Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(auth): ownerfield as pk in relational models #1389

Merged
merged 8 commits into from
Apr 10, 2023
Merged

Conversation

AaronZyLee
Copy link
Contributor

@AaronZyLee AaronZyLee commented Apr 5, 2023

Description of changes

Use stash instead of source for owner auth resolver when the owner field of related model is part of the key schema. The connection fields will be put into $ctx.stash.connectionAttributes in auth resolver and consumed by the latter data resolver.

CDK / CloudFormation Parameters Changed

Issue #, if available

Fix #1383

Description of how you validated changes

Unit & e2e tests
Team Bug bash

Checklist

  • PR description included
  • yarn test passes
  • Tests are changed or added
  • Relevant documentation is changed or added (and PR referenced)
  • New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies
  • Any CDK or CloudFormation parameter changes are called out explicitly

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@AaronZyLee AaronZyLee requested a review from a team as a code owner April 5, 2023 14:57
@AaronZyLee AaronZyLee marked this pull request as draft April 5, 2023 14:57
@AaronZyLee AaronZyLee marked this pull request as ready for review April 7, 2023 14:30
#set( $result = {
\\"items\\": []
} )
#return($result)
#else
#set( $limit = $util.defaultIfNull($context.args.limit, 100) )
#set( $sortKeyValue0 = $util.defaultIfNull($ctx.stash.connectionAttibutes.get(\\"title\\"), $ctx.source.title) )
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here, we are defining the sort key value, but not using it anywhere? Are we missing some step to set the sort key?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is expected as the CPK feature flag is not enabled. The sort key field will not be used in the query. This is kept for not breaking old projects.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The test statement for this snapshot: should not generate sort key field in implicit hasMany relation when CPK feature is disabled

#set( $result = {
\\"items\\": []
} )
#return($result)
#else
#set( $limit = $util.defaultIfNull($context.args.limit, 100) )
#set( $sortKeyValue0 = $util.defaultIfNull($ctx.stash.connectionAttibutes.get(\\"title\\"), $ctx.source.title) )
#set( $sortKeyValue1 = $util.defaultIfNull($ctx.stash.connectionAttibutes.get(\\"likes\\"), $ctx.source.likes) )
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

double check on usage of these sort key values please.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above as CPK feature flag is false

@@ -299,7 +299,7 @@ test('it generates expected resources', () => {
{
Ref: Match.anyValue(),
},
'"))\n$util.qr($ctx.stash.put("endpoint", "https://',
'"))\n$util.qr($ctx.stash.put("connectionAttributes", {}))\n$util.qr($ctx.stash.put("endpoint", "https://',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this an expected change for Searchable resolver? Can you confirm whether we changed the corresponding querying logic to use 'connctionAttributes' variable?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed that the search query does consume the connectionAttributes. The code block here is to have it initialized as it is applied to all init slot

@AaronZyLee AaronZyLee merged commit 9b636f7 into main Apr 10, 2023
@AaronZyLee AaronZyLee deleted the fix-owner-pk branch April 10, 2023 18:07
AaronZyLee added a commit that referenced this pull request Apr 10, 2023
* fix(auth): ownerfield as pk in relational models

* fix hasone belongsto relation of owner pk auth

* fix: use stash for sort key value

* fix unit test

* fix: unit tests

* rm yarn lock change

* add e2e test

* change snapshot
AaronZyLee added a commit that referenced this pull request Apr 12, 2023
* fix(auth): ownerfield as pk in relational models

* fix hasone belongsto relation of owner pk auth

* fix: use stash for sort key value

* fix unit test

* fix: unit tests

* rm yarn lock change

* add e2e test

* change snapshot
sundersc pushed a commit to sundersc/amplify-category-api that referenced this pull request Apr 21, 2023
* fix(auth): ownerfield as pk in relational models

* fix hasone belongsto relation of owner pk auth

* fix: use stash for sort key value

* fix unit test

* fix: unit tests

* rm yarn lock change

* add e2e test

* change snapshot
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Defect in GraphQL Resolver Allows Unauthorized Access to field-level Data
4 participants