aws / aws/aws-appsync-community

Subscriptions are not working with dynamic auth groups

Open
#111 0 comments 6 reactions 0 assignees View on GitHub
feature-request
Dominant language
HTML
Stars
507
Forks
37
PR merge metrics
No merged PRs in 30d

Description

**Subscriptions to models with `@auth` directives for dynamic groups don't trigger subscription events.**

**Related Issue**: aws-amplify/amplify-category-api#389

I created the following **example** to illustrate this problem: https://github.com/lucido-apps/appsync-dynamic-groups-subscribe

And a **video** (using the example above): https://youtu.be/O7rofaqRdaU

At first I encountered this issue with `DataStore` but after chatting an AWS Amplify about it, I got the following information https://discord.com/channels/705853757799399426/707328986077855836/717887363388407829:

> Dynamic Groups isn't unsupported in DataStore. The limitation you're referring to is Dynamic Groups with GraphQL subscriptions in general. AuthZ happens at connection time which is why dynamic groups function for queries and mutations since they are request/response based. Subscriptions are websockets so after AuthZ happens there's nothing at runtime to perform validation against, therefore you cannot do this dynamic check against a data source.
We're working through possibilities of doing runtime filtering with the AppSync team on their roadmap which would open up this capability. That being said almost all systems do runtime filtering at clients and AuthZ happens on connections just like this since it's the most scalable solution.

Contributor guide

Open the contributing guide

Research direction

Start with the linked reproduction repository and the related issue to reproduce dynamic-group subscription behavior. The payload names no repository file or test, so first identify the AppSync subscription authorization path and verify the documented limitation. Done is undefined without a proposed implementation or acceptance criteria; the issue may require a design or roadmap decision.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, graphql
Domain
api, authorization
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.