Inverted-only rules

[liukaren]

Is the case of inverted-only rules in the casl-mongoose library supported?

For example, if I add this test case to the mongo-query spec:

it('ignores inverted-only rules', () => {
  const ability = AbilityBuilder.define((can, cannot) => {
    cannot('read', 'Post', { private: true })
  })
  const query = toMongoQuery(ability, 'Post')

  expect(query).to.equal(null)
})

It fails with: AssertionError: expected { '$and': [ { '$nor': [Object] } ] } to equal null, so it will query for all non-private Posts, instead of no Posts.

Perhaps it is silly to only have a negative rule, but I noticed this when I wanted to copy-paste a negative rule across the board, and it granted permissions to some abilities that had no permissions in the first place.

[stalniy]

This is a bug. Thanks for the issue!

So, I think the proposed fix is to check if there are only inverted rules then return null

[liukaren]

Yes, sounds good to me! 👍

[stalniy]

Fixed in @casl/[email protected]

[liukaren]

So fast! Thank you