Can when fields are not specified

[Arcus16]

Hi, I have this rule for updating an Account

    can(Action.Update, Account, ['name'], {
        id: {
            $in: accountIds,
        },
    });

And it works as it should, for example

ability.can(Action.Update, account, 'name') // returns true 
ability.can(Action.Update, account, 'region') // returns false

What bothers me is when somebody does this:

ability.can(Action.Update, account) //  returns true

so I added this rule

    cannot(Action.Update, Account).because('Field must be specified');

and I thought that now the ability.can(Action.Update, account) would return false and ability.can(Action.Update, account, 'name') would still return true. But it doesn't work that way, so I want to ask is there some other approach to achieve this?

[stalniy]

What you want is flag/claim based permission checks. Let’s map what you did in casl to real world

If you have access to a room inside some building, do you then have access to the building itself? Yes because room is part of building and there is no way to enter room without accessing building.

This is how casl was designed and how it works.

Name is an attribute of Account, this is part of an Account, if you can update part of an Account it means you can update Account. Because when you update part of a whole, you update this whole. I believe it’s logical

If this is not desired, you have 2 options:

• use another library
• Don’t use attribute level checks

[Arcus16]

Thanks for the explanation! I thought this behavior was impossible, but I wanted to ask because I may have missed something in the documentation or misunderstood something. I am just adding a new feature to my application, and I need more granular rules, so far users can update anything on Account if accountId matched, now I need to allow only specific fields.
So, I have ability.can(Action.Update, account) on many places in my codebase, and I was wondering if it could work as I described I could prevent bugs caused by not specifying fields when checking user permissions.