DataStore query on many-to-many join table, using @manyToMany, not working, source tables are using owner auth. GraphQL create join table object, not working, due to missing owner field in Input model.

[ecc7220]

Before opening, please confirm:

• I have searched for duplicate or closed issues and discussions.
• I have read the guide for submitting bug reports.
• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

JavaScript Framework

React

Amplify APIs

DataStore

Amplify Categories

api

Environment information

# Put output below this line

Describe the bug

Using GraphQL transformer V2.

Following the examples on many-to-many queries from:

Amplify Docs - DataSore - Many-to-many

With a graphql.schema like this:

type User @model @auth(rules: [{allow: owner, operations: [read]}]) {
  id: ID!
  name: String @index(name: "byName", queryField: "userByName")
  cars: [Car] @manyToMany(relationName: "UserCar")
  owner: String!
}

type Car @model @auth(rules: [{allow: owner, operations: [read]}]) {
  id: ID!
  name: String @index(name: "byName", queryField: "carByName")
  users: [User] @manyToMany(relationName: "UserCar"),
  owner: String
}

Query on UserCar like this (notice no filter):

const result = await DataStore.query(UserCar);

Gives an empty array as result.

Query results on User or Car deliver the right objects.
If I look in Amplify Studio, I see the many-to-many relationships, when I load a User or Car.

The corresponding join table object was inserted using GraphQL in a Lambda function, but it was not possible to provide the owner field for the join object, due to missing definition in the AppSync CreateUserCarInput, although the type in AppSync for UserCar contains the owner field. Just for a test I populated the owner field using DynamoDB console, but without any success. The local storage on the browser client for the UserCar is always empty.

Please advice on how to proceed from here, because the only thing I can think about now, is to not use @manytomany at all, because it seems to be not working as it should, even using GraphQL instead of DataStore, due to the fact, that the CreateUserCarInput is missing the owner field, which is present in the type definition of UserCar in AppSync.

If you link a Car to a User in Amplify Studio, the owner field is obviously also missing the DynamoDB data.
So this lets me think, that owner auth is not supported on many-to-many relationships.

Please confirm, so I can start removing DataStore immediately to start making some progress on my project.

Expected behavior

To be able to fetch join table object with owner auth.

Reproduction steps

See the description:

1. Create the model as shown in the description.

2. Create test data in Amplify Studio.

3. Try to fetch join table object using DataStore in the client.

4. Try to create a join table object with GraphQL, with and without owner field set.

Code Snippet

// Put your code below this line.

Log output

// Put your logs below this line

aws-exports.js

No response

Manual configuration

No response

Additional configuration

No response

Mobile Device

No response

Mobile Operating System

No response

Mobile Browser

No response

Mobile Browser Version

No response

Additional information and screenshots

No response

[benjeater]

+1

I have the same issue when using dynamic group rules on a GraphQL API (@auth rules below)

@auth(
  rules: [
    { allow: groups, groupsField: "groupsCanRead", operations: [read] },
    { allow: groups, groupsField: "groupsCanUpdate", operations: [read, update] },
    { allow: groups, groupsField: "groupsFullControl", operations: [read, update, delete] },
    { allow: groups, groups: ["ADMINISTRATOR"], operations: [create, read, update, delete] }
  ]
)

Looking at the relevant .vtl templates for the generated join table in the api/[api-name]/build/resolvers folder, it appears that the authorization checks are inherited from the parent table.

In ecc7220's case, it is looking for an owner field on the join table and not finding one. In my case, it's looking for fields called groupsCanRead, groupsCanUpdate, groupsFullControl and not finding them.

There is certainly a requirement to define the auth rules for the join table, but I can find no documentation for how to do this.

To get around this problem I am going to go back to the V1 transformer method of creating many-to-many connections (i.e. defining my own join tables).

[titiloxx]

Can I work on this?

[RikiZimbakov]

Any update here? I also face a similar problem!

[olliethedev]

Same issue here!

Here is my graqhQL schema:

type Post @model @auth(rules: [
  { allow: groups, groups: ["Admins"] },
  { allow: public, operations: [read] }
  ]){
  slug: ID! @primaryKey
  title: String!
  description: String!
  content: String!
  image: String!
  published: Boolean!
  tags: [Tag] @manyToMany(relationName: "PostTag")
}

type Tag @model  @auth(rules: [
  { allow: groups, groups: ["Admins"] },
  { allow: public, operations: [read] }
  ]){
  name: ID! @primaryKey
  posts: [Post] @manyToMany(relationName: "PostTag")
}

The generated code in the /model/schema.js relational table looks like this:

"PostTag": {
            "name": "PostTag",
            "fields": {
                "id": {
                    "name": "id",
                    "isArray": false,
                    "type": "ID",
                    "isRequired": true,
                    "attributes": []
                },
                "postSlug": {
                    "name": "postSlug",
                    "isArray": false,
                    "type": "ID",
                    "isRequired": false,
                    "attributes": []
                },
                "tagName": {
                    "name": "tagName",
                    "isArray": false,
                    "type": "ID",
                    "isRequired": false,
                    "attributes": []
                },
                "post": {
                    "name": "post",
                    "isArray": false,
                    "type": {
                        "model": "Post"
                    },
                    "isRequired": true,
                    "attributes": [],
                    "association": {
                        "connectionType": "BELONGS_TO",
                        "targetNames": [
                            "postSlug"
                        ]
                    }
                },
                "tag": {
                    "name": "tag",
                    "isArray": false,
                    "type": {
                        "model": "Tag"
                    },
                    "isRequired": true,
                    "attributes": [],
                    "association": {
                        "connectionType": "BELONGS_TO",
                        "targetNames": [
                            "tagName"
                        ]
                    }
                },
                "createdAt": {
                    "name": "createdAt",
                    "isArray": false,
                    "type": "AWSDateTime",
                    "isRequired": false,
                    "attributes": [],
                    "isReadOnly": true
                },
                "updatedAt": {
                    "name": "updatedAt",
                    "isArray": false,
                    "type": "AWSDateTime",
                    "isRequired": false,
                    "attributes": [],
                    "isReadOnly": true
                }
            },
            "syncable": true,
            "pluralName": "PostTags",
            "attributes": [
                {
                    "type": "model",
                    "properties": {}
                },
                {
                    "type": "key",
                    "properties": {
                        "name": "byPost",
                        "fields": [
                            "postSlug"
                        ]
                    }
                },
                {
                    "type": "key",
                    "properties": {
                        "name": "byTag",
                        "fields": [
                            "tagName"
                        ]
                    }
                }
            ]
        }
    }

As you can see its missing an Auth attribute.

To fix the issue I just added the same auth attribute from the Post (or Tag) model. Its a temporary solution since next codegen will probably override the changes.

    {
                    "type": "auth",
                    "properties": {
                        "rules": [
                            {
                                "groupClaim": "cognito:groups",
                                "provider": "userPools",
                                "allow": "groups",
                                "groups": [
                                    "Admins"
                                ],
                                "operations": [
                                    "create",
                                    "update",
                                    "delete",
                                    "read"
                                ]
                            },
                            {
                                "allow": "public",
                                "operations": [
                                    "read"
                                ]
                            }
                        ]
                    }
                }

Hopefully this helps anyone who is stuck with many-to-many Datastore unauthorized error!

This seems like a simple issue to solve for anyone who might want to give it a shot over a weekend. This line here is probably a good place to start.