Condition on Ability not working

[nsssayom]

I am using nest-casl library to implement authorization on my GraphQL API.

I set the permission as follows:

  // customers.permission.ts
  customer({ user, can }) {
    can(Actions.read, Customer, { id: user.id });
  }

And used the guard and ability as follows:

  // customers.service.ts
  @UseGuards(GqlAuthGuard, AccessGuard)
  @UseAbility(Actions.read, Customer)
  @Query(() => Customer, { name: 'getCustomerById' })
  async getCustomerById(
    @Args('id')
    id: string,
  ) {
    return await this.customersService.getCustomerById(id);
  }

But unfortunately, my customer can query other customers by their ID. This should not be happening, Can anyone help, please?

[liquidautumn]

you need to pull subject somehow, check https://github.com/getjerry/nest-casl#subject-hook for details