Lazy Pattern

[corzani]

Hi,
Consider the following simple case:

function defineAbilitiesFor(user) {
    const {can, cannot, rules} = new AbilityBuilder();

   can('read', 'Something', ... a json that is a result of some computations ...);
   can('edit', 'Something', ... a json that is a result of some computations ...);
   can('delete', 'Something', ... a json that is a result of some computations ...);

return new Ability(rules);
}

It would be nice to specify all the possible rules as above but let CASL executing them lazily in case we use a function as parameter instead of a json.
Is there a way to define several complex rules avoiding unwanted code execution?

Something like:

can('read', 'Something', () => check1())
can('edit', 'Something', () => check2());
can('delete', 'Something', () => check3());

toMongoQuery(abilityAbove, 'XYZ', 'read') // Should have executed only check1 lambda

Is there any specific known pattern to handle similar cases using CASL (in my case the mongoose package)? Would it make sense as a feature?
Thanks

[stalniy]

Hi,

Thanks for the issue! Not sure that I correctly understand the usecase but you can already do this. CASL evaluates conditions lazily at the moment when you call ability.can(). Check Customize Ability

If you want to define async conditions, then this is not available for now and probably won't be implemented. You can find reasons and alternatives in #160 . Someday I plan to put this in a cookbook section.

Not sure what you expect from toMongoQuery but it returns an object of mongo conditions and it was not designed to work with functions. At least, I cannot imagine how it should work.

Does it make sense or you have something else in mind?

[corzani]

@stalniy , it's exactly that bit (the Customize Ability section), I did miss it.
Regarding toMongoQuery part... Unfortunately, to check my permissions, I need to execute several queries due to the complexity of the problem and build a json filter. With that custom Ability you pointed at I can make something dynamic that can work even if they do not support async functions.
Thanks again

[stalniy]

Cool! So, can we close the issue?

[corzani]

Yes, please do.