CASL + MikroORM (Collections)

[Arcus16]

Hello, I am attempting to create more complex rules for my application and have encountered a problem related to MikroOrm Collections.

Let's say I have the following code:

import { Ability, AbilityBuilder, subject } from "@casl/ability";

const { can, build } = new AbilityBuilder(Ability);

can("create", "Meeting", {
  users: { $elemMatch: { id: { $in: [1, 10, 11] } } },
});

const ability = build();

console.log(ability.can("create", subject("Meeting", { users: [{ id: 10 }] }))); // true
console.log(ability.can("create", subject("Meeting", { users: [{ id: 9 }] }))); // false

The code above will function as expected. However, if we use a Meeting entity instead of "Meeting", the users will change from an Array to a Collection, causing the code above to no longer work.

My question is how to fix this? I know I could serialize an entity before passing it to casl for validation, but that could have some performance implications.

[stalniy]

Hello

Doesn’t Collection have the same interface as an Array or maybe even extends it?

[stalniy]

Ok, the issue is in this check -
https://github.com/stalniy/ucast/blob/c37d3052a151f1efc1d024be58fa300cc86d166d/packages/js/src/interpreters.ts#L111

[stalniy]

Probably I need a custom check for isArray interface. Which will existence of length property + method which is needed for the check

[Arcus16]

A Collection should have the same properties and functions as an Array, with additional functionality tailored for MikroORM's ORM capabilities.

Yes, the Array.isArray(value) will return false if the value is an instance of a Collection. One way to get an Array from a Collection is to use the .getItems() function, so Array.isArray(value.getItems()) returns true. But using a custom implementation of Array.isArray is a better approach for this.

[stalniy]

Looks like there is a different solution if you can efficiently extract underlying array.

You can create custom conditions matcher which will be completely the same as built in one but with custom compare function which for collections will extract underlying array.

You can take a look how it’s done for dates and objects that have toJSON method
https://github.com/stalniy/ucast/blob/c37d3052a151f1efc1d024be58fa300cc86d166d/packages/mongo2js/src/factory.ts#L26

Alternatively, if you do Collection.prototype.toJSON = function(){ return this.getItems()}, it will work with built in conditions matcher

[Arcus16]

Hi, sorry for the delay.
The Collection already has the toJSON method, which is used for serialization. By default, it serializes all entities in the Collection by recursively calling toJSON on each entity and its relations. I think this is not a good solution since it could lead to performance problems on collections with many entities.
I think the solution with a custom conditions matcher is better, but anyone with the same problem as me would need to implement the matcher in their project. Also, It adds code that will need updating in the future when upgrading to a new library version, requiring me to write tests for it.
So if we can make it work by using a custom implementation of Array.isArray(value), I think that is the best solution.

[haayman-imagem]

I'm running into the same problem. Did you manage to create a custom conditions matcher? I've been searching all morning how to override the default interpreter.get method so it handles Collections correctly, but I'm drowning in the typescript definitions and don't know how to set it up.

[Arcus16]

Hi, I didn't attempt to implement a custom conditions matcher because a feature for which I need it was postponed.

[haayman-imagem]

I found a solution that makes use of the toJSON() of MikroORM in combination with the subject() helper function from @casl/ability.
I believe this helper function is only meant for use on the frontend, but it serves me well.

So, in my BaseEntity I add a method toSubject()

import { wrap, PrimaryKey, Property, SerializedPrimaryKey, Entity } from "@mikro-orm/core";
import { subject } from "@casl/ability";
import { ObjectId } from "@mikro-orm/mongodb";

@Entity({ abstract: true })
export abstract class BaseEntity {
  @PrimaryKey()
  _id!: ObjectId;

  @SerializedPrimaryKey()
  id!: string;

  // convert to JSON and add__caslSubjectType__ 
  // this is used in AbilityFactory to determine the subject
  toSubject(): object {
    // @ts-ignore - subject wants to use a string as identifier, but on the server we use the class constructor
    return subject(this.constructor, wrap(this.toJSON());
  }
}

my createForUser uses this

export async function createForUser(user: User): Promise<AnyAbility> {
  const builder = new AbilityBuilder<MongoAbility>(createMongoAbility);
  for (const factory of factories) {
    await factory.createRules(builder, user);
  }
  const ability = builder.build({
    detectSubjectType: (object) => {
      // either use the __caslSubjectType__ or the original constructor
      return object.__caslSubjectType__ || (object.constructor as ExtractSubjectType<MongoAbility>);
    },
  });
  return ability;
}

Now I can create an endpoint like so

  @Get(":id")
  async get(
    @Param("id") id: string,
    @Query("action") action: string,
    @CurrentUser() currentUser: User,
  ) {
    action = action || Action.Read;

    const user = await this.usersService.findOne({ id }, { populate: ["roles"] });
    if (!user) {
      throw new NotFoundException("Gebruiker niet gevonden");
    }
    const ability = await createForUser(currentUser);

    throwUnlessCan(ability, action, user.toSubject());
    return permittedFields(ability, action, user.toSubject());
  }

[antonioprudenzano]

Hi everybody,

i had the same problem, didn't find any solution so i created a custom operator for MikroOrm Collections.

import {
  JsInterpreter,
  ITSELF,
  FieldCondition,
  FieldInstruction,
  ObjectQueryFieldParsingContext,
  Condition,
} from '@ucast/mongo2js';
import { Collection } from '@mikro-orm/core';
import { MongoQuery } from '@casl/ability';

export const $collectionMatch: FieldInstruction<
  MongoQuery<any>,
  ObjectQueryFieldParsingContext
> = {
  type: 'field',
  validate(instruction, value) {
    if (!value || value.constructor !== Object) {
      throw new Error(
        `"${instruction.name}" expects to receive an object with nested query or field level operators`,
      );
    }
  },
  parse(instruction, value, { parse, field, hasOperators }) {
    const condition = hasOperators(value)
      ? parse(value, { field: ITSELF })
      : parse(value);
    return new FieldCondition(instruction.name, field, condition);
  },
};
export const collectionMatch: JsInterpreter<FieldCondition<Condition>> = (
  node,
  object,
  { interpret, get },
) => {
  let value = get(object, node.field);
  if (value instanceof Collection) {
    value = value.getItems();
  }
  return (
    Array.isArray(value) && value.some((v: any) => interpret(node.value, v))
  );
};

When defining the Ability you need to create a custom matcher like this:

const conditionsMatcher = buildMongoQueryMatcher(
  { $collectionMatch },
  { collectionMatch },
);

and pass it to the build method:

return build({
  conditionsMatcher,
  detectSubjectType: (item) =>
    item.constructor as ExtractSubjectType<Subjects>,
});

I am still figuring out how to have typescript to recognize the operator, my editor gives this error(i need to add my new operator to the ones recognized by the MongoQuery type):