🔐 CASL

The core query service is CASL-agnostic. Install the optional peers only in applications that use CASL:

pnpm add @casl/ability @casl/prisma

🧩 Service Wiring

import { QueryService, type BaseDelegateTypeMap } from '@querry-kit/nest-prisma-query';
import { createCaslAccessibleWhere } from '@querry-kit/nest-prisma-query/casl';

export class ProjectsService extends QueryService<
  typeof PrismaService.prototype.project,
  ProjectTypeMap,
  typeof PrismaService.prototype.project,
  QueryOptionsMap<ProjectTypeMap>,
  AppAbility,
  'Project'
> {
  constructor(prisma: PrismaService) {
    super(prisma.project, {
      subject: 'Project',
      accessibleWhere: createCaslAccessibleWhere({ action: 'read' }),
    });
  }
}

Pass the current ability when calling protected read methods:

const result = await this.projectsService.query(query, ability);

👥 Member-Based Project Access

CASL Prisma rules can express relation filters. For example, allow a user to read projects where they are tagged as a member:

can('read', 'Project', {
  members: {
    some: {
      userId: currentUser.id,
    },
  },
});

When query receives both an ability and caller filters, QueryService merges them as:

{
  AND: [
    { members: { some: { userId: currentUser.id } } },
    { archived: false }
  ]
}

This keeps the access rule mandatory while still allowing endpoint-level filters.

🔄 CASL Prisma Versions

The adapter supports both CASL Prisma subject maps and the newer accessibleBy(...).ofType(subject) shape. The package does not export an ability factory; applications keep their own CASL module, subjects, actions, and user context.