aws-amplify / aws-amplify/amplify-studio

Allow Lambda function chaining with auto-generated resolvers

Open
#298 1 comment 4 reactions 0 assignees View on GitHub
data feature-request studio-ui
Dominant language
No language data
Stars
135
Forks
32
PR merge metrics
No merged PRs in 30d

Description

**Is your feature request related to a problem? Please describe.**
My team is developing a multi-tenant application that requires granular hierarchical authorization. Think of it like folder and file permissions. Users create files in folders and can grant access to other users at folder level. In this example Folder and File are GraphQL types. Since our users are also frequently interacting with the app in environments with limited Internet connectivity, we would like to use the DataStore. This means that we cannot use Pipeline resolvers or custom Lambda resolvers. We also cannot use Cognito groups, because Cognito has limits on number of groups per AWS account.

Authorization use cases:

1. Check that user is able to share the folder with another user
2. Check that user is able to create a file in the folder
3. Check that user is able to view/edit/delete/etc. the file

We would also like to be able to:

1. Write CloudWatch logs with details about request/response
2. Emit custom metrics
3. Etc.

None of these things seem possible right now, but they are essential to any application before it is released to production.

**Describe the solution you'd like**
It would be nice to have a mechanism to generate pipeline resolvers that get executed as part of default query and mutation operations (i.e. auto-generated operations for @model types).

Alternatively, it would be great if we could write custom resolver overrides that are Lambda instead of VTL. I know cost was quoted as the reason why VTL resolvers are generated by default instead of Lambda, but we (and I imagine many other teams) would be OK with some cost if it meant more flexibility in terms of the business logic we can put into resolvers.

**Describe alternatives you've considered**

1. Dropping DataStore entirely and implementing a custom local storage with IndexedDB.
2. Relaxing authorization.

Both of these options are less than ideal.

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by reviewing how @model operations and their resolvers are generated, then examine the DataStore constraints described here. Done would require a decided design for generated pipeline or Lambda resolver support, including authorization and logging or metrics behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, graphql
Domain
authentication, backend-api-design
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.