Throw error when object is not defined and can manage all

[RenaudAubert]

Hi!

I've noticed that the following code throws except when the user can("manage", "all")

ForbiddenError.from(permissions).throwUnlessCan(action, subject(model, resource), field)

The problem is I'd like for this code to throw even if the user can manage all.
My prisma ability implements PureAbility which in turns implements RuleIndex class which has this method

detectSubjectType(object?: Normalize<A>[1]): ExtractSubjectType<Normalize<A>[1]> {
    if (isSubjectType(object)) return object as ExtractSubjectType<Normalize<A>[1]>;
    if (!object) return this._anySubjectType as ExtractSubjectType<Normalize<A>[1]>;
    return this._detectSubjectType(object as Exclude<Normalize<A>[1], SubjectType>);
  }

We can see clearly here that if object is not defined it returns _anySubjectType (default being "all").
I've tried passing detectSubjectType option to the build method but this option is used after checking if the object exists.

Any idea how I could override this?

Cheers,

[stalniy]

Hey,

you can extend Ability and overwrite its detectSubjectType method

[RenaudAubert]

Hey!
Thanks a lot for the help.
I actually found another solution for my problem:

can("manage", "all")
// "null" is a special subject created to handle null cases
cannot("manage", "null")

// Later
ForbiddenError.from(ability).throwUnlessCan(
    action,
    subject( resource ? model : NULL_MODEL_NAME, resource ?? {}),
    field
)

This way a user can do everything as long as the object exists.