feat(mongoose): wraps resulting query into additional $and

This prevents collisions when later query is merged with another query which has `$or` condition

Fixes #140

packages/casl-mongoose/package.json

@@ -15,7 +15,7 @@
   "homepage": "https://stalniy.github.io/casl/",
   "scripts": {
     "build.es": "rollup -c ../../tools/rollup.es.js -e @casl/ability/extra",
-    "build.cjs": "rollup -c ../../tools/rollup.umd.js -e @casl/ability/extra -f cjs -o index.js",
+    "build.cjs": "SKIP_MINIFY=1 rollup -c ../../tools/rollup.umd.js -e @casl/ability/extra -f cjs -o index.js",
     "build": "npm run build.es && npm run build.cjs",
     "lint": "eslint src/",
     "test": "NODE_ENV=test jest --config ../../tools/jest.config.js",

packages/casl-mongoose/spec/accessible_records.spec.js

@@ -58,12 +58,12 @@ describe('Accessible Records Plugin', () => {
       expect(Post.where).to.be.called()
     })
 
-    it('passes query created by `toMongoQuery` in `where` method of the query', () => {
+    it('wraps `toMongoQuery` result with additional `$and` to prevent collisions when combined with `$or` query', () => {
       const query = toMongoQuery(ability, 'Post')
       spy.on(Post, 'where')
       Post.accessibleBy(ability)
 
-      expect(Post.where).to.be.called.with.exactly(query)
+      expect(Post.where).to.be.called.with.exactly({ $and: [query] })
     })
 
     it('does not change query return type', () => {

packages/casl-mongoose/src/accessible_records.js

@@ -35,7 +35,7 @@ function emptyQuery(query) {
 function accessibleBy(ability, action) {
   const query = toMongoQuery(ability, this.modelName || this.model.modelName, action);
 
-  return query === null ? emptyQuery(this.where()) : this.where(query);
+  return query === null ? emptyQuery(this.where()) : this.where({ $and: [query] });
 }
 
 export function accessibleRecordsPlugin(schema) {