Closed harukaze-sm closed 2 years ago
Update:
Found that after removing checkIdInQuery function inside _get method helped my resolve my issue, works as excepted
Just for documentation. It is the same wrong behavior in _remove and _update method if we use feathers-casl.
Issues were fixed this in v0.5.7
Steps to reproduce
export const defineRulesFor = (user: User) => { const { can, rules } = new AbilityBuilder(Ability);
can('read', 'users', { id: user.id }); # note that { id: user.id } causes this issue can('update', 'users', { id: user.id }); can('delete', 'users', { id: user.id });
return rules; };
Expected behavior
It should allow user to get only info related to their id, and give 403 on any other user
Actual behavior
System details
Macbook Pro M1 13inch MacOS Monterey 12.2
Module versions (especially the part that's not working):
NodeJS version:
Operating System: