aws-amplify / aws-amplify/amplify-data

GraphQL API should send idToken to AppSync instead of accessToken

Open
#464 5 comments 0 reactions 0 assignees View on GitHub
feature-request GraphQL
Dominant language
TypeScript
Stars
18
Forks
23
Avg merge
26m
Merged PRs (30d)
1

Description

### Before opening, please confirm:

- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-js/issues?q=is%3Aissue+) and [discussions](https://github.com/aws-amplify/amplify-js/discussions).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-js/blob/main/CONTRIBUTING.md#bug-reports).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### JavaScript Framework

Vue

### Amplify APIs

GraphQL API

### Amplify Categories

auth, api

### Environment information

```
# Put output below this line

System:
OS: macOS 12.6.2
CPU: (8) arm64 Apple M1
Memory: 116.53 MB / 16.00 GB
Shell: 5.8.1 - /bin/zsh
Binaries:
Node: 18.12.1 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/node
Yarn: 1.22.19 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/yarn
npm: 8.19.2 - ~/Library/Caches/fnm_multishells/29183_1677164461499/bin/npm
Browsers:
Chrome: 110.0.5481.177
Firefox: 108.0.2
Safari: 16.2
npmPackages:
@aws-amplify/api-graphql: ^3.1.3 => 3.1.3
@graphql-codegen/cli: 3.1.0 => 3.1.0
@graphql-codegen/client-preset: 2.1.0 => 2.1.0
@mdi/font: ^7.1.96 => 7.1.96
@pinia/testing: ^0.0.15 => 0.0.15
@playwright/test: ^1.31.0 => 1.31.0
@rushstack/eslint-patch: ^1.2.0 => 1.2.0
@sentry/tracing: ^7.38.0 => 7.38.0
@sentry/vite-plugin: ^0.4.0 => 0.4.0
@sentry/vue: ^7.38.0 => 7.38.0
@storybook/addon-actions: ^6.5.16 => 6.5.16
@storybook/addon-essentials: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/addon-interactions: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/addon-links: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/blocks: ^7.0.0-alpha.8 => 7.0.0-alpha.8
@storybook/testing-library: ^0.0.14-next.1 => 0.0.14-next.1
@storybook/vue3: ^7.0.0-beta.53 => 7.0.0-beta.53
@storybook/vue3-vite: ^7.0.0-beta.53 => 7.0.0-beta.53
@tanstack/vue-query: ^4.24.10 => 4.24.10
@types/jsdom: ^21.1.0 => 21.1.0
@types/lodash.merge: ^4.6.7 => 4.6.7
@types/node: ^18.14.0 => 18.14.0
@types/uuid: ^9.0.1 => 9.0.1
@types/validator: ^13.7.12 => 13.7.12
@vitejs/plugin-vue: ^4.0.0 => 4.0.0
@vitest/ui: ^0.28.5 => 0.28.5
@vue/eslint-config-prettier: ^7.1.0 => 7.1.0
@vue/eslint-config-typescript: ^11.0.2 => 11.0.2
@vue/test-utils: ^2.3.0 => 2.3.0
@vue/tsconfig: ^0.1.3 => 0.1.3
aws-amplify: ^5.0.15 => 5.0.15
axios: ^1.3.3 => 1.3.3
axios-retry: ^3.4.0 => 3.4.0
camelcase-keys: ^8.0.2 => 8.0.2
change-case: ^4.1.2 => 4.1.2
dotenv: ^16.0.3 => 16.0.3
eslint: ^8.34.0 => 8.34.0
eslint-plugin-storybook: ^0.6.11 => 0.6.11
eslint-plugin-vue: ^9.9.0 => 9.9.0
graphql: ^16.6.0 => 16.6.0
husky: ^8.0.3 => 8.0.3
immutable: ^4.2.4 => 4.2.4
jsdom: ^21.1.0 => 21.1.0
keycode: ^2.2.1 => 2.2.1
lint-staged: ^13.1.2 => 13.1.2
lodash.merge: ^4.6.2 => 4.6.2
node-ray: ^1.19.4 => 1.19.4
npm-run-all: ^4.1.5 => 4.1.5
pinia: ^2.0.32 => 2.0.32
prettier: ^2.8.4 => 2.8.4
react: ^18.2.0 => 18.2.0
react-dom: ^18.2.0 => 18.2.0
sass: ^1.58.3 => 1.58.3
snakecase-keys: ^5.4.5 => 5.4.5
storybook: ^7.0.0-beta.53 => 7.0.0-beta.53
typescript: ~4.9.5 => 4.9.5
uuid: ^9.0.0 => 9.0.0
validator: ^13.9.0 => 13.9.0
vite: ^4.1.4 => 4.1.4
vite-plugin-vuetify: ^1.0.2 => 1.0.2
vitest: 0.28.5 => 0.28.5
vue: ^3.2.47 => 3.2.47
vue-router: ^4.1.6 => 4.1.6
vue-tsc: ^1.1.7 => 1.1.7
vue3-smooth-dnd: ^0.0.2 => 0.0.2
vuetify: ^3.1.6 => 3.1.6
waveform-data: ^4.3.0 => 4.3.0
zen-observable-ts: ^1.1.0 => 1.1.0
npmGlobalPackages:
@aws-amplify/cli: 10.6.0
corepack: 0.14.2
diff-so-fancy: 1.4.3
npm: 8.19.2
ts-node: 10.9.1
yarn: 1.22.19

```

### Describe the bug

When a user is logged in and making GraphQL requests, their custom attributes from Cognito don't exist in the `identity` object on the resolver side.

### Expected behavior

I would expect custom attributes to be in the claims.

### Reproduction steps

Set up GraphQL API and make a request (authenticated)

### Code Snippet

Workaround:

```ts
Amplify.configure({
aws_appsync_graphqlEndpoint: import.meta.env.VITE_GRAPHQL_ENDPOINT,
aws_appsync_region: 'us-east-1',
aws_appsync_authenticationType: 'AMAZON_COGNITO_USER_POOLS',
API: {
graphql_headers: async () => ({
Authorization: (await Auth.currentSession()).getIdToken().getJwtToken(),
}),
},
});
```

### Log output

```
// Put your logs below this line

```

### aws-exports.js

_No response_

### Manual configuration

_No response_

### Additional configuration

_No response_

### Mobile Device

_No response_

### Mobile Operating System

_No response_

### Mobile Browser

_No response_

### Mobile Browser Version

_No response_

### Additional information and screenshots

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in the @aws-amplify/api-graphql package and trace how authenticated GraphQL requests obtain their Cognito token for AppSync. Compare that path with the documented workaround using Auth.currentSession().getIdToken().getJwtToken(). Done means authenticated resolver requests expose Cognito custom attributes in the identity claims while preserving existing GraphQL authentication behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, graphql, typescript
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.