CASL ability rules for resource authorization: working versions (tested 2026-10-15)

{
  "name": "casl-ability-rules",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "@casl/ability": "7.0.2"
  },
  "devDependencies": {
    "@types/node": "26.6.5",
    "tsx": "4.23.15"
  }
}

import { AbilityBuilder, createMongoAbility, subject, type MongoAbility, type InferSubjects } from "@casl/ability";

export type Actions = "create" | "read" | "update" | "delete" | "manage";
export type Post = { id: number; authorId: number; published: boolean };
export type Subjects = InferSubjects<Post> | "Post" | "all";
export type AppAbility = MongoAbility<[Actions, Subjects]>;

export type Actor = { id: number; role: "admin" | "author" | "guest" };

export function asPost(p: Post) {
  return subject("Post", p);
}

export function defineAbilityFor(user: Actor): AppAbility {
  const { can, cannot, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
  if (user.role === "admin") {
    can("manage", "all");
  } else if (user.role === "author") {
    can("read", "Post");
    can("create", "Post");
    can("update", "Post", { authorId: user.id });
    cannot("delete", "Post");
  } else {
    can("read", "Post", { published: true });
  }
  return build();
}

export function packAbility(ability: AppAbility) {
  return ability.rules;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { createMongoAbility } from "@casl/ability";
import { asPost, defineAbilityFor, packAbility, type Post } from "../src/abilities.ts";

const owned: Post = { id: 1, authorId: 7, published: false };
const other: Post = { id: 2, authorId: 9, published: true };

test("admin can manage everything", () => {
  const a = defineAbilityFor({ id: 1, role: "admin" });
  assert.equal(a.can("delete", asPost(owned)), true);
  assert.equal(a.can("manage", "all"), true);
});

test("author updates only own posts", () => {
  const a = defineAbilityFor({ id: 7, role: "author" });
  assert.equal(a.can("update", asPost(owned)), true);
  assert.equal(a.can("update", asPost(other)), false);
  assert.equal(a.can("delete", asPost(owned)), false);
  assert.equal(a.can("create", "Post"), true);
});

test("guest reads only published and rules pack", () => {
  const a = defineAbilityFor({ id: 0, role: "guest" });
  assert.equal(a.can("read", asPost(other)), true);
  assert.equal(a.can("read", asPost(owned)), false);
  const packed = packAbility(a);
  const restored = createMongoAbility(packed);
  assert.equal(restored.can("read", asPost(other)), true);
});