CASL + drizzle + drizzle-zod: getting subject out of the inference

[orenmizr]

has anyone gotten the inferred types from drizzle orm or drizzle-zod inferred schema to supply the subject for the ability builder.
i figured this would work:

type Subjects = InferSubjects<typeof selectUserSchema> | InferSubjects<typeof selectBookmarkSchema> | 'all';

this did not yield the wanted result.

[ceopaludetto]

has anyone gotten the inferred types from drizzle orm or drizzle-zod inferred schema to supply the subject for the ability builder. i figured this would work:

type Subjects = InferSubjects<typeof selectUserSchema> | InferSubjects<typeof selectBookmarkSchema> | 'all';

this did not yield the wanted result.

Hey, kinda late but I'm struggling with this rn, so you probably can do something like this:

import type { InferModelFromColumns } from "drizzle-orm";
import type { SQLiteTableWithColumns } from "drizzle-orm/sqlite-core";
import * as schema from "~/path/to/your/database/schema"

type InferSubjectsFromDrizzle<Schema> = {
  [K in keyof Schema]: Schema[K] extends SQLiteTableWithColumns<infer Table>
    ? InferModelFromColumns<Table["columns"]> | Table["name"]
    : never
};

type InferSubjects<Schema> = InferSubjectsFromDrizzle<Schema>[keyof InferSubjectsFromDrizzle<Schema>] | "all";
type Subjects = InferSubjects<typeof schema>

Note that if you use postgres or mysql you should change to the equivalent type:

import type { PgTableWithColumns } from "drizzle-orm/pg-core"
import type { MySqlTableWithColumns } from "drizzle-orm/mysql-core"

You may also want to lower case the first letter of the table name(this vary based on your table names and it's just for folks that want to type "users" instead of "Users", not really required)

import type { InferModelFromColumns } from "drizzle-orm";
import type { SQLiteTableWithColumns } from "drizzle-orm/sqlite-core";

type LowercaseFirstLetter<S extends string> = S extends `${infer F}${infer R}` ? `${Lowercase<F>}${R}` : S;

type InferSubjectsFromDrizzle<Schema> = {
  [K in keyof Schema]: Schema[K] extends SQLiteTableWithColumns<infer Table>
    ? InferModelFromColumns<Table["columns"]> | LowercaseFirstLetter<Table["name"]>
    : never
};

type InferSubjects<Schema> = InferSubjectsFromDrizzle<Schema>[keyof InferSubjectsFromDrizzle<Schema>] | "all";

Warning

Keep in mind that this doesn't auto detect the subject type at runtime, it's just TYPE INFERENCE, also I think it's not possible to detect at runtime at all since drizzle produced objects doesn't have any kind of runtime information that can be extracted later on (so you should stick with the subject function(https://casl.js.org/v6/en/guide/subject-type-detection#subject-helper) right now)

This was tested with @casl/ability: ^6.7.1 and drizzle-orm: ^0.31.0

[stuartin]

Thanks for this! It helped me get full e2e type safety across drizzle and CASL 🚀

type User = {
    id: string;
    roles: {
        id: string;
        role: "admin" | ...
    }[];
}

type Todo = {
    id: string;
    content: string;
    admin: string;
}

import type { ForcedSubject, MatchConditions } from "@casl/ability";
import type { InferModelFromColumns } from "drizzle-orm";
import type { SQLiteTableWithColumns } from "drizzle-orm/sqlite-core";

import { AbilityBuilder, PureAbility } from "@casl/ability";

import type * as schema from "@/db/schema";
import type { User } from "@/types";

type InferSubjectsFromDrizzle<Schema> = {
    [K in keyof Schema]: Schema[K] extends SQLiteTableWithColumns<infer Table>
        ? (InferModelFromColumns<Table["columns"]> & ForcedSubject<Table["name"]>) | Table["name"]
        : never
};
type InferSubjects<Schema> = InferSubjectsFromDrizzle<Schema>[keyof InferSubjectsFromDrizzle<Schema>] | "all";

type Subject = InferSubjects<typeof schema>;
type Action = "create" | "read" | "update" | "delete" | "setStatus" | "setPermissions";
type AppAbility = PureAbility<[Action, Subject], MatchConditions>;

const lambdaMatcher = (matchConditions: MatchConditions) => matchConditions;
export function defineAbilityFor(user: User) {
    const { can, build } = new AbilityBuilder<AppAbility>(PureAbility);

    user.roles.forEach(({ role }) => {
        can("delete", "todos", ({ admin }) => user.id === admin || role === "role_admin");
    });

    return build({
        conditionsMatcher: lambdaMatcher,
    });
}

import { defineAbilityFor } from './'
import { subject } from "@casl/ability";

const todo: Todo = {
    id: "todo",
    content: "My todo",
    admin: "user_one",
}

const userOne: User = {
    id: "user_one",
    roles: [{
        id: "role_admin",
        role: "user"
    }]
}

const ability = defineAbilityFor(userOne);
ability.can("delete", subject("todos", todo));
// ^? true - user is admin on todo

const userTwo: User = {
    id: "user_two",
    roles: [{
        id: "role_user",
        role: "user"
    }]
}

const ability = defineAbilityFor(userTwo);
ability.can("delete", subject("todos", todo));
// ^? false - user not admin on todo and no admin role

[orenmizr]

an old question of mine. it is weird there isn't an open source tool that is simple and less verbose than casl at this point.
rbac/abac/acl are so important for matintability yet it seem 90% of production use IFs instead. most other packages are dead for years.

[stalniy]

How do you think verbosity can be decreased?

[orenmizr]

i don't claim to have the solution to a problem you've been working on for years. casl is very powerful and flexible. maybe there is a sweet spot between the nonsense self implemented role === admin that is the most popular solution to ability builders.

might go for something like this in the next project (also ability building): https://github.com/Barbapapazes/orion/blob/main/app/utils/templates/abilities.ts

[stalniy]

Let’s then rephrase it. What part of casl seems to be too verbose?

maybe I can find a way to make it simpler

[stuartin]

Having only discoverd CASL a few days ago, I find it an excellent approach to how I was doing things previously.
I heard about it from the comments in a youtube video by Web Dev Simplified¹, he had a slightly different approach but I believe you could still adapt to use CASL.

You may find it helpful: https://github.com/WebDevSimplified/permission-system/blob/main/auth-abac.ts

Footnotes

1. https://youtu.be/5GG-VUvruzE?t=1463 ↩