Open benediktms opened 1 year ago
Unfortunately it's not possible (at least I cant find a good way to do this). accessibleBy
throws ForbiddenError only in case it cannot generate where
. This means either there is no rules defined for that particular action/subject or rules defined in a way that it's possible to predict empty result set.
In order to narrow down, conditions I need to return back some where
conditions and this should be something like WHERE 1 != 1
, so we force underlying database engine to return empty result set (in this case SQL). But very likely prisma doesn't support this kind of query (at least it was true few versions ago).
In mongoose, there is a way to hook into query execution and return empty result or throw an error. If smth is possible in Prisma ecosystem (maybe with extensions), then potentially we can implement the same logic in Prisma
In the past, casl-mongoose returned empty set in case user has no access to anything but later some people asked me to raise an exception instead.
The issue here is that in case of database query it's impossible to solve this issue, correct me if I'm wrong somewhere. Look at this scenarios:
Imagine we have a blog website where multiple authors can write articles and create drafts. Only draft author has access to own drafts.
Now we have these situations:
When in this situation should we throw an error? In non of this cases. Only when this user initiates request to fetch drafts of other users (not own) but this may be forbidden technically (e.g., by using /my/drafts
-> no way to fetch others drafts from API standpoint).
Potentially we could check that query somehow partially matched to allowed object will return allowed objects but even this doesn't give 100% guarantee whether user has access to smth or not. Because of queries like >
& <
, geolocation queries, LIKE
, REGEXP
, mongo allow to pass $where
expressions to conditions, how should we validate that smth potentially may be disallowed in that case? This brings a lot of complexity to casl and very likely will never be solved. In my opinion there is nothing bad to show empty result set or 404 instead of 403. Moreover it's even better because you do not disclose data in your db to potential hackers.
Imagine there is a resource in db and when smb access it without proper access, you return 403 -> this tells smth to the hacker:
When you return 404 instead, the hacker don't have these 2 points from the top ^^^ and for him now impossible to know whether this resource even exist. This is how github works, in case you access private repo, you will get 404 not 403. And from encapsulation and information hiding standpoint, this is nice.
I found a way to return an empty list from db instead of throwing exception -> https://www.prisma.io/docs/concepts/components/prisma-client/null-and-undefined#the-effect-of-null-and-undefined-on-conditionals
Basically if there is { OR: [] }
, Prisma should return an empty result set.
Describe the bug I am using casl with the Prisma plugin. So far I think everything is working really nicely, but I've noticed that that the
accessibleBy
function does not throw an error when a restricted resource is being accessed, instead it seems to simply narrow the search query, so that nothing is returned if the user does not have permission to access the resource.To Reproduce For example, here I've defined my ability:
Expected behavior As mentioned in the documentation I am expecting a
ForbiddenError
to be thrown. However it seems that this query simply returns:suggesting that the
can
simply narrows the search results rather than throw an exception. Using afindFirst
and not using any filters and then asserting afterwards like so:seems to work, but this does not seem to be the intended behaviour.
CASL Version
"@casl/ability": "^6.5.0", "@casl/prisma": "^1.4.0", "@casl/react": "^3.1.0",
Environment:
node: ^18