This works fine from imported JSON:
[
{
"action": "update",
"subject": "blogpost",
"conditions": {
"authorId": "{{userId}}"
},
"reason": "User is not the original author"
}
]
I use Mustache to change the {{userId}} to the userId of the user that is requesting the permission to update.
{
name: "User 1",
userId: 1,
roles: ["admin", "billingadmin"]
}
… so the JSON now looks like the below:
[
{
"action": "update",
"subject": "blogpost",
"conditions": {
"authorId": "1"
},
"reason": "User is not the original author"
}
]
If the blogpost object looks like this:
{
title”: “Test Blog Post”,
authorId: 1
}
… then CASL recognises the condition is met that the “authorId” of the blogpost is “1”, which is the same in the conditions in the JSON file. Great stuff.
However, now I want to check if the user has a specific role when trying to update the blogpost.
This is different, because I’m not checking an attribute of the subject, but an attribute of the user accessing the subject.
How do I do this in the JSON?
My user is like this:
{
name: "User 1",
userId: 1,
roles: ["admin", "billingadmin"]
}
… so how would my JSON look like? It can’t look like the below as the ‘userrole’ attribute isn’t on the subject.
[
{
"action": "update",
"subject": "blogpost",
"conditions": {
"userrole": "admin"
},
"reason": "User is not an admin"
}
]
… so what’s the best approach?