stalniy / casl

CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access
https://casl.js.org/
MIT License
5.96k stars 270 forks source link

Incompatibility rulesToQuery with Sequelize 5 #171

Closed bbones closed 5 years ago

bbones commented 5 years ago

The result of function based on String doesn't work with { where: query } statement for example in a scope definition

Workaround based on Security part of http://docs.sequelizejs.com/manual/querying.html#combinations You need to use operatorsAliases

` const Op = Sequelize.Op; const operatorsAliases = { $eq: Op.eq, $ne: Op.ne, $gte: Op.gte, $gt: Op.gt, $lte: Op.lte, $lt: Op.lt, $not: Op.not, $in: Op.in, $notIn: Op.notIn, $is: Op.is, $like: Op.like, $notLike: Op.notLike, $iLike: Op.iLike, $notILike: Op.notILike, $regexp: Op.regexp, $notRegexp: Op.notRegexp, $iRegexp: Op.iRegexp, $notIRegexp: Op.notIRegexp, $between: Op.between, $notBetween: Op.notBetween, $overlap: Op.overlap, $contains: Op.contains, $contained: Op.contained, $adjacent: Op.adjacent, $strictLeft: Op.strictLeft, $strictRight: Op.strictRight, $noExtendRight: Op.noExtendRight, $noExtendLeft: Op.noExtendLeft, $and: Op.and, $or: Op.or, $any: Op.any, $all: Op.all, $values: Op.values, $col: Op.col };

const connection = new Sequelize(db, user, pass, { operatorsAliases });`

stalniy commented 5 years ago

rulesToQuery was implemented as a generic helper function which result must be transformed according to ORM or db driver rules.

CASL has never officially supported sequelize or SQL (#8), so it's not an issue.

stalniy commented 5 years ago

I close this but feel free to reopen if you think I can do something on this

stalniy commented 5 years ago

Please look at this discussion about sequelize aliases: https://github.com/sequelize/sequelize/issues/10820#issuecomment-501959070