GraphQL Schema Transform Minor Bug in Resolver Logic

[xitanggg]

Describe the bug I create a schema for account, which stores userId, fullName, email.

At the account level, I gives

• Cognito Admins Group full CRUD permission
• AWS iam service full CRUD permission
• Owner him/herself RU permission (so owner can change fullName and email)

At the userId field, I gives

• Owner him/herself R permission (I don't want owner to be able to change/update its userId for obvious reason)

type account
    @model(subscriptions: null)
    @key(fields: ["userId"])
    @auth(
        rules: [
            {
                allow: groups
                groups: ["Admins"]
                operations: [create, read, update, delete]
            }
            {
                allow: private
                provider: iam
                operations: [create, read, update, delete]
            }
            { allow: owner, ownerField: "userId", operations: [read, update] }
        ]
    ) {
    userId: String!
        @auth(
            rules: [
                { allow: owner, ownerField: "userId", operations: [read] }
            ]
        )
    fullName: String
    email: String
}

Expected behavior I expect Cognito Admins Group and AWS iam service have full CRUD permission in user accounts.

Actual behavior AWS iam service has full CRUD permission in user accounts, but Cognito Admins Group don't. Cognito Admins Group isn't able to read userId on a listAccounts query.

To enable it, I have to re-specify Cognito Admin Group permission at userId.

userId: String!
        @auth(
            rules: [
                {
                    allow: groups
                    groups: ["Admins"]
                    operations: [create, read, update, delete]
                }
                { allow: owner, ownerField: "userId", operations: [read] }
            ]
        )

I suspect this to be a minor bug in the resolver logic.

[SwaySway]

Hello @xitanggg currently if you introduce a field rule it will override the object rule. To ensure that the owner can also read userId you would need to add that rule in the field as well. This is a part of some optimizations we are considering for @auth.

[xitanggg]

Thanks for your response. @SwaySway So with my example, I expect the field rule userId of the owner to only override the object rule of the owner, but it seems to remove the object rule of the groups as well.