Casl: How do field restrictions work in rule definition?

[Vbboi24]

ability = [
  {
    "actions": ["create", "read", "update", "delete"],
    "subject": "Post",
     "fields" : ['title'],
    "conditions": {
      "author": "${user.id}"
    }
  },
  {
    "actions": ["read", "update"],
    "subject": "User",
"fields" : ['UserName','phoneNo'],
    "conditions": {
      "id": "${user.id}"
    }
  }
]

What would be expected behavior from the above Rules for an ability ? Does it restrict a user from updating the field 'title' in Task or does it allow only that field to be edited ?

I am trying to find a working example for ability.define(). Yes, there is one available for ability.can(). Can i have more information on this please ?

[stalniy]

fields are just additional flags which you can use to enforce permissions. So, in your case:

ability.can('read', 'Post') // true
ability.can('read', 'Post', 'title') // true
ability.can('read', 'Post', 'description') // false

class Post {
  constructor(props) {
    Object.assign(this, props)
  }
}

ability.can('read', new Post({ userId: 1, title: 'test', description: 'test' })) // true
ability.can('read', new Post({ userId: 1, title: 'test', description: 'test' }), 'description') // false

Also you can use some useful helpers methods for @casl/ability/extra subpackage. You can find info about it here - https://github.com/stalniy/casl/tree/master/packages/casl-ability#4-extra

[Vbboi24]

Wow thanks, Will i be able to enforce permission using the define function. Rather than the can function.
More like Ability.define(rules). I could not have it working when i load it from the backend api.

[Vbboi24]

If i may ask here, Can i have multiple conditions created ? I tried doing the following. ability = [ { "actions": ["create", "read", "update", "delete"], "subject": "Post", "fields" : ['title'], "conditions": { "author": "${user.id}", "moderator" : "${user.id}" } } ]

The above rule definition seems to break and neither of the conditions apply. But when used independently. ie. ability = [ { "actions": ["create", "read", "update", "delete"], "subject": "Post", "fields" : ['title'], "conditions": { "author": "${user.id}", } } ] or ability = [ { "actions": ["create", "read", "update", "delete"], "subject": "Post", "fields" : ['title'], "conditions": { "moderator" : "${user.id}" } } ]

[stalniy]

Wow thanks, Will i be able to enforce permission using the define function. Rather than the can function.
More like Ability.define(rules). I could not have it working when i load it from the backend api.

No, define function is for DSL syntax. You can pass rules directly to Ability constructor new Ability(rulesFromBackend). You can find working examples in my github repos for angular, Vue , react. There are also examples of full stack apps for Vue + express.js and Vue + RoR cancancan

[stalniy]

All properties in conditions are logically AND-ed and rules with the same pair of action and object are logically OR-ed

That’s why the 1st definitions doesn’t work

[Vbboi24]

This worked!! When i created it this way ability = [ { "actions": ["update"], "subject": "Post", "fields" : ['title'], "conditions": { "author": "${user.id}"} }, { "actions": ["update"], "subject": "Post", "fields" : ['title'], "conditions": { "moderator": "${user.id}"} } ]

This way, i was able to set multiple conditions for an ability. I am not sure if this is the best way to do it.

[Vbboi24]

Wow thanks, Will i be able to enforce permission using the define function. Rather than the can function.
More like Ability.define(rules). I could not have it working when i load it from the backend api.

No, define function is for DSL syntax. You can pass rules directly to Ability constructor new Ability(rulesFromBackend). You can find working examples in my github repos for angular, Vue , react. There are also examples of full stack apps for Vue + express.js and Vue + RoR cancancan

Yes, I have. Thanks for this beautiful library. I am pretty sure this is way better than the traditional ones where i do manual handling on the conditions.