Files
What you'll learn
- Say when a role is not enough: permissions that depend on the record being touched
- Build an ability with CASL's AbilityBuilder: can and cannot, a subject class, conditions on its fields, and why a later cannot beats an earlier can
- Check an ability against a subject type in a guard and against an instance in the service, and know what each answer means
- Attach policies to routes with metadata and a guard that runs them all
Press Run tests to start the app. Its log appears here.Graded endpoints
A user, not an admin
His ability will be manage all
Her ability: read all, update her own cats
The token payload the guards read: id, name, roles
The policy asks whether she may create cats at all; no rule says so, so the guard returns false and Nest answers 403
manage on all covers create on Cat
A second cat, which nobody will adopt
Reading stays public
Any member of staff may; the cat now carries her id
The guard passed her (some cats are hers to update); the service checked this cat, whose ownerId matches
Any member of staff, as in lesson 2; no policy involved
Decrypted for staff
Past the guard, refused by the service: the condition ownerId is not hers
manage all, no condition
No rule lets a user delete any cat, so the guard stops her before the service
The guard passed him (he may delete cats); the service asked about this cat, and the cannot rule on adopted cats beats manage all
Not adopted, so the cannot rule does not match
Tom Jr, adopted by ada, is still on the record