fix(ability): returns null from rulesToQuery if ability has only …

…inverted rules

Fixes #170

packages/casl-ability/spec/query.spec.js

@@ -42,6 +42,15 @@ describe('rulesToQuery', () => {
     expect(Object.keys(query)).to.be.empty
   })
 
+  it('returns `null` if specified only inverted rules', () => {
+    const ability = AbilityBuilder.define((can, cannot) => {
+      cannot('read', 'Post', { private: true })
+    })
+    const query = toQuery(ability, 'read', 'Post')
+
+    expect(query).to.be.null
+  })
+
   it('returns `null` if at least one inverted rule does not have conditions', () => {
     const ability = AbilityBuilder.define((can, cannot) => {
       cannot('read', 'Post', { author: 123 })
@@ -80,6 +89,7 @@ describe('rulesToQuery', () => {
 
   it('AND-es conditions for inverted rules', () => {
     const ability = AbilityBuilder.define((can, cannot) => {
+      can('read', 'Post')
       cannot('read', 'Post', { status: 'draft', createdBy: 'someoneelse' })
       cannot('read', 'Post', { status: 'published', createdBy: 'me' })
     })

packages/casl-ability/src/extra.js

@@ -25,7 +25,9 @@ export function rulesToQuery(ability, action, subject, convert) {
     }
   }
 
-  return rules.length > 0 ? query : null;
+  const isOnlyInvertedRules = query.$and && query.$and.length === rules.length;
+
+  return rules.length === 0 || isOnlyInvertedRules ? null : query;
 }
 
 export function rulesToFields(ability, action, subject) {