How to authorize data access in AWS Amplify by user custom claims?

user_4061319 0
Viewed 267

I am new to aws amplify and have started studying the documentation to see if my application can fit into a completely serverless framework with the help of Amplify.

My main doubts are related to the Authentication and the consequent authorization of the contents.

I try to briefly explain how my app should be organized so as to ask the right questions about my doubts.

imagine an app where vendors sell products to customers. so I will have two user groups: "sellers" and "customers".

I add a detail, the sellers should be associated with a shop. Thus the sellers associated with the same "shop id" can manage the same data.

Here comes the first question:

  1. How can I save this information, linked to the single user so that he can easily be authorized to access the data concerning the same shop?

Second question for now :)

  1. when I create a new model in "datastore" on the right it is possible to choose the authorization permissions, but these only allow me to set them according to "groups" or "owner". But I would like them to also be based on the "shop id". For example: all users who have associated the "claim" "shop id" with their users can see and modify the data of that shop
aws-lambda aws-amplify amazon-cognito amazon-web-services
1 Answers

You are on the right path. You need to use the owner auth rule but in the following way.

type Shop @model
  @auth(rules: [
    # Defaults to use the creator.
    { allow: owner },
    # Authorize the update mutation and both queries to the.
    { allow: owner, ownerField: "sellers", operations: [update, read] }
  ]) {
  id: ID!
  sellers: [String]
}

So the sellers can modify the values of the Shop. I don't know if this solves specifically your question but will help you to know how permissions should work. More info

user_132060510
Related