Why this returns true?

[NazarKalytiuk]

https://codesandbox.io/p/devbox/casl-playground-forked-ktjfjj

I have a rule with a condition, but I think If I check in general for a subject itself this should return false.
How to make this work?

[stalniy]

There is no way to change this. It’s by design. You ask a question: can I do smth with this type? And casl says yes, you can do smth with the instances of this type. It doesn’t check conditions on type obviously

[NazarKalytiuk]

I mean in the example. We must forbid if we have a can rule with mongo query to object

import { Ability, AbilityBuilder, subject } from "@casl/ability";

const { can, build, cannot, rules } = new AbilityBuilder(Ability);

can("create", "Meeting", {
  "event.id": 1,
  count: { $lt: Number.POSITIVE_INFINITY },
});

if (false) {
  // user.isAdmin etc
  can("create", "Meeting");
} else {
  cannot("create", "Meeting"); // only this makes it work
}

const ability = build();

console.log(ability.can("create", "Meeting")); // why this true?

[stalniy]

In this case you just throw away the rule with condition. As soon as you try to check not a type but an instance of type with properties that match your conditions, you will get false. Because you forbid creation of Meeting

[NazarKalytiuk]

You are right. Ok, so how to build an ability where the user can 'manage' a 'Meeting' if meeting.created.id == user.id and 'create' a 'Meeting' if the user has a role admin?
The problem is I want to use both can('update', meetingObj) and can('create', 'Meeting').

Here is an example, that does not work, but looks intuitive. How to fix it? is it possible?

import { Ability, AbilityBuilder, subject } from "@casl/ability";

const { can, build, cannot, rules } = new AbilityBuilder(Ability);
const user = { id: 1, admin: false };
can("manage", "Meeting", {
  createdBy: user.id,
});

if (user.admin) {
  can("create", "Meeting");
}

const ability = build();

console.log(ability.can("create", "Meeting")); // I want this to return false
console.log(ability.can("update", subject("Meeting", { createdBy: 1 }))); // and  this returns true as expected

I see that can use another subject for this. For example, I can use can("create", "MeetingS"); in both builder and use cases.
But I do not like this.

[stalniy]

As I said in the first message, there is no way to change it on code level. It works like this by intention.

You need to understand why it works this way or just switch to a different library :)

[NazarKalytiuk]

I understand. I just do not know how to achieve what I need to get.