docs(security): update deprecated method from @casl/ability

[usystemsoftwares]

PR Checklist

Please check if your PR fulfills the following requirements:

• The commit message follows our guidelines: https://github.com/nestjs/docs.nestjs.com/blob/master/CONTRIBUTING.md

PR Type

What kind of change does this PR introduce?

• Bugfix
• Feature
• Code style update (formatting, local variables)
• Refactoring (no functional changes, no api changes)
• Build related changes
• Docs
• Other... Please describe:

What is the current behavior?

Warning message - "@deprecated use createMongoAbility function instead and MongoAbility interface. In the next major version PureAbility will be renamed to Ability and this class will be removed"

What is the new behavior?

Keep official documentation up to date!

Does this PR introduce a breaking change?

• Yes
• No

Other information

Happy to be able to keep up to date the official documentation of this exceptional framework that is Nest.js.

[jmcdo29]

LGTM

[kamilmysliwiec]

This guide isn't mongo specific so why "createMongoAbility"?

[Tony133]

see here: https://github.com/stalniy/casl/blob/master/packages/casl-ability/src/Ability.ts#L9,

If I am honest, the name "Ability" was much better, while "MongoAbility" which is very confusing.

[kamilmysliwiec]

This guide isn't mongo specific so why "MongoAbility"?

[kamilmysliwiec]

Why?

[edgahan]

Disclaimer: I am not 100% sure about this but I've just tried to get Casl working with Nest today and the only way I got it working was like this:

// I did not use createMongoAbility or anything with the word Mongo in it, instead I used PureAbility
import {
  PureAbility,
  AbilityBuilder,
  ExtractSubjectType,
  InferSubjects,
  AbilityClass,
  MatchConditions,
} from '@casl/ability';

const Ability = PureAbility as AbilityClass<AppAbility>;
// I created a lambdaMatcher as this seemed to be the only way to check attributes (below)
const lambdaMatcher = (matchConditions: MatchConditions) => matchConditions;


type Subjects =
  | InferSubjects<typeof User | typeof Entity>
  | 'all';

export enum Action {
  MANAGE = 'manage',
  CREATE = 'create',
  READ = 'read',
  UPDATE = 'update',
  DESTROY = 'destroy',
}

@Injectable()
export class CaslAbilityFactory {
  createForUser(user: User | AccountUser) {
    const { can, cannot, build } = new AbilityBuilder(Ability);
    
    // Note: probably nicer to check user role here?
    if (user.isAdmin) {
      can(Action.READ, Entity, (e: Entity) => {
        // Return a boolean, note: `e` is an instance
        // Note I could not get it working as per the documentation with the object syntax 
        return e.account.id === user.account.id;
      });

      // Shorthand example
      can(Action.READ, Entity, (e: Entity) => e.userId === user.id);
    }

    return build({
      detectSubjectType: (item) =>
        item.constructor as ExtractSubjectType<Subjects>,

      // Add conditionsMatcher
      conditionsMatcher: lambdaMatcher,
    });
  }
}

And then in an example Entity controller, I have:

export class EntityController {
  constructor(
    private readonly caslAbilityFactory: CaslAbilityFactory,
  ) {}
  
    @Get(':id')
    async findOne(@Param('id') id: string, @Req() req: RequestWithUser) {
      const ability = this.caslAbilityFactory.createForUser(req.user);
      const entity = await this.entitiesService.findOneById(id);
      // Note we pass in entity instance not Entity class
      if (ability.can(Action.READ, entity)) {
        // Authorized
      }
    }
}