aws-amplify / aws-amplify/amplify-android

[DataStore] Detected multiple owner type auth rules with a READ operation

Open
#1,728 0 comments 0 reactions 0 assignees View on GitHub
datastore feature-request
Dominant language
Java
Stars
287
Forks
132
Avg merge
2d 2h
Merged PRs (30d)
45

Description

### Before opening, please confirm:

- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-android/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-android/discussions).

### Language and Async Model

Kotlin

### Amplify Categories

DataStore

### Gradle script dependencies

```groovy
implementation "com.amplifyframework:aws-datastore:1.35.1"
implementation "com.amplifyframework:aws-api-appsync:1.35.1"
```

### Environment information

```
------------------------------------------------------------
Gradle 7.2
------------------------------------------------------------

Build time: 2021-08-17 09:59:03 UTC
Revision: a773786b58bb28710e3dc96c4d1a7063628952ad

Kotlin: 1.5.21
Groovy: 3.0.8
Ant: Apache Ant(TM) version 1.10.9 compiled on September 27 2020
JVM: 11.0.14 (Amazon.com Inc. 11.0.14+9-LTS)
OS: Mac OS X 12.3.1 x86_64
```

### Please include any relevant guides or documentation you're referencing

_No response_

### Describe the bug

The schema below describes the authorization scheme: _Every todo can be accessed by its owner and read by precisely one other user if it chooses._ This is being used in a customer app to mirror a parent/child relationship where the child is the owner. Using Cognito Groups is not possible due to the fact that you can only have a limited number of groups registered, so these would quickly be exhausted if they were created on a per-parent/child basis.

I have verified that the schema works in AppSync, fulfilling the authorization scheme described. However, sync in DataStore is not possible due to the following issue:

```
ApiAuthException{message=Detected multiple owner type auth rules with a READ operation, cause=null, recoverySuggestion=We currently do not support this use case. Please limit your type to just one owner auth rule with a READ operation restriction.}
```

I have also confirmed that the same issue is present on iOS. What is the intended workaround to achieve this authorization scheme?

### Reproduction steps (if applicable)

1. Login
2. See initial sync fail

### Code Snippet

_No response_

### Log output

The logs show the following. Setting a breakpoint at `MultiAuthSubscriptionOperation.java:105` gives the underlying exception posted above.

```
E/amplify:aws-datastore(18986): Failure encountered while attempting to start API sync.
E/amplify:aws-datastore(18986): DataStoreException{message=Error during subscription., cause=ApiException{message=Unable to establish subscription connection., cause=null, recoverySuggestion=Sorry, we don't have a suggested fix for this error yet.}, recoverySuggestion=Evaluate details.}
E/amplify:aws-datastore(18986): at com.amplifyframework.datastore.appsync.AppSyncClient.lambda$subscription$3(AppSyncClient.java:331)
E/amplify:aws-datastore(18986): at com.amplifyframework.datastore.appsync.AppSyncClient$$ExternalSyntheticLambda1.accept(Unknown Source:4)
E/amplify:aws-datastore(18986): at com.amplifyframework.api.aws.MutiAuthSubscriptionOperation.emitErrorAndCancelSubscription(MutiAuthSubscriptionOperation.java:178)
E/amplify:aws-datastore(18986): at com.amplifyframework.api.aws.MutiAuthSubscriptionOperation.dispatchRequest(MutiAuthSubscriptionOperation.java:141)
E/amplify:aws-datastore(18986): at com.amplifyframework.api.aws.MutiAuthSubscriptionOperation.$r8$lambda$iziEcYpvlINdYbit2it7fDbbt8A(Unknown Source:0)
E/amplify:aws-datastore(18986): at com.amplifyframework.api.aws.MutiAuthSubscriptionOperation$$ExternalSyntheticLambda4.run(Unknown Source:2)
E/amplify:aws-datastore(18986): at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:462)
E/amplify:aws-datastore(18986): at java.util.concurrent.FutureTask.run(FutureTask.java:266)
E/amplify:aws-datastore(18986): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
E/amplify:aws-datastore(18986): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
E/amplify:aws-datastore(18986): at java.lang.Thread.run(Thread.java:923)
E/amplify:aws-datastore(18986): Caused by: ApiException{message=Unable to establish subscription connection., cause=null, recoverySuggestion=Sorry, we don't have a suggested fix for this error yet.}
E/amplify:aws-datastore(18986): ... 8 more
```

### amplifyconfiguration.json

_No response_

### GraphQL Schema

```graphql
type Todo @model @auth(rules: [
{ allow: owner }
{ allow: owner, ownerField: "user", operations: [read] }
]) {
id: ID!
name: String!
description: String
isComplete: Boolean!
owner: String
user: String
}
```

### Additional information and screenshots

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the GraphQL schema and reproduce the initial sync failure, then inspect MultiAuthSubscriptionOperation.java:105 and the surrounding subscription path referenced in the logs. Determine whether the multiple owner READ rules are supported by DataStore and document or validate the intended workaround; completion requires a confirmed resolution for this authorization scheme.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, graphql, java, kotlin
Domain
authorization, backend-api-design, databases
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.