How do you implement ABAC with CASL in a NestJS application?

Q: How do you implement ABAC with CASL in a NestJS application?

// npm i @casl/ability import { defineAbility, AbilityBuilder, createMongoAbility } from '@casl/ability'; // AbilityFactory — builds abilities per user @Injectable() export class AbilityFactory { createForUser(user: User) { const { can, cannot, build } = new AbilityBuilder(createMongoAbility); if (user.roles.includes('admin')) { can('manage', 'all'); // full access } else { can('read', 'Article'); can('update', 'Article', { authorId: user.id }); // own articles only cannot('delete', 'Article'); } return build(); } } // @CheckPolicies() decorator export type PolicyHandler = (ability: AppAbility) => boolean; export const CheckPolicies = (...handlers: PolicyHandler[]) => SetMetadata('policies', handlers); // PoliciesGuard @Injectable() export class PoliciesGuard implements CanActivate { constructor( private reflector: Reflector, private abilityFactory: AbilityFactory, ) {} async canActivate(ctx: ExecutionContext): Promise { const policies = this.reflector.get ('policies', ctx.getHandler()); if (!policies?.length) return true; const { user } = ctx.switchToHttp().getRequest(); const ability = this.abilityFactory.createForUser(user); return policies.every(handler => handler(ability)); } } // Usage @CheckPolicies(ability => ability.can('delete', 'Article')) @Delete(':id') remove(@Param('id', ParseIntPipe) id: number) {} AbilityFactory is REQUEST-scoped if abilities depend on database state — singleton if based only on JWT claims. can('update', 'Article', { authorId: user.id }) — conditional rule using subject field matching. subject('Article', articleInstance) — wraps a plain object so CASL can match field conditions against it. policies.every() — all policies must pass; use policies.some() for OR semantics. Combine PoliciesGuard with JwtAuthGuard — run auth first so req.user is always available.

Difficulty: 7/10

ABAC, CASL integration, NestJS guards

Create an AbilityFactory service that builds a CASL ability for the current user based on their roles and attributes. Build a PoliciesGuard that reads policy handlers from route metadata via @CheckPolicies() and evaluates each against the user's ability. Policy handlers are functions that call ability.can() on specific actions and subjects.

AbilityFactory, PoliciesGuard, and @CheckPolicies() decorator

CASL ABAC implementation notes:

How do you implement ABAC with CASL in a NestJS application?

Difficulty: 7/10

ABAC, CASL integration, NestJS guards

Create an AbilityFactory service that builds a CASL ability for the current user based on their roles and attributes. Build a PoliciesGuard that reads policy handlers from route metadata via @CheckPolicies() and evaluates each against the user's ability. Policy handlers are functions that call ability.can() on specific actions and subjects.

AbilityFactory, PoliciesGuard, and @CheckPolicies() decorator

CASL ABAC implementation notes:

How do you implement ABAC with CASL in a NestJS application?

How do you implement ABAC with CASL in a NestJS application?

Scenario Questions

Follow-up Questions