ps73 / feathers-prisma

A Feathers service adapter for Prisma ORM.
MIT License
38 stars 3 forks source link

Unexpected behaviour on get method #6

Closed harukaze-sm closed 2 years ago

harukaze-sm commented 2 years ago

Steps to reproduce

export const defineRulesFor = (user: User) => { const { can, rules } = new AbilityBuilder(Ability);

can('read', 'users', { id: user.id }); # note that { id: user.id } causes this issue can('update', 'users', { id: user.id }); can('delete', 'users', { id: user.id });

return rules; };


```javascript
import { authorize } from 'feathers-casl/dist';

 before: {
    all: [authenticate('jwt'), loadAbilities()], // load abilities are basically same as https://feathers-casl.netlify.app/getting-started.html#add-abilities-to-hooks-context
    get: [authorize()], // this hook causes the JSON response written at the top
  },

Expected behavior

It should allow user to get only info related to their id, and give 403 on any other user

Actual behavior

image

System details

Macbook Pro M1 13inch MacOS Monterey 12.2

Module versions (especially the part that's not working):

feathers-prisma@0.5.6
feathers-casl@0.7.1

NodeJS version:

v16.13.0

Operating System:

MacOS
harukaze-sm commented 2 years ago

Update:

Found that after removing checkIdInQuery function inside _get method helped my resolve my issue, works as excepted

image
ps73 commented 2 years ago

Just for documentation. It is the same wrong behavior in _remove and _update method if we use feathers-casl.

ps73 commented 2 years ago

Issues were fixed this in v0.5.7