1
export enum Action {
2
  MANAGE = "manage",
3
  CREATE = "create",
4
  READ = "read",
5
  UPDATE = "update",
6
  DELETE = "delete",
7
}
8

9
export enum Subject {
10
  ALL = "all",
11
  USER = "User",
12
  ROLE = "Role",
13
  PERMISSION = "Permission",
14
  LOGS = "Logs",
15
}

1
@Injectable()
2
export class CaslAbilityFactory {
3
  createForUser(user: User) {
4
    const { can, cannot, build } = new AbilityBuilder<AppAbility>(
5
      createMongoAbility,
6
    );
7

8
    user.roles?.forEach((role) => {
9
      role.permissions?.forEach((permission) => {
10
        let conditions = permission.conditions;
11

12
        // 核心逻辑：利用正则替换处理静态 JSON
13
        if (conditions) {
14
          const conditionsStr = JSON.stringify(conditions);
15
          const replaced = conditionsStr.replace(
16
            /"\$\{user\.id\}"/g,
17
            user.id.toString(), // 将占位符替换为真实的登录用户 ID
18
          );
19
          conditions = JSON.parse(replaced);
20
        }
21

22
        if (permission.inverted) {
23
          cannot(permission.action, permission.subject, conditions);
24
        } else {
25
          can(permission.action, permission.subject, conditions);
26
        }
27
      });
28
    });
29

30
    return build({
31
      detectSubjectType: (item) =>
32
        typeof item === "string" ? item : (item.constructor.name as any),
33
    });
34
  }
35
}

1
const detectAppSubjectType = (item: any): SubjectType => {
2
  if (typeof item === "string") return item as SubjectType;
3

4
  // 如果对象包含 __typename 属性，按该类型判定
5
  if (item?.__typename) return item.__typename as SubjectType;
6

7
  return (item.constructor?.name || item.constructor) as SubjectType;
8
};
9

10
const defaultAbility = createMongoAbility([], {
11
  detectSubjectType: detectAppSubjectType,
12
});

1
import { subject } from '@casl/ability';
2
import { Action, Subject } from '@nestjs-learning/shared';
3
import { Can } from '@/components/Can';
4

5
// ... 在 Ant Design 的 Table columns render 函数中
6
render: (_, record) => (
7
  <Space>
8
    {/* 结合具体的 record 和数据库配置的 conditions 进行校验 */}
9
    <Can I={Action.UPDATE} a={subject(Subject.USER, record)}>
10
      <Button type="link" onClick={() => handleEdit(record)}>
11
        编辑
12
      </Button>
13
    </Can>
14

15
    <Can I={Action.DELETE} a={subject(Subject.USER, record)}>
16
      <Button type="link" danger onClick={() => handleDelete(record.id)}>
17
        删除
18
      </Button>
19
    </Can>
20
  </Space>
21
),

1
import { ReactNode } from "react";
2
import { Navigate } from "react-router-dom";
3
import { Action, Subject } from "@nestjs-learning/shared";
4
import { useAuthStore } from "@/stores/useAuthStore";
5

6
interface PolicyGuardProps {
7
  action: Action;
8
  subject: Subject;
9
  children: ReactNode;
10
}
11

12
export const PolicyGuard = ({
13
  action,
14
  subject,
15
  children,
16
}: PolicyGuardProps) => {
17
  const { ability } = useAuthStore();
18

19
  if (ability.can(action, subject)) {
20
    return <>{children}</>;
21
  }
22

23
  // 无权访问时重定向至 403 页面
24
  return <Navigate to="/403" replace />;
25
};

1
{
2
  path: '/users',
3
  element: (
4
    <PolicyGuard action={Action.MANAGE} subject={Subject.USER}>
5
      <UserManagement />
6
    </PolicyGuard>
7
  ),
8
}

1
// 查询包含 Role 和 Permission 的完整用户实体
2
const user = await this.userService.findUserProfile(jwtUser.id);
3
const ability = this.caslAbilityFactory.createForUser(user);

1
import { Action, Subject } from "@nestjs-learning/shared";
2

3
async function seed() {
4
  // 1. 获取或创建 ADMIN 角色
5
  const adminRole = await roleRepository.findOne({ where: { name: "ADMIN" } });
6

7
  // 2. 注入核心管理权限（ROOT 访问权限）
8
  const rootPermission = permissionRepository.create({
9
    name: "ROOT_ACCESS",
10
    action: Action.MANAGE,
11
    subject: Subject.ALL,
12
    conditions: null,
13
  });
14

15
  const savedPermission = await permissionRepository.save(rootPermission);
16

17
  // 3. 将权限关联至角色
18
  adminRole.permissions = [savedPermission];
19
  await roleRepository.save(adminRole);
20
}