fix: adds unlessCan method to ForbiddenError and reused it mongoose package to construct ForbiddenError

Author: stalniy

packages/casl-ability/spec/pack_rules.spec.js

@@ -1,4 +1,4 @@
-import './spec_helper';
+import './spec_helper'
 import { packRules, unpackRules } from '../src/extra'
 
 describe('Ability rules packing', () => {

packages/casl-ability/spec/rulesToAST.spec.js

@@ -1,6 +1,6 @@
 import { defineAbility } from '../src'
 import { rulesToAST } from '../src/extra'
-import './spec_helper';
+import './spec_helper'
 
 describe('rulesToAST', () => {
   it('returns empty "and" `Condition` if there are no conditions in `Ability`', () => {

packages/casl-ability/spec/rulesToQuery.spec.js

@@ -1,6 +1,6 @@
 import { defineAbility } from '../src'
 import { rulesToQuery } from '../src/extra'
-import './spec_helper';
+import './spec_helper'
 
 function toQuery(ability, action, subject) {
   const convert = rule => rule.inverted ? { $not: rule.conditions } : rule.conditions

packages/casl-ability/spec/rules_to_fields.spec.js

@@ -1,6 +1,6 @@
 import { rulesToFields } from '../src/extra'
 import { defineAbility, PureAbility } from '../src'
-import './spec_helper';
+import './spec_helper'
 
 describe('rulesToFields', () => {
   it('returns an empty object for an empty `Ability` instance', () => {

packages/casl-ability/spec/spec_helper.js

@@ -1,6 +1,6 @@
 import chai from 'chai'
 import spies from 'chai-spies'
-import '../../dx/lib/spec_helper';
+import '../../dx/lib/spec_helper'
 
 chai.use(spies)
 

packages/casl-ability/src/ForbiddenError.ts

@@ -1,9 +1,10 @@
 import { AnyAbility } from './PureAbility';
-import { Normalize } from './types';
+import { Normalize, Subject } from './types';
 import { Generics } from './RuleIndex';
 import { getSubjectTypeName } from './utils';
 
 export type GetErrorMessage = (error: ForbiddenError<AnyAbility>) => string;
+/** @deprecated will be removed in the next major release */
 export const getDefaultErrorMessage: GetErrorMessage = error => `Cannot execute "${error.action}" on "${error.subjectType}"`;
 
 const NativeError = function NError(this: Error, message: string) {
@@ -25,7 +26,7 @@ export class ForbiddenError<T extends AnyAbility> extends NativeError {
     this._defaultErrorMessage = typeof messageOrFn === 'string' ? () => messageOrFn : messageOrFn;
   }
 
-  static from<U extends AnyAbility>(ability: U) {
+  static from<U extends AnyAbility>(ability: U): ForbiddenError<U> {
     return new this<U>(ability);
   }
 
@@ -39,26 +40,33 @@ export class ForbiddenError<T extends AnyAbility> extends NativeError {
     }
   }
 
-  setMessage(message: string) {
+  setMessage(message: string): this {
     this.message = message;
     return this;
   }
 
-  throwUnlessCan(...args: Parameters<T['can']>) {
-    const rule = this.ability.relevantRuleFor(...args);
+  throwUnlessCan(...args: Parameters<T['can']>): void
+  throwUnlessCan(action: string, subject?: Subject, field?: string): void {
+    const error = (this as any).unlessCan(action, subject, field);
+    if (error) throw error;
+  }
+
+  unlessCan(...args: Parameters<T['can']>): this | undefined
+  unlessCan(action: string, subject?: Subject, field?: string): this | undefined {
+    const rule = this.ability.relevantRuleFor(action, subject, field);
 
     if (rule && !rule.inverted) {
       return;
     }
 
-    this.action = args[0];
-    this.subject = args[1];
-    this.subjectType = getSubjectTypeName(this.ability.detectSubjectType(args[1]));
-    this.field = args[2];
+    this.action = action;
+    this.subject = subject;
+    this.subjectType = getSubjectTypeName(this.ability.detectSubjectType(subject));
+    this.field = field;
 
     const reason = rule ? rule.reason : '';
     // eslint-disable-next-line no-underscore-dangle
     this.message = this.message || reason || (this.constructor as any)._defaultErrorMessage(this);
-    throw this; // eslint-disable-line
+    return this; // eslint-disable-line consistent-return
   }
 }

packages/casl-mongoose/spec/accessible_records.spec.ts

@@ -1,4 +1,4 @@
-import { Ability, defineAbility, ForbiddenError, SubjectType } from '@casl/ability'
+import { Ability, createMongoAbility, defineAbility, ForbiddenError, MongoAbility, SubjectType } from '@casl/ability'
 import mongoose from 'mongoose'
 import { AccessibleRecordModel, accessibleRecordsPlugin, toMongoQuery } from '../src'
 
@@ -195,14 +195,29 @@ describe('Accessible Records Plugin', () => {
           })
       })
 
-      it('throws `ForbiddenError` for `countDocuments` request', async () => {
+      it('throws `ForbiddenError` for `estimatedDocumentCount` request', async () => {
         await query.estimatedDocumentCount()
           .then(() => fail('should not execute'))
           .catch((error: any) => {
             expect(error).toBeInstanceOf(ForbiddenError)
             expect(error.message).toMatch(/cannot execute/i)
           })
       })
+
+      it('throws `ForbiddenError` with correct message when subjectType is a model', async () => {
+        const anotherAbility = createMongoAbility([
+          { action: 'read', subject: Post }
+        ], {
+          detectSubjectType: o => o.constructor,
+        })
+
+        await Post.find().accessibleBy(anotherAbility, 'update')
+          .then(() => fail('should never be called'))
+          .catch((error: unknown) => {
+            expect(error).toBeInstanceOf(ForbiddenError)
+            expect((error as ForbiddenError<MongoAbility>).message).toBe('Cannot execute "update" on "Post"')
+          })
+      })
     })
   })
 

packages/casl-mongoose/src/accessible_records.ts

@@ -1,4 +1,4 @@
-import { Normalize, AnyMongoAbility, Generics, ForbiddenError, getDefaultErrorMessage } from '@casl/ability';
+import { Normalize, AnyMongoAbility, Generics, ForbiddenError } from '@casl/ability';
 import { Schema, QueryWithHelpers, Model, Document, HydratedDocument, Query } from 'mongoose';
 import { toMongoQuery } from './mongo';
 
@@ -13,10 +13,7 @@ function failedQuery(
 
   if (typeof anyQuery.pre === 'function') {
     anyQuery.pre((cb: (error?: Error) => void) => {
-      const error = ForbiddenError.from(ability);
-      error.action = action;
-      error.subjectType = modelName;
-      error.setMessage(getDefaultErrorMessage(error));
+      const error = ForbiddenError.from(ability).unlessCan(action, modelName);
       cb(error);
     });
   }