Checking access with CASL throws an error - PrismaORM, NestJs, Typescript

Question

In a middleware I'm setting up a condition to access users, being the users to be in the same appartment than the authenticated user. This condition is the following : can(DirectoryAction.VIEW, 'DirectoryUser', { roles: { some: { role: { unitId: CASL_ROLE.unitId } } } }); DirectoryAction is an enum containing actions such as view, delete, or update. DirectoryUser is the name of my user object. CASL_ROLE is the name I gave to the authenticated user's role. Consider unitId to be the appartment ID.

No exception at compilation, typescript error detected in studio code. It's a pure runtime error : --> "equals" does not supports comparison of arrays and objects

Prisma schemas :

model DirectoryUser {
    id          BigInt   @id @default(autoincrement())
    userName    String   @map("user_name")
    password    String
    roles   DirectoryRoleUserMapping[]

    @@map("directory_users")
}

model DirectoryRoleUserMapping {
    id  BigInt          @id @default(autoincrement())
    roleId  BigInt          @map("role_id")
    role    DirectoryRole   @relation(fields: [roleId], references: [id], onDelete: Cascade, onUpdate: Cascade)
    userId  BigInt      @map("user_id")
    user    DirectoryUser   @relation(fields: [userId], references: [id], onDelete: Cascade, onUpdate: Cascade)

    @@unique([roleId, userId])
    @@map("directory_role_user_mappings")
}

model DirectoryRole {
    id     BigInt    @id @default(autoincrement())
    name   String
    unitId BigInt?   @map("unit_id")
    unit   BmsUnit?  @relation(fields: [unitId], references: [id], onDelete: Cascade, onUpdate: Cascade)
    rank   BigInt

    users  DirectoryRoleUserMapping[]

    @@unique([name, unitId])
    @@map("directory_roles")
}

Changind the condition for a less complicated one as (only the condition here) : { roles: { some: { roleId: CASL_ROLE.id } } } Does not throw an error anymore, but the condition don't follow anymore the specifications. It seems that anytime I set an object instead of a pair key: value in the "some", this error shows up. f.e., this condition : { roles: { some: { role: { id: CASL_ROLE.id } } } } Throws an error, but the condition verifies the same thing as the one just before.

Ask more infos if needed ! Thks a lot for your attention !

Answer 1

It seems like you're running into an issue where 'equals' doesn't support comparison of arrays and objects. This is usually an issue that crops up when you try to use an 'equals' function on object or array types. Here, it seems like you're trying to make a comparison using the 'some' function from CASL (Common Access Security Layer), but it doesn't support the level of object complexity you're using.

A potential solution could be to flatten the objects to a level where you're comparing simple key-value pairs, rather than comparing nested objects. You should also ensure that you are comparing objects of the same type for equality. The error message seems to suggest that you're comparing an array to an object, which won't work.

In summary, make sure you're comparing apples to apples (simple key-value pairs to simple key-value pairs) rather than apples to oranges (arrays to objects).

I don't have full context of your application but here is sample prisma schema:

model DirectoryUser {
    id          BigInt   @id @default(autoincrement())
    userName    String   @map("user_name")
    password    String
    roles       DirectoryRoleUserMapping[]

    @@map("directory_users")
}

model DirectoryRoleUserMapping {
    id  BigInt          @id @default(autoincrement())
    roleId  BigInt      @map("role_id")
    role    DirectoryRole   @relation(fields: [roleId], references: [id], onDelete: Cascade, onUpdate: Cascade)
    userId  BigInt      @map("user_id")
    user    DirectoryUser   @relation(fields: [userId], references: [id], onDelete: Cascade, onUpdate: Cascade)

    @@unique([roleId, userId])
    @@map("directory_role_user_mappings")
}

model DirectoryRole {
    id     BigInt    @id @default(autoincrement())
    name   String
    unitId BigInt?   @map("unit_id")
    unit   BmsUnit?  @relation(fields: [unitId], references: [id], onDelete: Cascade, onUpdate: Cascade)
    rank   BigInt

    users  DirectoryRoleUserMapping[]

    @@unique([name, unitId])
    @@map("directory_roles")
}