// I did not use createMongoAbility or anything with the word Mongo in it, instead I used PureAbility
import {
 PureAbility,
 AbilityBuilder,
 ExtractSubjectType,
 InferSubjects,
 AbilityClass,
 MatchConditions,
} from '@casl/ability';
const Ability = PureAbility as AbilityClass<AppAbility>;
// I created a lambdaMatcher as this seemed to be the only way to check attributes (below)
const lambdaMatcher = (matchConditions: MatchConditions) => matchConditions;
type Subjects =
 | InferSubjects<typeof User | typeof Entity>
 | 'all';
export enum Action {
 MANAGE = 'manage',
 CREATE = 'create',
 READ = 'read',
 UPDATE = 'update',
 DESTROY = 'destroy',
}
@Injectable()
export class CaslAbilityFactory {
 createForUser(user: User | AccountUser) {
 const { can, cannot, build } = new AbilityBuilder(Ability);
 
 // Note: probably nicer to check user role here?
 if (user.isAdmin) {
 can(Action.READ, Entity, (e: Entity) => {
 // Return a boolean, note: `e` is an instance
 // Note I could not get it working as per the documentation with the object syntax 
 return e.account.id === user.account.id;
 });
 // Shorthand example
 can(Action.READ, Entity, (e: Entity) => e.userId === user.id);
 }
 return build({
 detectSubjectType: (item) =>
 item.constructor as ExtractSubjectType<Subjects>,
 // Add conditionsMatcher
 conditionsMatcher: lambdaMatcher,
 });
 }
}

export class EntityController {
 constructor(
 private readonly caslAbilityFactory: CaslAbilityFactory,
 ) {}
 
 @Get(':id')
 async findOne(@Param('id') id: string, @Req() req: RequestWithUser) {
 const ability = this.caslAbilityFactory.createForUser(req.user);
 const entity = await this.entitiesService.findOneById(id);
 // Note we pass in entity instance not Entity class
 if (ability.can(Action.READ, entity)) {
 // Authorized
 }
 }
}