Open josefaidt opened 1 year ago
To mitigate, include the ID field on the model itself. From there we are able to execute updates as expected
type Todo
@model(subscriptions: null)
@auth(
rules: [
{ allow: owner }
{ allow: owner, ownerField: "editors", operations: [read, update] }
]
) {
+ id: ID!
name: String!
description: String
editors: [ID]
@auth(
rules: [
{ allow: owner }
{ allow: owner, ownerField: "editors", operations: [read] }
]
)
}
Hey Josef, I can reproduce the issue using steps provided above.
Before opening, please confirm:
How did you install the Amplify CLI?
pnpm
If applicable, what version of Node.js are you using?
18
Amplify CLI Version
10.4.0
What operating system are you using?
mac
Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
n/a
Amplify Categories
api
Amplify Commands
Not applicable
Describe the bug
Unable to run update* mutations when logged into a user that has limited access and the owner field is an array of owners (as described in the documentation for multi-user data access)
This occurs when the
id
field is not manually included in the model, and we instead lean on@model
to generate this field.Using this schema:
And the following operations (you can run this in AppSync to verify)
we are receiving the following error:
Expected behavior
users that have access via non-standard "owner" field should be able to update the fields they have access to as defined in the graphql schema
Reproduction steps
amplify init -y
amplify add api
> GraphQL > choose Cognito User Poolsamplify push -y
amplify console auth
> create two separate users (notesub::username
for second user)amplify console api
> run the operations noted in the descriptionGraphQL schema(s)
Log output
Additional information
project id 02f796c6f2e9e7c5a53d44ad88500b67