Skip to content
Permalink
Browse files

feat(mongoose): wraps resulting query into additional `$and`

This prevents collisions when later query is merged with another query which has `$or` condition

Fixes #140
  • Loading branch information...
stalniy committed Dec 28, 2018
1 parent 7b3f917 commit 1af1c5435080b182a925d6c62099d4b7e27f953a
@@ -15,7 +15,7 @@
"homepage": "https://stalniy.github.io/casl/",
"scripts": {
"build.es": "rollup -c ../../tools/rollup.es.js -e @casl/ability/extra",
"build.cjs": "rollup -c ../../tools/rollup.umd.js -e @casl/ability/extra -f cjs -o index.js",
"build.cjs": "SKIP_MINIFY=1 rollup -c ../../tools/rollup.umd.js -e @casl/ability/extra -f cjs -o index.js",
"build": "npm run build.es && npm run build.cjs",
"lint": "eslint src/",
"test": "NODE_ENV=test jest --config ../../tools/jest.config.js",
@@ -58,12 +58,12 @@ describe('Accessible Records Plugin', () => {
expect(Post.where).to.be.called()
})

it('passes query created by `toMongoQuery` in `where` method of the query', () => {
it('wraps `toMongoQuery` result with additional `$and` to prevent collisions when combined with `$or` query', () => {
const query = toMongoQuery(ability, 'Post')
spy.on(Post, 'where')
Post.accessibleBy(ability)

expect(Post.where).to.be.called.with.exactly(query)
expect(Post.where).to.be.called.with.exactly({ $and: [query] })
})

it('does not change query return type', () => {
@@ -35,7 +35,7 @@ function emptyQuery(query) {
function accessibleBy(ability, action) {
const query = toMongoQuery(ability, this.modelName || this.model.modelName, action);

return query === null ? emptyQuery(this.where()) : this.where(query);
return query === null ? emptyQuery(this.where()) : this.where({ $and: [query] });
}

export function accessibleRecordsPlugin(schema) {

0 comments on commit 1af1c54

Please sign in to comment.
You can’t perform that action at this time.