Casl: Add examples of how to use @casl/mongoose with mapReduce and aggregation pipeline

[stalniy]

[Faibk]

Are there any news on this? Or do you know a resource/blog post where this has been discussed already? If not, how would you approach such a thing, is there metadata casl attaches to the query (like the user's name/id), which we could use to check ownership?

We are looking for a way to use casl in our aggregations with mongoose and are happy to collaborate and share our findings here.

[stalniy]

casl adds conditions to mongoose query. So, when you do:

// Post is mongoose Model
const query = Post.accessibleBy(ability)

You can get query conditions by doing this:

console.log(query.getQuery()) // <--- a mongoose query object with all conditions for a specific model

Later you can pass this object to mapReduce or aggregate functions

[stalniy]

just don't have time to document this :)

[hennessyevan]

Hey I'm trying to fit accessibleBy onto a mongoose aggregation I have. No matter where I put the mongoose query accessibleBy it doesn't seem to want to do it. The integration is working great for regular Post.accessibleBy(ability).find() type queries

What I'm trying

const query = Post.accessibleBy(ability)
// also tried
const query = Post.accessibleBy(ability).getQuery()

// I'm not sure where to put "query" I've tried putting it everywhere it seems.

Post.aggregate()
.match({ // match object })
.limit() // Of course I have logic in these fields but I cut it out for simplicity
.lookup()
.unwind()

[DoctorFishy]

Here is how it works:

const query = Post.accessibleBy(ability).getQuery();

Post.aggregate([
  $match: {
    $and: [
      query,
      // your other aggregate conditions
    ]
  },
  // more pipelines here
])
  .next(result => {
    // do stuff
  })
  .catch(err => {
    // handle error
  });

[stalniy]

will be available with 4.0 release of casl