Trying to make feathers-casl to work with Feathers v5 Dove

[HarisHashim]

I am trying feathers-casl with v5 base on Getting started guide.

Initially I asked question in discord about where to put code to assign the ability by calling defineAbilitiesFor() since authentication.hooks.ts no longger exist in v5.

A repo for my codes is here => https://github.com/HarisHashim/fcasl-example

I solved that by adding the hook in authentication.ts like so

export const authentication = (app: Application) => {
  const authentication = new AuthenticationService(app)

  const servicePath =   'authentication'

  authentication.register('jwt', new JWTStrategy())
  authentication.register('local', new LocalStrategy())
  authentication.register('google', new OAuthStrategy())
  authentication.register('auth0', new OAuthStrategy())

  app.use(servicePath, authentication)

  console.log('Setting up Authentication service hook') // <== start here
  app.service(servicePath).hooks({
    after: {create:[
   (context) => {
        const { user } = context.result;
        if (!user) return context;
        const ability = defineAbilitiesFor(user);
        context.result.ability = ability;
        context.result.rules = ability.rules;

        return context;
      }
    ]}
  })

  app.configure(oauth())
}

This make feathers-casl work but still does not allow user with admin role to create another user. basically there is after and before hook in users.ts file that use authorizeHook as per bellow code

// users.ts file

import { authorize } from 'feathers-casl'
const authorizeHook = authorize({ adapter: '@feathersjs/knex' })

// before create hook
before: {
        authorizeHook
}

// after create hook
after: {
        authorizeHook
}

If authorizeHook is removed from before and after create hook. I can crate another user using admin role. Otherwise I will get below error. Which is how I know that feathers-casl is somewhat working.

{
    "name": "Forbidden",
    "message": "You're not allowed to create on 'users'",
    "code": 403,
    "className": "forbidden"
}

The thing is that, I need to allow admin user to create user.

My code for abilities.ts is

import { Ability, AbilityBuilder, createAliasResolver } from "@casl/ability";

// don't forget this, as `read` is used internally
const resolveAction = createAliasResolver({
  update: "patch", // define the same rules for update & patch
  read: ["get", "find"], // use 'read' as a equivalent for 'get' & 'find'
  delete: "remove" // use 'delete' or 'remove'
});

export const defineRulesFor = (user) => {
  console.log('defineRulsFor') //'user', JSON.stringify( user,null, '\tab'));

  // also see https://casl.js.org/v6/en/guide/define-rules
  const { can, cannot, rules } = new AbilityBuilder(Ability);

  if (user.role && user.role.name === "super") {
    // SuperAdmin can do evil
    can("manage", "all");
    return rules;
  }

  if (user.role && user.role.name === "admin") {
    can("create", "users");
  }

  can("read", "users");
  can("update", "users", { id: user.id });
  cannot("update", "users", ["roleId"], { id: user.id });
  cannot("delete", "users", { id: user.id });

  return rules;
};

export const defineAbilitiesFor = (user) => {
  const rules = defineRulesFor(user);

  return new Ability(rules, { resolveAction });
};

Also there are migration and seed file in the repo that create correct database structure since my theory about why it doesn't work is knex and database related. But when there are proper table for user and roles. It still doesn't work.

@fratzinger please help?

[HarisHashim]

In abilities.ts , user.role is undefined. While user.roleId is valid. Tested by setting breakpoint and use postmen to simulate login (i.e. POST to authentication service).

Basicly user.role.name is where I am stuck now.

 if (user.role && user.role.name === "admin") {
    can("create", "users");
  }

Looks like no relationship between users table and roles table. Looks like no relationship between users table and roles table. Eventhough users table is setup correctly. Perhaps I am missing something on knex?

CREATE TABLE `users` (
	`id` INT(10) UNSIGNED NOT NULL AUTO_INCREMENT,
	`email` VARCHAR(255) NULL DEFAULT NULL COLLATE 'utf8mb4_general_ci',
	`password` VARCHAR(255) NULL DEFAULT NULL COLLATE 'utf8mb4_general_ci',
	`googleId` VARCHAR(255) NULL DEFAULT NULL COLLATE 'utf8mb4_general_ci',
	`auth0Id` VARCHAR(255) NULL DEFAULT NULL COLLATE 'utf8mb4_general_ci',
	`roleId` INT(10) UNSIGNED NOT NULL,
	PRIMARY KEY (`id`) USING BTREE,
	UNIQUE INDEX `users_email_unique` (`email`) USING BTREE,
	INDEX `users_roleid_foreign` (`roleId`) USING BTREE,
	CONSTRAINT `users_roleid_foreign` FOREIGN KEY (`roleId`) REFERENCES `roles` (`id`) ON UPDATE RESTRICT ON DELETE RESTRICT
)

[fratzinger]

Thanks for the thorough explanation!

Of course user.role is undefined, which should be your problem. There are hundred ways of solving this. I will share a very basic approach which solves your problem for now, which you might change in the future.

You need to populate role to the user. The v5 way of doing this would be a resolver. I don't use resolves myself so I will share a method I know works. The example uses alterItems from feathers-hooks-common so please make sure to install it (https://hooks-common.feathersjs.com/hooks.html#alteritems).

// hooks for service '/users'
import { alterItems } from "feathers-hooks-common";

const populateRole = () => {
  return alterItems(async (user, context) => {
    if (!user.roleId) {
      return;
    }

    user.role = await context.app.service('roles' /* YOUR ROLES SERVICEPATH */).get(user.roleId);

    return user;
  });
}

// ...
// add as after hook
// ... whereever your users hooks live
  after: {
    all: [populateRole()],
    find: [],
    get: [],
    create: [],
    update: [],
    patch: [],
    remove: [],
  },

Please let me know if user.role in abilities.ts is defined now.

[HarisHashim]

Thanks @fratzinger , did what you suggested and user.role is defined now.

That part is working and doing "/authentication" with admin user give below response.

But still fail at creating user with same forbidden error when I use access token from the response body.

code: 201 created
Body:

{
    "accessToken": "xxxxxx",
    "authentication": {
        "strategy": "local",
        "payload": {
            "iat": 1730980570,
            "exp": 1731066970,
            "aud": "https://yourdomain.com",
            "sub": "2",
            "jti": "xxxx"
        }
    },
    "user": {
        "id": 2,
        "email": "[email protected]",
        "googleId": null,
        "auth0Id": null,
        "roleId": 2,
        "role": {
            "id": 2,
            "name": "admin",
            "permissions": "[{\"action\":\"create\",\"subject\":\"users\"}]"
        }
    },
    "ability": {
        "h": true,
        "l": {},
        "p": {},
        "$": "manage",
        "A": "all",
        "M": [
            {
                "action": "create",
                "subject": "users"
            },
            {
                "action": "read",
                "subject": "users"
            },
            {
                "action": "update",
                "subject": "users",
                "conditions": {
                    "id": 2
                }
            },
            {
                "action": "update",
                "inverted": true,
                "subject": "users",
                "fields": [
                    "roleId"
                ],
                "conditions": {
                    "id": 2
                }
            },
            {
                "action": "delete",
                "inverted": true,
                "subject": "users",
                "conditions": {
                    "id": 2
                }
            }
        ],
        "m": false
    },
    "rules": [
        {
            "action": "create",
            "subject": "users"
        },
        {
            "action": "read",
            "subject": "users"
        },
        {
            "action": "update",
            "subject": "users",
            "conditions": {
                "id": 2
            }
        },
        {
            "action": "update",
            "inverted": true,
            "subject": "users",
            "fields": [
                "roleId"
            ],
            "conditions": {
                "id": 2
            }
        },
        {
            "action": "delete",
            "inverted": true,
            "subject": "users",
            "conditions": {
                "id": 2
            }
        }
    ]
}

Error when creating new user

{
    "name": "Forbidden",
    "message": "You're not allowed to create on 'users'",
    "code": 403,
    "className": "forbidden"
}

The repo now have develop branch with codes that implement populateRole hook in users.ts .

[HarisHashim]

Debugging at the moment and seeing this...

The forbidden error is actually thrown at that line of code possibly because options?.ability is undefined

[HarisHashim]

I think this is more correct assesment. In the same function getAbility$1 context?.params?.ability is undefined.

I am not sure how context.result.ability = ability in below code populate context?.params?.ability . Probably some hook magic and looks to me it is not working.