build(deps): migrate @casl/ability v6 → v7#3696
Conversation
v7 renames PureAbility to Ability and drops the default conditions matcher;
the historical MongoDB-matching Ability class no longer exists. Build abilities
via createMongoAbility so condition rules ({ _id }, { organizationId }) keep
matching — without this, authorization silently denies and endpoints return
403/422.
Supersedes dependabot #3693. See MIGRATIONS.md for downstream notes.
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
WalkthroughThis PR upgrades the Changes
🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR migrates the project from @casl/ability v6 to v7 while restoring MongoDB-style condition matching required by the app’s CASL policies (to avoid condition rules silently failing and denying authorization).
Changes:
- Bump
@casl/abilityto^7.0.0(and lockfile transitive@ucast/*updates). - Update the policy middleware to build abilities using
createMongoAbility(MongoQuery matcher) instead of the v7Abilityexport (formerlyPureAbility). - Update JSDoc type references and document downstream upgrade steps in
MIGRATIONS.md.
Reviewed changes
Copilot reviewed 4 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| package.json | Bumps @casl/ability to ^7.0.0. |
| package-lock.json | Locks @casl/ability@7.0.0 and updated @ucast/* transitive dependencies. |
| MIGRATIONS.md | Adds downstream-facing migration notes and rationale for the CASL v7 change. |
| lib/middlewares/policy.js | Switches ability construction to createMongoAbility to restore MongoQuery condition matching. |
| lib/helpers/abilities.js | Updates JSDoc to reflect MongoAbility usage for serialized rules. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3696 +/- ##
=======================================
Coverage 89.70% 89.70%
=======================================
Files 142 142
Lines 4780 4780
Branches 1498 1498
=======================================
Hits 4288 4288
Misses 385 385
Partials 107 107
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@MIGRATIONS.md`:
- Around line 14-21: The fenced JavaScript example block around the
AbilityBuilder/Ability -> AbilityBuilder/createMongoAbility snippet lacks
surrounding blank lines and triggers MD031; fix by adding an empty line before
the opening ```js and an empty line after the closing ``` so the code block is
isolated, ensuring the examples showing AbilityBuilder, Ability, and
createMongoAbility are properly delimited and markdownlint stops flagging the
block.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1f1ad6d3-fa25-44c1-b96d-4ef18e3b29c2
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
MIGRATIONS.mdlib/helpers/abilities.jslib/middlewares/policy.jspackage.json
… note Review (Copilot): the policy unit-test mock did not export createMongoAbility nor assert the builder is seeded with it, so the #3693 auth regression could silently return. Mock createMongoAbility + assert new AbilityBuilder(createMongoAbility). Also corrects the MIGRATIONS wording: v7 renames PureAbility→Ability (the class isn't removed); only its default conditions matcher is dropped.
Summary
Migrates
@casl/ability^6.8.1→^7.0.0. Supersedes dependabot #3693 (which is red — the bare bump breaks authorization).Root cause
v7 renames
PureAbility→Abilityand drops the default conditions matcher; the historical MongoDB-matchingAbilityclass no longer exists. The policy builder didnew AbilityBuilder(Ability), so condition rules likecan('manage', 'Organization', { _id })stopped matching → authorization silently denied → endpoints returned 403/422.What changed
lib/middlewares/policy.js— build viacreateMongoAbilityinstead ofAbility(restores MongoQuery condition matching).Ability→MongoAbility(policy.js,lib/helpers/abilities.js).package.json—@casl/ability ^7.0.0.MIGRATIONS.md— downstream-complete upgrade notes.Module policy files are unchanged (they use
can/cannotclosures, never theAbilityclass). Serialized rule format is unchanged (createMongoAbilitykeeps the MongoQuery shape) → Node→client packing stays compatible.Test plan
npm run test:unit— 1498 passednpm run test:integration— passednpm run test:e2e— 9 passed (incl. the org permission test that returned 422 on build(deps): bump @casl/ability from 6.8.1 to 7.0.0 #3693, now 200)npm run lint— cleanSummary by CodeRabbit
Chores
@casl/abilitydependency to v7.0.0 with enhanced MongoDB-style ability handling.Documentation