How/when are conditions checked for non-idempotent mongo queries when using accessibleBy?

[robbie-accessearth]

When the code below is executed, are the conditions of the ability checked before the update is executed? I've been looking through the docs but I can't seem to find an answer.

can(Action.Update, UsersModel, {id: user.id})
...
const ability = abilityFactory.defineAbilityFor(user);
UsersModel.updateOne({id: user.id}, {someField: update}).accessibleBy(ability, Action.Update)

[stalniy]

if UsersModel is a mongoose.Model then it works as a filter, obviously before update ;)

it works the same way as SQL:

UPDATE users
SET ...
WHERE id =  ${user.id}