chrisbonifacio
commented
2 years ago Hi @AlessioVallero 👋 thanks for raising this issue.
This is just a warning that can be ignored if you're okay with owners having the ability to update the id field. The problem is simply that the id field is acting as two important mechanisms here. It is both the unique identifier for the record and the field that determines ownership. So, the value of id in this case is probably the user's cognito sub::username. Please correct me if I'm wrong, but that's usually how the owner auth rule works.
Now, if you want to get rid of the warning because you don't want the owner of a Coordinator record to be able to update the id field, thus potentially re-assigning ownership, you can protect the id with a field level auth rule granting them only create and read permissions instead. They should still be able to update the record, just not the id. The other fields inherit the model level auth rule.
type Coordinator @model @auth(rules: [{ allow: owner, ownerField: "id" }]) {
id: ID!
@auth(
rules: [{ allow: owner, ownerField: "id", operations: [create, read] }]
)
something: String
}I should note that when using field level auth rules, you have to either apply field-level authorization rules to all required fields where all rules have read access ["id"], make those fields nullable, or disable subscriptions for "Coordinator" (setting level to off or public).
Let me know if that helps!
AlessioVallero
0x24a537r9
alharris-at
Before opening, please confirm:
JavaScript Framework
React Native
Amplify APIs
GraphQL API
Amplify Categories
auth
Environment information
Describe the bug
Since I installed Amplify version 10.0.0, when running
amplify api gql-compile, I've seen the following warning:In our model, a
Coordinatorhas a primary key of typeid: ID!that we use when running the autogeneratedupdateCoordinatorfunction to update other fields. Can you clarify why anupdateCoordinator, which needs theidto identify the record to update and that does not, in fact, mutate theid, still shows the warning? I cannot remove the permission toupdateotherwise I lose the possibility to update.Expected behavior
A primary key field should be expected to be used to perform
updatemutations on a model and it shouldn't show the warning.Reproduction steps
npm install -g @aws-amplify/cli@10.2.1amplify initamplify api gql-compileand you should see the warningCode Snippet
Log output
aws-exports.js
No response
Manual configuration
No response
Additional configuration
No response
Mobile Device
No response
Mobile Operating System
No response
Mobile Browser
No response
Mobile Browser Version
No response
Additional information and screenshots
No response