Amplify-cli: model transforms: support allow:authenticated in auth transform

[adrianhall]

Do you want to request a feature or report a bug?

FEATURE

What is the current behavior?

I cannot have a type that applies per mutation/query permissions to all authenticated users. If I specify any rules, they have to be owner or group-based.

What is the expected behavior?

I want to be able to write a schema where the owner can create/update/delete and any authenticated user can read. Example is a protected blog. Something like:

type Post @model
    @auth(rules: [
        { allow: owner },
        { allow: authenticated, queries: [ "get", "list" ], mutations: [] }
    ])
{
  // Fields here
}

Additional environment details

• OS version: Mac OSX
• Output of amplify --version: 0.1.13
• Did this work in previous versions?: N

[mikeparisstuff]

Can we get a "graphql-transform" label plz?

[kaustavghosh06]

@mikeparisstuff Done.

[mikeparisstuff]

This is a relatively straight-forward task. An "authenticated" rule would mean prefixing all generated query resolvers with a null check for $ctx.identity. If it is null, throw $util.unauthorized() else allow execution. In mutations this may require injecting a true == false in the conditional expression because the older version (2017) resolvers always run the operation so we could not fail before.

[jimmyn]

Is there any workaround for now? I'm facing the same issue, I have a Product model, I would like to give read access to all users, but only write access to Admin group.

[wontwon]

Hello, any updates around this issue @mikeparisstuff? @adrianhall? Just started working with amplify, but am now running into this block with unauthorized access

[aej11a]

@mikeparisstuff Can you share any updates on this?

[kaustavghosh06]

Hey guys, we launched multi-auth support for the GraphQL transform which allows public access via API Keys and IAM. Please find more info out here - https://aws-amplify.github.io/docs/cli-toolchain/graphql#public-authorization