// CASL: JavaScript/TypeScript のポリシーライブラリ
// npm install @casl/ability
 
import {
  AbilityBuilder,
  createMongoAbility,
  MongoAbility,
  subject,
  ForbiddenError,
} from '@casl/ability';
 
// アクションとサブジェクトの型定義
type Actions = 'read' | 'create' | 'update' | 'delete' | 'publish' | 'manage';
type Subjects = 'Article' | 'User' | 'Comment' | 'Organization' | 'all';
type AppAbility = MongoAbility<[Actions, Subjects]>;
 
// ユーザー型
interface User {
  id: string;
  role: string;
  orgId: string;
  department?: string;
  permissions?: string[];
}
 
// ユーザーのロールに基づくAbility定義
function defineAbilityFor(user: User): AppAbility {
  const { can, cannot, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
  switch (user.role) {
    case 'super_admin':
      can('manage', 'all'); // 全権限
      break;
 
    case 'admin':
      can('manage', 'Article');
      can('read', 'User');
      can('create', 'User');
      can('update', 'User', { orgId: user.orgId }); // 同じ組織のみ
      cannot('delete', 'User'); // ユーザー削除は super_admin のみ
      can('manage', 'Comment');
      can('read', 'Organization', { id: user.orgId });
      can('update', 'Organization', { id: user.orgId });
      break;
 
    case 'editor':
      can('read', 'Article');
      can('create', 'Article');
      can('update', 'Article', { authorId: user.id }); // 自分の記事のみ
      can('delete', 'Article', { authorId: user.id }); // 自分の記事のみ
      can('read', 'Comment');
      can('create', 'Comment');
      can('update', 'Comment', { authorId: user.id });
      can('delete', 'Comment', { authorId: user.id });
      break;
 
    case 'viewer':
      can('read', 'Article', { status: 'published' }); // 公開記事のみ
      can('read', 'Comment');
      can('create', 'Comment');
      can('update', 'Comment', { authorId: user.id }); // 自分のコメントのみ
      can('delete', 'Comment', { authorId: user.id });
      break;
  }
 
  return build();
}
 
// 使用例
const ability = defineAbilityFor({ id: 'user_1', role: 'editor', orgId: 'org_1' });
 
ability.can('read', 'Article');    // true
ability.can('create', 'Article');  // true
ability.can('update', subject('Article', { authorId: 'user_1' })); // true（自分の記事）
ability.can('update', subject('Article', { authorId: 'user_2' })); // false（他人の記事）
ability.can('publish', 'Article'); // false（editor には publish 権限なし）

// CASL の MongoDB 互換条件構文
function defineAdvancedAbility(user: User): AppAbility {
  const { can, cannot, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
  // $eq: 等値比較（デフォルト）
  can('read', 'Article', { status: 'published' });
 
  // $ne: 否定
  can('update', 'Article', { status: { $ne: 'archived' } });
 
  // $in: 配列内のいずれかに一致
  can('read', 'Article', { category: { $in: ['tech', 'science'] } });
 
  // $nin: 配列内のいずれにも一致しない
  can('read', 'Article', { sensitivity: { $nin: ['confidential', 'top_secret'] } });
 
  // $gt, $gte, $lt, $lte: 比較演算
  can('read', 'Article', { priority: { $gte: 1, $lte: 5 } });
 
  // $exists: フィールドの存在チェック
  can('read', 'Article', { deletedAt: { $exists: false } });
 
  // $regex: 正規表現マッチ
  can('read', 'Article', { title: { $regex: /^公開/ } });
 
  // $all: 配列の全要素を含む
  can('read', 'Article', { tags: { $all: ['approved', 'reviewed'] } });
 
  // $elemMatch: 配列要素の条件
  can('read', 'Article', {
    collaborators: { $elemMatch: { userId: user.id, role: 'editor' } },
  });
 
  // 複数条件の組み合わせ（AND）
  can('update', 'Article', {
    authorId: user.id,
    status: { $ne: 'archived' },
    orgId: user.orgId,
  });
 
  // cannot で明示的に拒否（can よりも優先）
  cannot('delete', 'Article', { status: 'published' });
 
  return build();
}

import { createMongoAbility, MongoAbility, AbilityBuilder } from '@casl/ability';
import { buildMongoQueryMatcher } from '@casl/ability/extra';
 
// カスタム演算子: $today（今日かどうか）
const customConditionsMatcher = buildMongoQueryMatcher({
  $today: (value: boolean, fieldValue: Date) => {
    const today = new Date();
    today.setHours(0, 0, 0, 0);
    const tomorrow = new Date(today);
    tomorrow.setDate(tomorrow.getDate() + 1);
    const isToday = fieldValue >= today && fieldValue < tomorrow;
    return value ? isToday : !isToday;
  },
  $withinHours: (hours: number, fieldValue: Date) => {
    const cutoff = new Date(Date.now() - hours * 60 * 60 * 1000);
    return fieldValue >= cutoff;
  },
});
 
// カスタムマッチャーを使った Ability
const ability = createMongoAbility<[Actions, Subjects]>(
  [
    {
      action: 'update',
      subject: 'Article',
      conditions: { createdAt: { $withinHours: 24 } }, // 作成24時間以内のみ編集可
    },
    {
      action: 'delete',
      subject: 'Comment',
      conditions: { createdAt: { $today: true } }, // 今日作成したコメントのみ削除可
    },
  ],
  { conditionsMatcher: customConditionsMatcher }
);

// CASL + Express ミドルウェア
import { ForbiddenError, subject } from '@casl/ability';
 
// 汎用権限チェックミドルウェア
function authorize(action: Actions, subjectType: Subjects) {
  return async (req: Request, res: Response, next: NextFunction) => {
    const ability = defineAbilityFor(req.user);
 
    try {
      // サブジェクトタイプのみのチェック（条件なし）
      ForbiddenError.from(ability).throwUnlessCan(action, subjectType);
      next();
    } catch (error) {
      if (error instanceof ForbiddenError) {
        return res.status(403).json({
          error: 'Forbidden',
          message: `Cannot ${error.action} ${error.subjectType}`,
          reason: error.message,
        });
      }
      next(error);
    }
  };
}
 
// リソースベースの権限チェック（属性付き）
function authorizeResource<T>(
  action: Actions,
  subjectType: Subjects,
  getResource: (req: Request) => Promise<T | null>
) {
  return async (req: Request, res: Response, next: NextFunction) => {
    const ability = defineAbilityFor(req.user);
 
    // リソースの取得
    const resource = await getResource(req);
    if (!resource) {
      return res.status(404).json({ error: 'Resource not found' });
    }
 
    try {
      // 属性ベースのチェック
      ForbiddenError.from(ability).throwUnlessCan(
        action,
        subject(subjectType, resource as Record<string, unknown>)
      );
      (req as any).resource = resource;
      next();
    } catch (error) {
      if (error instanceof ForbiddenError) {
        return res.status(403).json({
          error: 'Forbidden',
          message: `Cannot ${error.action} ${error.subjectType}`,
        });
      }
      next(error);
    }
  };
}
 
// 記事の更新API
app.put(
  '/api/articles/:id',
  authorizeResource('update', 'Article', async (req) =>
    prisma.article.findUnique({ where: { id: req.params.id } })
  ),
  async (req, res) => {
    const article = (req as any).resource;
 
    const updated = await prisma.article.update({
      where: { id: req.params.id },
      data: req.body,
    });
 
    res.json(updated);
  }
);
 
// 記事一覧API（ポリシーに基づくフィルタリング）
app.get('/api/articles', async (req, res) => {
  const ability = defineAbilityFor(req.user);
 
  // CASL のルールから Prisma の where 条件を構築
  const articles = await prisma.article.findMany({
    where: accessibleBy(ability, 'read').Article,
    orderBy: { createdAt: 'desc' },
    take: 20,
  });
 
  res.json(articles);
});
 
// グローバルエラーハンドラー
app.use((error: Error, req: Request, res: Response, next: NextFunction) => {
  if (error instanceof ForbiddenError) {
    return res.status(403).json({
      error: 'Forbidden',
      message: `Cannot ${error.action} ${error.subjectType}`,
    });
  }
  next(error);
});

// npm install @casl/prisma
import { accessibleBy } from '@casl/prisma';
 
// CASL のルールから Prisma の where 条件を自動生成
async function getAccessibleArticles(user: User) {
  const ability = defineAbilityFor(user);
 
  // ability の 'read' ルールから where 条件を自動構築
  // editor の場合:
  //   can('read', 'Article')
  //   → where: {} （制限なし）
  //
  // viewer の場合:
  //   can('read', 'Article', { status: 'published' })
  //   → where: { status: 'published' }
  const articles = await prisma.article.findMany({
    where: accessibleBy(ability, 'read').Article,
  });
 
  return articles;
}
 
// 更新可能な記事のみ取得
async function getEditableArticles(user: User) {
  const ability = defineAbilityFor(user);
 
  // editor: can('update', 'Article', { authorId: user.id })
  // → where: { authorId: user.id }
  const articles = await prisma.article.findMany({
    where: accessibleBy(ability, 'update').Article,
  });
 
  return articles;
}
 
// 安全な更新（権限チェック + データ取得を統合）
async function safeUpdateArticle(user: User, articleId: string, data: any) {
  const ability = defineAbilityFor(user);
 
  // accessibleBy で権限のある記事のみを対象にする
  const article = await prisma.article.findFirst({
    where: {
      id: articleId,
      ...accessibleBy(ability, 'update').Article,
    },
  });
 
  if (!article) {
    throw new Error('Article not found or no permission');
  }
 
  return prisma.article.update({
    where: { id: articleId },
    data,
  });
}

// React + CASL
import { createContext, useContext, useMemo } from 'react';
import { createContextualCan } from '@casl/react';
import { createMongoAbility, MongoAbility } from '@casl/ability';
 
// Ability コンテキスト
const AbilityContext = createContext<AppAbility>(undefined!);
const Can = createContextualCan(AbilityContext.Consumer);
 
// プロバイダー
function AbilityProvider({ children }: { children: React.ReactNode }) {
  const { data: user } = useUser();
  const ability = useMemo(() => {
    if (!user) return createMongoAbility<[Actions, Subjects]>([]);
    return defineAbilityFor(user);
  }, [user]);
 
  return (
    <AbilityContext.Provider value={ability}>
      {children}
    </AbilityContext.Provider>
  );
}
 
// Can コンポーネントで UI を条件表示
function ArticleActions({ article }: { article: Article }) {
  return (
    <div className="flex gap-2">
      <Can I="read" this={subject('Article', article)}>
        <button>View</button>
      </Can>
 
      <Can I="update" this={subject('Article', article)}>
        <button>Edit</button>
      </Can>
 
      <Can I="delete" this={subject('Article', article)}>
        <button className="text-red-500">Delete</button>
      </Can>
 
      <Can I="publish" a="Article">
        <button className="text-green-500">Publish</button>
      </Can>
 
      {/* not プロパティで否定条件 */}
      <Can not I="update" this={subject('Article', article)}>
        <span className="text-gray-400">編集権限なし</span>
      </Can>
    </div>
  );
}
 
// フック
function useAbility() {
  return useContext(AbilityContext);
}
 
// useAbility フックを使った条件分岐
function ArticlePage({ article }: { article: Article }) {
  const ability = useAbility();
 
  if (ability.cannot('read', subject('Article', article))) {
    return <div>この記事を閲覧する権限がありません</div>;
  }
 
  return (
    <div>
      <ArticleContent article={article} />
      {ability.can('update', subject('Article', article)) && (
        <EditButton articleId={article.id} />
      )}
    </div>
  );
}

// バックエンド: ポリシールールを API で公開
// GET /api/auth/permissions
app.get('/api/auth/permissions', async (req, res) => {
  const ability = defineAbilityFor(req.user);
 
  // CASL のルールを JSON シリアライズ可能な形式で返す
  res.json({
    rules: ability.rules,
  });
});
 
// フロントエンド: サーバーのルールで Ability を再構築
import { createMongoAbility } from '@casl/ability';
import { unpackRules } from '@casl/ability/extra';
 
function useServerAbility() {
  const { data, error } = useSWR('/api/auth/permissions', fetcher);
 
  const ability = useMemo(() => {
    if (!data?.rules) {
      return createMongoAbility<[Actions, Subjects]>([]);
    }
 
    return createMongoAbility<[Actions, Subjects]>(data.rules);
  }, [data]);
 
  return { ability, isLoading: !data && !error };
}
 
// Ability の更新を検知して再レンダリング
function useAbilityUpdate(ability: AppAbility) {
  const [, forceUpdate] = useState(0);
 
  useEffect(() => {
    // ability.rules が変更されたら再レンダリング
    const unsubscribe = ability.on('updated', () => {
      forceUpdate((n) => n + 1);
    });
 
    return () => unsubscribe();
  }, [ability]);
}

// 承認フローを ABAC で実装
interface WorkflowStage {
  status: string;
  allowedActions: Record<string, string[]>; // ロール → 許可アクション
}
 
const articleWorkflow: WorkflowStage[] = [
  {
    status: 'draft',
    allowedActions: {
      author: ['read', 'update', 'delete', 'submit'],
      editor: ['read'],
      admin: ['read', 'update', 'delete'],
    },
  },
  {
    status: 'review',
    allowedActions: {
      author: ['read'],
      editor: ['read', 'approve', 'reject'],
      admin: ['read', 'approve', 'reject', 'update'],
    },
  },
  {
    status: 'approved',
    allowedActions: {
      author: ['read'],
      editor: ['read', 'publish'],
      admin: ['read', 'publish', 'update', 'reject'],
    },
  },
  {
    status: 'published',
    allowedActions: {
      author: ['read'],
      editor: ['read'],
      admin: ['read', 'update', 'unpublish', 'archive'],
    },
  },
];
 
// ワークフロー対応の Ability 定義
function defineWorkflowAbility(user: User, article: Article): AppAbility {
  const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
  const stage = articleWorkflow.find((s) => s.status === article.status);
  if (!stage) return build();
 
  // ロールに基づく権限
  const roleActions = stage.allowedActions[user.role] || [];
  for (const action of roleActions) {
    can(action as Actions, 'Article', { id: article.id });
  }
 
  // 作者の場合の追加権限
  if (article.authorId === user.id) {
    const authorActions = stage.allowedActions['author'] || [];
    for (const action of authorActions) {
      can(action as Actions, 'Article', { id: article.id });
    }
  }
 
  return build();
}

// 環境情報を含むポリシー定義
interface EnvironmentContext {
  time: Date;
  ipAddress: string;
  userAgent: string;
  isMfaVerified: boolean;
  riskScore: number;
  networkType: 'corporate' | 'vpn' | 'public';
}
 
function defineAbilityWithEnvironment(
  user: User,
  env: EnvironmentContext
): AppAbility {
  const { can, cannot, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
  // 基本的な読み取り権限
  can('read', 'Article', { orgId: user.orgId });
 
  // 営業時間内のみデータエクスポートを許可
  const hour = env.time.getHours();
  const isBusinessHours = hour >= 9 && hour < 18;
  const isWeekday = env.time.getDay() >= 1 && env.time.getDay() <= 5;
 
  if (isBusinessHours && isWeekday) {
    can('export', 'Article' as any, { orgId: user.orgId });
  }
 
  // 社内ネットワークからのみ機密データへのアクセスを許可
  if (env.networkType === 'corporate' || env.networkType === 'vpn') {
    can('read', 'Article', { classification: 'confidential', orgId: user.orgId });
  }
 
  // MFA 認証済みの場合のみ管理操作を許可
  if (env.isMfaVerified) {
    can('update', 'User', { orgId: user.orgId });
    can('delete', 'Article', { authorId: user.id });
  }
 
  // 高リスクスコアの場合は機密操作を拒否
  if (env.riskScore > 70) {
    cannot('export', 'Article' as any);
    cannot('delete', 'Article');
    cannot('update', 'User');
  }
 
  return build();
}
 
// 環境情報の取得
function getEnvironmentContext(req: Request): EnvironmentContext {
  return {
    time: new Date(),
    ipAddress: getClientIP(req),
    userAgent: req.headers.get('user-agent') || '',
    isMfaVerified: req.session?.mfaVerified ?? false,
    riskScore: calculateRiskScore(req),
    networkType: classifyNetwork(getClientIP(req)),
  };
}

// ポリシーのテスト
import { describe, it, expect } from 'vitest';
import { subject } from '@casl/ability';
 
describe('Editor permissions', () => {
  const ability = defineAbilityFor({
    id: 'user_1',
    role: 'editor',
    orgId: 'org_1',
  });
 
  it('can read articles', () => {
    expect(ability.can('read', 'Article')).toBe(true);
  });
 
  it('can create articles', () => {
    expect(ability.can('create', 'Article')).toBe(true);
  });
 
  it('can update own articles', () => {
    expect(
      ability.can('update', subject('Article', { authorId: 'user_1' }))
    ).toBe(true);
  });
 
  it('cannot update others articles', () => {
    expect(
      ability.can('update', subject('Article', { authorId: 'user_2' }))
    ).toBe(false);
  });
 
  it('cannot publish articles', () => {
    expect(ability.can('publish', 'Article')).toBe(false);
  });
 
  it('cannot manage users', () => {
    expect(ability.can('update', 'User')).toBe(false);
  });
 
  it('can manage own comments', () => {
    expect(
      ability.can('update', subject('Comment', { authorId: 'user_1' }))
    ).toBe(true);
    expect(
      ability.can('delete', subject('Comment', { authorId: 'user_1' }))
    ).toBe(true);
  });
 
  it('cannot manage others comments', () => {
    expect(
      ability.can('update', subject('Comment', { authorId: 'user_2' }))
    ).toBe(false);
  });
});
 
describe('Viewer permissions', () => {
  const ability = defineAbilityFor({
    id: 'user_2',
    role: 'viewer',
    orgId: 'org_1',
  });
 
  it('can only read published articles', () => {
    expect(
      ability.can('read', subject('Article', { status: 'published' }))
    ).toBe(true);
    expect(
      ability.can('read', subject('Article', { status: 'draft' }))
    ).toBe(false);
  });
 
  it('cannot create articles', () => {
    expect(ability.can('create', 'Article')).toBe(false);
  });
});
 
describe('Admin permissions', () => {
  const ability = defineAbilityFor({
    id: 'admin_1',
    role: 'admin',
    orgId: 'org_1',
  });
 
  it('can manage articles', () => {
    expect(ability.can('manage', 'Article')).toBe(true);
  });
 
  it('can update users in same org', () => {
    expect(
      ability.can('update', subject('User', { orgId: 'org_1' }))
    ).toBe(true);
  });
 
  it('cannot update users in different org', () => {
    expect(
      ability.can('update', subject('User', { orgId: 'org_2' }))
    ).toBe(false);
  });
 
  it('cannot delete users', () => {
    expect(ability.can('delete', 'User')).toBe(false);
  });
});
 
describe('Super admin permissions', () => {
  const ability = defineAbilityFor({
    id: 'super_1',
    role: 'super_admin',
    orgId: 'org_1',
  });
 
  it('can manage everything', () => {
    expect(ability.can('manage', 'all')).toBe(true);
    expect(ability.can('delete', 'User')).toBe(true);
    expect(ability.can('update', subject('User', { orgId: 'org_99' }))).toBe(true);
  });
});

// ポリシーマトリクステスト — 全ロール x 全アクション の組み合わせを検証
describe('Permission matrix', () => {
  type PermissionMatrix = {
    [role: string]: {
      [action: string]: {
        [subject: string]: boolean | 'conditional';
      };
    };
  };
 
  const expectedMatrix: PermissionMatrix = {
    super_admin: {
      manage: { all: true },
    },
    admin: {
      read: { Article: true, User: true, Comment: true, Organization: 'conditional' },
      create: { Article: true, User: true, Comment: true },
      update: { Article: true, User: 'conditional', Comment: true, Organization: 'conditional' },
      delete: { Article: true, User: false, Comment: true },
      publish: { Article: true },
    },
    editor: {
      read: { Article: true, User: false, Comment: true },
      create: { Article: true, Comment: true },
      update: { Article: 'conditional', Comment: 'conditional' },
      delete: { Article: 'conditional', Comment: 'conditional' },
      publish: { Article: false },
    },
    viewer: {
      read: { Article: 'conditional', Comment: true },
      create: { Article: false, Comment: true },
      update: { Article: false, Comment: 'conditional' },
      delete: { Article: false },
    },
  };
 
  for (const [role, actions] of Object.entries(expectedMatrix)) {
    describe(`${role} role`, () => {
      const ability = defineAbilityFor({
        id: `${role}_user`,
        role,
        orgId: 'org_1',
      });
 
      for (const [action, subjects] of Object.entries(actions)) {
        for (const [subjectType, expected] of Object.entries(subjects)) {
          if (expected === true) {
            it(`can ${action} ${subjectType}`, () => {
              expect(ability.can(action as Actions, subjectType as Subjects)).toBe(true);
            });
          } else if (expected === false) {
            it(`cannot ${action} ${subjectType}`, () => {
              expect(ability.can(action as Actions, subjectType as Subjects)).toBe(false);
            });
          }
          // 'conditional' は個別テストで検証
        }
      }
    });
  }
});

// ハイブリッドアクセス制御の完全な実装例
 
// 第1層: RBAC ミドルウェア
function requireRole(...allowedRoles: string[]) {
  return (req: Request, res: Response, next: NextFunction) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    if (!allowedRoles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Insufficient role' });
    }
    next();
  };
}
 
// 第2層: ABAC サービス
class ArticleService {
  async update(user: User, articleId: string, data: UpdateArticleInput) {
    const ability = defineAbilityFor(user);
    const article = await prisma.article.findUnique({ where: { id: articleId } });
 
    if (!article) throw new NotFoundError('Article not found');
 
    // ABAC チェック
    ForbiddenError.from(ability).throwUnlessCan(
      'update',
      subject('Article', article)
    );
 
    // 第3層: ビジネスルール
    if (article.status === 'published' && !user.permissions?.includes('edit_published')) {
      throw new BusinessRuleError('Published articles require special permission to edit');
    }
 
    return prisma.article.update({ where: { id: articleId }, data });
  }
}
 
// API ルート（3層を組み合わせ）
app.put(
  '/api/articles/:id',
  requireRole('editor', 'admin', 'super_admin'),  // 第1層: RBAC
  async (req, res, next) => {
    try {
      const result = await articleService.update(  // 第2層 + 第3層
        req.user,
        req.params.id,
        req.body
      );
      res.json(result);
    } catch (error) {
      next(error);
    }
  }
);

// ABAC アクセス制御の監査ログ
interface AuditLogEntry {
  timestamp: Date;
  userId: string;
  action: string;
  resourceType: string;
  resourceId: string;
  decision: 'allow' | 'deny';
  reason?: string;
  attributes: {
    subject: Record<string, any>;
    resource: Record<string, any>;
    environment: Record<string, any>;
  };
  ipAddress: string;
  userAgent: string;
}
 
class AuditLogger {
  async log(entry: AuditLogEntry) {
    // 構造化ログとして出力
    console.log(JSON.stringify({
      level: entry.decision === 'deny' ? 'warn' : 'info',
      message: `ABAC ${entry.decision}: ${entry.userId} ${entry.action} ${entry.resourceType}/${entry.resourceId}`,
      ...entry,
    }));
 
    // DB に永続化
    await prisma.auditLog.create({
      data: {
        timestamp: entry.timestamp,
        userId: entry.userId,
        action: entry.action,
        resourceType: entry.resourceType,
        resourceId: entry.resourceId,
        decision: entry.decision,
        reason: entry.reason,
        metadata: entry.attributes,
        ipAddress: entry.ipAddress,
        userAgent: entry.userAgent,
      },
    });
  }
}
 
// 監査付き権限チェック
async function authorizeWithAudit(
  user: User,
  action: Actions,
  resourceType: Subjects,
  resource: Record<string, any>,
  req: Request
): Promise<boolean> {
  const ability = defineAbilityFor(user);
  const allowed = ability.can(action, subject(resourceType, resource));
 
  await auditLogger.log({
    timestamp: new Date(),
    userId: user.id,
    action,
    resourceType,
    resourceId: resource.id,
    decision: allowed ? 'allow' : 'deny',
    attributes: {
      subject: { id: user.id, role: user.role, orgId: user.orgId },
      resource: { id: resource.id, authorId: resource.authorId, status: resource.status },
      environment: { time: new Date().toISOString(), ip: getClientIP(req) },
    },
    ipAddress: getClientIP(req),
    userAgent: req.headers.get('user-agent') || '',
  });
 
  return allowed;
}

// ✗ エラーが出る
ability.can('update', { authorId: 'user_1' }); // subject type が不明
 
// ✓ 正しい方法
import { subject } from '@casl/ability';
ability.can('update', subject('Article', { authorId: 'user_1' }));

// ✗ 意図しない動作
can('read', 'Article');                          // 全記事を読める
can('read', 'Article', { status: 'published' }); // これは上のルールに追加されるだけ
 
// ✓ 正しいアプローチ（deny-first）
can('read', 'Article', { status: 'published' }); // まず限定的なルール
// admin の場合のみ全記事
if (user.role === 'admin') {
  can('read', 'Article'); // 条件なしで全許可
}

// サポートされている条件
can('read', 'Article', { status: 'published' });        // ✓
can('read', 'Article', { status: { $ne: 'archived' } }); // ✓
can('read', 'Article', { status: { $in: ['a', 'b'] } }); // ✓
 
// サポートされていない可能性のある条件
can('read', 'Article', { tags: { $all: ['a', 'b'] } });  // △
can('read', 'Article', { title: { $regex: /^test/ } });   // ✗