slim $select instead of hide/restore $select about feathers-casl HOT 2 CLOSED

Hiding $select in before hooks and restoring it in after hooks makes it so the authorize hook needs to be placed last in before hooks and first in after hooks. One obvious downside to this is that you can't simply add the authorize hook as an app level before all hook.

When migrating my app to feathers-casl, this caused an issue. My current CASL implementation tries to authenticate and authorize every external request in a before all hook. However, needing to move my authorize hook to right before each method call means that all my validation hooks are running before authorization. This means that users that shouldn't have access to a resource would be getting validation errors instead of authorization errors. I think authorization should be one of the first things checked and should be able to fail fast. If a user doesn't have access to a resource, they should always get a Forbidden error.

This is another example/use case where not needing to hide/restore $select would be advantageous.

I spoke with @fratzinger about this outside of GitHub, and he mentioned another potential solution to the issue I'm experiencing: adding a lightweight version of the authorize hook that doesn't need to hide/restore $select, could be used in any hook, but would not work for field level validations (since the reason for the $select stuff is to handle field level validations). This might deserve to be its own issue, but @fratzinger, would this solution you're talking about here potentially fix my issue too?

from feathers-casl.

released as preversion v0.5.1-0 (#28)

from feathers-casl.