accessibleBy does not throw an error as expected when using createPrismaAbility about casl

[stalniy]

Unfortunately it's not possible (at least I cant find a good way to do this). accessibleBy throws ForbiddenError only in case it cannot generate where. This means either there is no rules defined for that particular action/subject or rules defined in a way that it's possible to predict empty result set.

In order to narrow down, conditions I need to return back some where conditions and this should be something like WHERE 1 != 1, so we force underlying database engine to return empty result set (in this case SQL). But very likely prisma doesn't support this kind of query (at least it was true few versions ago).

In mongoose, there is a way to hook into query execution and return empty result or throw an error. If smth is possible in Prisma ecosystem (maybe with extensions), then potentially we can implement the same logic in Prisma

[stalniy]

In the past, casl-mongoose returned empty set in case user has no access to anything but later some people asked me to raise an exception instead.

The issue here is that in case of database query it's impossible to solve this issue, correct me if I'm wrong somewhere. Look at this scenarios:

Imagine we have a blog website where multiple authors can write articles and create drafts. Only draft author has access to own drafts.

Now we have these situations:

1. database is empty and we fetch all drafts for particular author -> empty result set
2. database has drafts of other authors but not the one who initiates request -> empty result set
3. database has drafts for currently logged in user -> non-empty result set.

When in this situation should we throw an error? In non of this cases. Only when this user initiates request to fetch drafts of other users (not own) but this may be forbidden technically (e.g., by using /my/drafts -> no way to fetch others drafts from API standpoint).

Potentially we could check that query somehow partially matched to allowed object will return allowed objects but even this doesn't give 100% guarantee whether user has access to smth or not. Because of queries like > & <, geolocation queries, LIKE, REGEXP, mongo allow to pass $where expressions to conditions, how should we validate that smth potentially may be disallowed in that case? This brings a lot of complexity to casl and very likely will never be solved. In my opinion there is nothing bad to show empty result set or 404 instead of 403. Moreover it's even better because you do not disclose data in your db to potential hackers.

Imagine there is a resource in db and when smb access it without proper access, you return 403 -> this tells smth to the hacker:

1. This (probably guessed) resource exists but it's protected by ACL
2. This website has ACL, need to find out which one and try to crack it

When you return 404 instead, the hacker don't have these 2 points from the top ^^^ and for him now impossible to know whether this resource even exist. This is how github works, in case you access private repo, you will get 404 not 403. And from encapsulation and information hiding standpoint, this is nice.

[stalniy]

I found a way to return an empty list from db instead of throwing exception -> https://www.prisma.io/docs/concepts/components/prisma-client/null-and-undefined#the-effect-of-null-and-undefined-on-conditionals

Basically if there is { OR: [] }, Prisma should return an empty result set.