working like it should about casl

[stalniy]

Hey

thanks for the issue. Please show how you check permissions without all that Nest.js hassle.

There are 2 methods in casl:

1. To define permissions
2. To check it

you showed how you define permissions, now I need to see how you check it. In pure casl, there should be just few lines of code.

After all, this is casl repo) and at first we need to check that casl without Nest works as expected

[Dsantosjaime]

Yes sry, here it is:

@Injectable()
export class UserGuard implements CanActivate {
    constructor(
        private reflector: Reflector,
        private caslAbilityFactory: CaslAbilityFactory,
    ) { }

    async canActivate(context: ExecutionContext): Promise<boolean> {
        const policyHandlers =
            this.reflector.get<PolicyHandler[]>(
                CHECK_POLICIES_KEY,
                context.getHandler(),
            ) || [];

        const { user } = context.switchToHttp().getRequest();
        const ability = this.caslAbilityFactory.defineAbilityFor(user); <<<<

        return policyHandlers.every((handler) =>
            this.execPolicyHandler(handler, ability),
        );
    }

    private execPolicyHandler(handler: PolicyHandler, ability) {
        if (typeof handler === 'function') {
            return handler(ability);
        }
        return handler.handle(ability);
    }
}

As you can see I'm calling ''defineAbilityFor" and using "build()" to get ability, then ability is send to "UserPolicyHandler"

export class UserPolicyHandler implements IPolicyHandler {
    private action: Action;

    constructor(action: Action) {
        this.action = action;
    }

    handle(ability) {
        log(ability.can(this.action, 'User'))
        return ability.can(this.action, 'User');
    }
}

I'm logging the ability.can Right here.

[stalniy]

I see. Please read this section -> https://casl.js.org/v6/en/guide/intro#checking-logic

[Dsantosjaime]

Thank you, I'm checking it to understand what I missed.
I'm coming back to tell you if it solve my problem.

Ok in order to test, I changed my code like this:

export class UserPolicyHandler implements IPolicyHandler {
    private action: Action;

    constructor(action: Action) {
        this.action = action;
    }

    handle(ability, model) {
        return ability.can(this.action, model);
    }
}

and

@Injectable()
export class UserGuard implements CanActivate {
    constructor(
        private reflector: Reflector,
        private caslAbilityFactory: CaslAbilityFactory,
    ) { }

    async canActivate(context: ExecutionContext): Promise<boolean> {
        const policyHandlers =
            this.reflector.get<PolicyHandler[]>(
                CHECK_POLICIES_KEY,
                context.getHandler(),
            ) || [];

        const { user } = context.switchToHttp().getRequest();
        const ability = this.caslAbilityFactory.defineAbilityFor(user);

        return policyHandlers.every((handler) =>
            this.execPolicyHandler(handler, ability, user),
        );
    }

    private execPolicyHandler(handler: PolicyHandler, ability, user) {
        if (typeof handler === 'function') {
            return handler(ability, user);
        }
        return handler.handle(ability, user);
    }
}

But I'm getting "False", but I'm checking my user with itself. Is it normal ?