aws-amplify / aws-amplify/amplify-data
GraphQL API should send idToken to AppSync instead of accessToken
- Dominant language
- TypeScript
- Stars
- 18
- Forks
- 23
- Avg merge
- 26m
- Merged PRs (30d)
- 1
Description
### Before opening, please confirm:
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-js/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-js/discussions).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-js/blob/main/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
### JavaScript Framework
Vue
### Amplify APIs
GraphQL API
### Amplify Categories
auth, api
### Environment information
```
# Put output below this line
System:
OS: macOS 12.6.2
CPU: (8) arm64 Apple M1
Memory: 116.53 MB / 16.00 GB
Shell: 5.8.1 - /bin/zsh
Binaries:
Node: 18.12.1 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/node
Yarn: 1.22.19 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/yarn
npm: 8.19.2 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/npm
Browsers:
Chrome: 110.0.5481.177
Firefox: 108.0.2
Safari: 16.2
npmPackages:
@aws-amplify/api-graphql: ^3.1.3 => 3.1.3
@graphql-codegen/cli: 3.1.0 => 3.1.0
@graphql-codegen/client-preset: 2.1.0 => 2.1.0
@mdi/font: ^7.1.96 => 7.1.96
@pinia/testing: ^0.0.15 => 0.0.15
@playwright/test: ^1.31.0 => 1.31.0
@rushstack/eslint-patch: ^1.2.0 => 1.2.0
@sentry/tracing: ^7.38.0 => 7.38.0
@sentry/vite-plugin: ^0.4.0 => 0.4.0
@sentry/vue: ^7.38.0 => 7.38.0
@storybook/addon-actions: ^6.5.16 => 6.5.16
@storybook/addon-essentials: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/addon-interactions: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/addon-links: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/blocks: ^7.0.0-alpha.8 => 7.0.0-alpha.8
@storybook/testing-library: ^0.0.14-next.1 => 0.0.14-next.1
@storybook/vue3: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/vue3-vite: ^7.0.0-beta.53 => 7.0.0-beta.53
@tanstack/vue-query: ^4.24.10 => 4.24.10
@types/jsdom: ^21.1.0 => 21.1.0
@types/lodash.merge: ^4.6.7 => 4.6.7
@types/node: ^18.14.0 => 18.14.0
@types/uuid: ^9.0.1 => 9.0.1
@types/validator: ^13.7.12 => 13.7.12
@vitejs/plugin-vue: ^4.0.0 => 4.0.0
@vitest/ui: ^0.28.5 => 0.28.5
@vue/eslint-config-prettier: ^7.1.0 => 7.1.0
@vue/eslint-config-typescript: ^11.0.2 => 11.0.2
@vue/test-utils: ^2.3.0 => 2.3.0
@vue/tsconfig: ^0.1.3 => 0.1.3
aws-amplify: ^5.0.15 => 5.0.15
axios: ^1.3.3 => 1.3.3
axios-retry: ^3.4.0 => 3.4.0
camelcase-keys: ^8.0.2 => 8.0.2
change-case: ^4.1.2 => 4.1.2
dotenv: ^16.0.3 => 16.0.3
eslint: ^8.34.0 => 8.34.0
eslint-plugin-storybook: ^0.6.11 => 0.6.11
eslint-plugin-vue: ^9.9.0 => 9.9.0
graphql: ^16.6.0 => 16.6.0
husky: ^8.0.3 => 8.0.3
immutable: ^4.2.4 => 4.2.4
jsdom: ^21.1.0 => 21.1.0
keycode: ^2.2.1 => 2.2.1
lint-staged: ^13.1.2 => 13.1.2
lodash.merge: ^4.6.2 => 4.6.2
node-ray: ^1.19.4 => 1.19.4
npm-run-all: ^4.1.5 => 4.1.5
pinia: ^2.0.32 => 2.0.32
prettier: ^2.8.4 => 2.8.4
react: ^18.2.0 => 18.2.0
react-dom: ^18.2.0 => 18.2.0
sass: ^1.58.3 => 1.58.3
snakecase-keys: ^5.4.5 => 5.4.5
storybook: ^7.0.0-beta.53 => 7.0.0-beta.53
typescript: ~4.9.5 => 4.9.5
uuid: ^9.0.0 => 9.0.0
validator: ^13.9.0 => 13.9.0
vite: ^4.1.4 => 4.1.4
vite-plugin-vuetify: ^1.0.2 => 1.0.2
vitest: 0.28.5 => 0.28.5
vue: ^3.2.47 => 3.2.47
vue-router: ^4.1.6 => 4.1.6
vue-tsc: ^1.1.7 => 1.1.7
vue3-smooth-dnd: ^0.0.2 => 0.0.2
vuetify: ^3.1.6 => 3.1.6
waveform-data: ^4.3.0 => 4.3.0
zen-observable-ts: ^1.1.0 => 1.1.0
npmGlobalPackages:
@aws-amplify/cli: 10.6.0
corepack: 0.14.2
diff-so-fancy: 1.4.3
npm: 8.19.2
ts-node: 10.9.1
yarn: 1.22.19
```
### Describe the bug
When a user is logged in and making GraphQL requests, their custom attributes from Cognito don't exist in the `identity` object on the resolver side.
### Expected behavior
I would expect custom attributes to be in the claims.
### Reproduction steps
Set up GraphQL API and make a request (authenticated)
### Code Snippet
Workaround:
```ts
Amplify.configure({
aws_appsync_graphqlEndpoint: import.meta.env.VITE_GRAPHQL_ENDPOINT,
aws_appsync_region: 'us-east-1',
aws_appsync_authenticationType: 'AMAZON_COGNITO_USER_POOLS',
API: {
graphql_headers: async () => ({
Authorization: (await Auth.currentSession()).getIdToken().getJwtToken(),
}),
},
});
```
### Log output
```
// Put your logs below this line
```
### aws-exports.js
_No response_
### Manual configuration
_No response_
### Additional configuration
_No response_
### Mobile Device
_No response_
### Mobile Operating System
_No response_
### Mobile Browser
_No response_
### Mobile Browser Version
_No response_
### Additional information and screenshots
_No response_
Contributor guide
Research direction
Start in the @aws-amplify/api-graphql package and trace how authenticated GraphQL requests obtain their Cognito token for AppSync. Compare that path with the documented workaround using Auth.currentSession().getIdToken().getJwtToken(). Done means authenticated resolver requests expose Cognito custom attributes in the identity claims while preserving existing GraphQL authentication behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, graphql, typescript
- Domain
- api, authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100