Condition on many to many relation

[jd4u]

Person has many to many relation with Team. And Team member Person can "manage" own Team member Person.

👇 - Prisma schema example:

model Person{
 id Int
 name string
 teams Team[]
}
model Team{
 id Int 
 members Person[]
}

👇 - Ability configuration

// Person can manage own/self
// OR
// Person can manage other Persons having same Teams
can("manage", "Person", {
            OR: [
              { id: person.id },
              {
                teams: {
                  some: {
                    id: { in: [...person.teams.map((t) => t.id)] },
                  },
                },
              },
            ],
          });

👇 - Ability check for action create

const createInput = { name: "person2", teams: { connect: { id: 2} }, };  // for reference value
const user={ id: 1, teams: [ {id: 1}, {id: 2} ], }; // for reference value
// ability is created for the user as referenced above
const isAllowed = ability.can("create", subject("Person", createInput)); // 👈 isAllowed is false

❓ What is wrong in the ability configuration that causes the return value false?

Using @casl/prisma along with @casl/ability as per the guides.

[jd4u]

The Ability Configuration returns following while using accessibleBy for the same user

{"OR":[{"OR":[{"id":2},{"teams":{"some":{"id":{"in":[1,2]}}}}]}

The prisma findMany returned results are as expected using the above.

[jd4u]

Is the "connect" notation in createInput, processed correctly within @casl/prisma to match the condition?

[jd4u]

@stalniy ,

• is the above ability configuration correct?
• shall it match the CreateInput/UpdateInput object structure?
  Prisma Input structure for relations provide "connect", "create" or "connectOrcreate" object to cover the actual related object value?
• The ability configuration works for Where query generation with expected results.

[jd4u]

Note: Using the custom client location for prisma and suggested prisma-integration as per casl site.

[jd4u]

Currently moved to using a workaround to test only the validation fields as per conditions.

// ability is created for the user as referenced above
// const isAllowed = ability.can("create", subject("Person", createInput)); // 👈 isAllowed is false
// passing only validation fields as per the conditions
const isAllowed = ability.can("create", subject("Person", {teams: [ createInput.teams.connect ] )); // 👈 isAllowed is *true*

• shortcoming is only one connect must be present