Using filter

[Morb0]

How can I use filter function in the controller to return the filtered data?
To filter data with all user roles rules we need acess to permission object.

[bashleigh]

I "think" (not used this package) you can access the request object in an interceptor? So Something like this?

import { Injectable, NestInterceptor, ExecutionContext } from '@nestjs/common';
import { Observable } from 'rxjs';

@Interceptor()
export class DataInterceptor implements NestInterceptor {
  async intercept(context: ExecutionContext, call$: Observable<any>) {
    request = context.switchToHttp().getRequest();

    if (request.user && request.user.roles && request.user.roles.includes('SOME_ROLE')) {
        return call$.pipe();// add your rxjs method here to manipulate the response I think?
    }

    return call$;
  }
}

I've assigned @shekohex as he'll be able to help you more than I can with this.

[shekohex]

if you need to access the permission object that located at the user object
you could use @UserRoles('permission') decorator to access it, will return req.user.permission

if you asking about the Roles you have defined before, i.e the object passed to the AccessControlModule.forRoles(roles) then use @InjectRolesBuilder() instead.

[Morb0]

if you need to access the permission object that located at the user object
you could use @UserRoles('permission') decorator to access it, will return req.user.permission

if you asking about the Roles you have defined before, i.e the object passed to the AccessControlModule.forRoles(roles) then use @InjectRolesBuilder() instead.

Ok, if im using roleBuilder i can do so:

@UseRoles({
  resource: 'user',
  action: 'read',
  possession: 'own',
})
@Get('/me')
findMe(@AuthUser() user: User): User {
  const permission = this.roleBuilder.can(user.roles).readOwn('user');
  return permission.filter(user);
}

And for more than one role I do like this: (here use 2 roles only like example)

@UseRoles({
  resource: 'user',
  action: 'read',
  possession: 'own',
}, {
  resource: 'user',
  action: 'read',
  possession: 'any',
})
@Get('/me')
findMe(@AuthUser() user: User): User {
  const permission = this.roleBuilder.can(user.roles).readOwn('user').readAny('user');
  return permission.filter(user);
}

This is the correct decision?

[shekohex]

@0ArturkA I see, There is no problem here, but you are just reimplemented the work done for you by ACGuard, so i didn't get your point yet (what's the use case for doing so !)

[Morb0]

@0ArturkA I see, There is no problem here, but you are just reimplemented the work done for you by ACGuard, so i didn't get your point yet (what's the use case for doing so !)

I need the filtering function to hide some fields from the user, namely, when user trying to get self profile, he received only public data.

[shekohex]

Okay, just try to remove the @UseRoles(...)
that's unnecessary if you want to manually filter the roles.

[Morb0]

@shekohex Can I automate filtering with @UseRoles(...)? Perhaps for this need create a custom guard?

[shekohex]

IMO, in your use case, A custom Guard makes more sense now.
Take a look on the ACGuard first to have a full overview of how to implement yours.

[Morb0]

@shekohex Ok, thank for help