Open xitanggg opened 4 years ago
Hello @xitanggg currently if you introduce a field rule it will override the object rule. To ensure that the owner can also read userId you would need to add that rule in the field as well. This is a part of some optimizations we are considering for @auth
.
Thanks for your response. @SwaySway So with my example, I expect the field rule userId
of the owner
to only override the object rule of the owner
, but it seems to remove the object rule of the groups
as well.
Describe the bug I create a schema for
account
, which storesuserId
,fullName
,email
.At the
account
level, I givesAdmins Group
full CRUD permissioniam
service full CRUD permissionOwner
him/herself RU permission (so owner can changefullName
andemail
)At the
userId
field, I givesOwner
him/herself R permission (I don't want owner to be able to change/update itsuserId
for obvious reason)Expected behavior I expect Cognito
Admins Group
and AWSiam
service have full CRUD permission in user accounts.Actual behavior AWS
iam
service has full CRUD permission in user accounts, but CognitoAdmins Group
don't. CognitoAdmins Group
isn't able to readuserId
on alistAccounts
query.To enable it, I have to re-specify Cognito
Admin Group
permission atuserId
.I suspect this to be a minor bug in the resolver logic.