paulsson
commented
3 years ago @mrsimply @ronaldocpontes I'll try to keep this example as simple as possible. It took me quite a while to come up with this and wrap my head around...
Hypothetical data resource types and relationships: Users are assigned to a Business (employee of) A Business has 1 or more Locations A User can also be assigned to 1 or more Locations of the Business (many-to-many relationship not shown in below schema)
Now let's say there are 2 types of roles for a user:
- Business admin (can administer the Business record and ALL Locations belonging to the Business)
- Location admin (can read/update the Locations that the user is assigned to within the Business)
schema.graphql
type Business
@model
@auth(rules: [
# grants "root" admins CRUD operations on all Businesses
{ allow: groups, groups: ["Admin"], operations: [create, read, update, delete] }
# grants Business admins read, update operations if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "id", operations: [read, update] }
# grants Location admins read access if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "id", groupClaim: "locationAdmin", operations: [read] }
]) {
id: ID!
name: String!
locations: [Location] @connection(keyName: "byBusiness", fields: ["id"])
}
type Location
@model
@auth(rules: [
# grants "root" admins CRUD operations on all Locations
{ allow: groups, groups: ["Admin"], operations: [create, read, update, delete] }
# grants Business admins create, read, update operations if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "businessID", operations: [create, read, update] }
# grants Location admins read, update access if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "id", operations: [read, update] }
])
@key(name: "byBusiness", fields: ["businessID", "name"]) {
id: ID!
businessID: ID!
name: String!
}
type User
@model
@auth(rules: [
# grants "root" admins CRUD operations on all Users
{ allow: groups, groups: ["Admin"], operations: [create, read, update, delete] }
# allow the User to read, update their own User record
{ allow: owner, ownerField: "id", operations: [read, update]
# grants Business admins create, read, update operations if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "businessID", operations: [create, read, update] }
# grants Location admins read access if the calling user is an employee of (assigned to) the Business
{ allow: groups, groupsField: "businessID", groupClaim: "locationAdmin", operations: [read] }
]) {
id: ID! # use the Cognito sub/id as the id here
businessID: ID!
emailAddress: AWSEmail!
role: Role
business: Business! @connection(fields: ["businessID"])
}
enum Role {
BUSINESS_ADMIN
LOCATION_ADMIN
}Cognito pre-token generation lambda handler code:
const getUserQuery = `query GetUser(
$id: ID!
) {
getUser(id: $id) {
role
business {
id
locations(limit: 100) {
items {
id
}
}
}
locations {
items {
location {
id
}
}
}
}
}`;
exports.handler = async (event, context, callback) => {
// get the user ID (Cognito sub)
const userSub = event.request.userAttributes.sub;
// get the user groups assigned through Cognito groups
const groups = event.request.groupConfiguration.groupsToOverride;
// get the calling User record from the GraphQL API
// make sure to load the Business with id and all Locations belonging to
// the Business as well as all Locations the user is assigned to
// NOTE: api.gqlCall is a utility method for making AppSync/GraphQL API calls
const userResp = await api.gqlCall(
getUserQuery, 'GetUser', { id: userSub }, graphqlEndpoint, REGION,
);
// make sure we got user data returned from the GQL API call
if (userResp.data && userResp.data.getUser) {
const businessId = userResp.data.getUser.business.id
const claimsToAddOrOverride = {
business_id: businessId,
};
const customGroups = [];
if (!groups.includes('Admin')) {
# don't need to do any of this for "root" admins
if (userResp.data.getUser.role === "BUSINESS_ADMIN") {
customGroups.push(businessId);
// add all Business Location IDs to customGroups
userResp.data.getUser.business.locations.items.forEach((item) => {
customGroups.push(item.location.id);
});
} else if (userResp.data.getUser.role === "LOCATION_ADMIN") {
// add only the specific Location IDs that the user is assigned to
userResp.data.getUser.locations.items.forEach((item) => {
customGroups.push(item.location.id);
});
claimsToAddOrOverride.locationAdmin = businessId;
} else {
claimsToAddOrOverride.readAccess = businessId;
}
}
event.response = {
claimsOverrideDetails: {
groupOverrideDetails: {
groupsToOverride: [...groups, ...customGroups],
},
claimsToAddOrOverride,
}
};
}
callback(null, event);
}I hope this can help give some good ideas for others!
ronaldocpontes
theunsa
dantasfiles
octaneC8H18
rhorohit
rajbachu6
Nxtra
spc16670
zepelega
nhruch
dlamon1
BBopanna
isaiahtaylor
Crusade1337
alexanderchan
Alex-Github-Account
8maxxam8
mauriceburn
przemekblasiak
redjonzaci
maziarzamani
chrisl777
flobo79
trevorgildersleeve
chunyenHuang
Is your feature request related to a problem? Please describe. Ability to support multi-tenancy thru AppSync where individual items are "owned/belong" to a tenant instead of a user and we still have the ability to permission queries and mutations. Generated resolvers today effectively use
isOwner || isInGroup(x for x in cognitoGroups)logic so multiple @auth rules cannot be combined to create more granular permissions.Describe the solution you'd like A few ideas:
isOwner && isInGroup(x for x in cognitoGroups)when we have both rules types declaredisTenant && (isOwner || isInGroup(x for x in cognitoGroups))Describe alternatives you've considered Currently using the existing @auth owner strategy with custom ownerField and identityFIeld values, and setting the tid claim on the token with a pre-token generation Lambda function:
When used as the only @auth strategy, it works as intended (e.g. inserting the correct tid value during mutations; filters by tid value during queries, etc.).
But when I combine with @auth static groups strategy for permissions, the authorisation checks use OR logic instead of AND logic. I can't check for instance that a record both belongs to Tenant A (which the user belongs to) and has Permission X.