fix(datastore): filter authrules with invalid ownerfield

AmplifyPlugins/Core/AWSPluginsCore/Model/Decorator/AuthRuleDecorator.swift

@@ -50,19 +50,13 @@ public struct AuthRuleDecorator: ModelBasedGraphQLDocumentDecorator {
 
     public func decorate(_ document: SingleDirectiveGraphQLDocument,
                          modelSchema: ModelSchema) -> SingleDirectiveGraphQLDocument {
-        let authRules = modelSchema.authRules.filterBy(authType: authType)
+        let authRules = modelSchema.authRules
+                    .filterBy(authType: authType)
+                    .filterBy(ownerFieldType: .string, modelSchema: modelSchema)
         guard !authRules.isEmpty else {
             return document
         }
         var decorateDocument = document
-        if authRules.readRestrictingOwnerRules().count > 1 {
-            log.error("""
-            Detected multiple owner type auth rules \
-            with a READ operation. We currently do not support this use case. Please \
-            limit your type to just one owner auth rule with a READ operation restriction.
-            """)
-            return decorateDocument
-        }
 
         let readRestrictingStaticGroups = authRules.groupClaimsToReadRestrictingStaticGroups()
         authRules.forEach { authRule in
@@ -179,6 +173,15 @@ public struct AuthRuleDecorator: ModelBasedGraphQLDocumentDecorator {
     }
 }
 
+private extension AuthRule {
+    func ownerField(inSchema schema: ModelSchema) -> ModelField? {
+        guard let fieldName = self.ownerField else {
+            return nil
+        }
+        return schema.field(withName: fieldName)
+    }
+}
+
 private extension AuthRules {
     func filterBy(authType: AWSAuthorizationType?) -> AuthRules {
         guard let authType = authType else {
@@ -195,6 +198,21 @@ private extension AuthRules {
             return authType == provider.toAWSAuthorizationType()
         }
     }
+
+    func filterBy(ownerFieldType: ModelFieldType,
+                  modelSchema: ModelSchema) -> AuthRules {
+        return filter {
+            guard let modelField = $0.ownerField(inSchema: modelSchema) else {
+                // if we couldn't find the owner field means it has been implicitly
+                // declared in the model schema, therefore has the correct type "string"
+                return true
+            }
+            if case .string = modelField.type {
+                return true
+            }
+            return false
+        }
+    }
 }
 
 extension AuthRuleDecorator: DefaultLogger {

AmplifyPlugins/Core/AWSPluginsCoreTests/Model/Decorator/AuthRuleDecorator/ModelMultipleOwnerAuthRuleTests.swift

@@ -71,31 +71,7 @@ class ModelMultipleOwnerAuthRuleTests: XCTestCase {
     override func tearDown() {
         ModelRegistry.reset()
     }
-    // This is a test case to demostrate if we attempt to use a model with multiple auth rules
-    // with a read operation, we effectively create a subscription without decorating it with auth.
-    // We should delete this use case when the AppSync service supports this use case.
-    func testUnsupportedModelMultipleOwner_CreateMutation() {
-        var documentBuilder = ModelBasedGraphQLDocumentBuilder(modelType: ModelMultipleOwner.self,
-                                                               operationType: .mutation)
-        documentBuilder.add(decorator: DirectiveNameDecorator(type: .create))
-        documentBuilder.add(decorator: AuthRuleDecorator(.mutation))
-        let document = documentBuilder.build()
-        let expectedQueryDocument = """
-        mutation CreateModelMultipleOwner {
-          createModelMultipleOwner {
-            id
-            content
-            editors
-            __typename
-          }
-        }
-        """
-        XCTAssertEqual(document.name, "createModelMultipleOwner")
-        XCTAssertEqual(document.stringValue, expectedQueryDocument)
-        XCTAssertTrue(document.variables.isEmpty)
-    }
-
-/*
+
     // Ensure that the `owner` field is added to the model fields
     func testModelMultipleOwner_CreateMutation() {
         var documentBuilder = ModelBasedGraphQLDocumentBuilder(modelSchema: ModelMultipleOwner.schema,
@@ -219,7 +195,7 @@ class ModelMultipleOwnerAuthRuleTests: XCTestCase {
                                                                operationType: .query)
         documentBuilder.add(decorator: DirectiveNameDecorator(type: .sync))
         documentBuilder.add(decorator: PaginationDecorator())
-        documentBuilder.add(decorator: ConflictResolutionDecorator())
+        documentBuilder.add(decorator: ConflictResolutionDecorator(graphQLType: .query))
         documentBuilder.add(decorator: AuthRuleDecorator(.query))
         let document = documentBuilder.build()
         let expectedQueryDocument = """
@@ -244,6 +220,8 @@ class ModelMultipleOwnerAuthRuleTests: XCTestCase {
         XCTAssertEqual(document.stringValue, expectedQueryDocument)
     }
 
+    // TODO: Fix below 3 tests:
+
     // Only the 'owner' inherently has `.create` operation, requiring the subscription operation to contain the input
     func testModelMultipleOwner_OnCreateSubscription() {
         let claims = ["username": "user1",
@@ -331,5 +309,5 @@ class ModelMultipleOwnerAuthRuleTests: XCTestCase {
         }
         XCTAssertEqual(variables["owner"] as? String, "user1")
     }
-*/
+
 }

AmplifyPlugins/DataStore/Tests/DataStoreHostApp/AWSDataStorePluginAuthCognitoTests/AWSDataStoreCategoryPluginAuthOwnerIntegrationTests.swift

@@ -92,15 +92,47 @@ class AWSDataStoreCategoryPluginAuthOwnerIntegrationTests: AWSDataStoreAuthBaseT
         }
 
         let todo = TodoExplicitOwnerField(content: "content")
-
+        
         // Mutations
         try await assertMutations(model: todo, expectations) { error in
             XCTFail("Error mutation \(error)")
         }
-
+
+        assertUsedAuthTypes([.amazonCognitoUserPools])
+    }
+
+    /// Given: a user signed in with CognitoUserPools, a model with multiple rules with
+    ///      explicit owner field
+    /// When: DataStore query/mutation operations are sent with CognitoUserPools
+    /// Then: DataStore is successfully initialized, query returns a result,
+    ///      mutation is processed for an authenticated users
+    func testExplicitMultipleOwner() async throws {
+        try await setup(withModels: ExplicitMultipleOwnerModelRegistration(),
+              testType: .defaultAuthCognito)
+
+        try await signIn(user: user1)
+
+        let expectations = makeExpectations()
+
+        try await assertDataStoreReady(expectations)
+
+        // Query
+        try await assertQuerySuccess(modelType: TodoCognitoMultiOwner.self,
+                                     expectations) { error in
+            XCTFail("Error query \(error)")
+        }
+
+        let post = TodoCognitoMultiOwner(title: "title")
+
+        // Mutations
+        try await assertMutations(model: post, expectations) { error in
+            XCTFail("Error mutation \(error)")
+        }
+
         assertUsedAuthTypes([.amazonCognitoUserPools])
     }
 
+
     /// Given: a user signed in with CognitoUserPools, a model with an implicit owner field
     /// When: DataStore query/mutation operations are sent with CognitoUserPools
     /// Then: DataStore is successfully initialized, query returns a result,
@@ -187,6 +219,13 @@ extension AWSDataStoreCategoryPluginAuthOwnerIntegrationTests {
         }
     }
 
+    struct ExplicitMultipleOwnerModelRegistration: AmplifyModelRegistration {
+        public let version: String = "version"
+        func registerModels(registry: ModelRegistry.Type) {
+            ModelRegistry.register(modelType: TodoCognitoMultiOwner.self)
+        }
+    }
+
     struct ImplicitOwnerModelRegistration: AmplifyModelRegistration {
         public let version: String = "version"
         func registerModels(registry: ModelRegistry.Type) {

AmplifyPlugins/DataStore/Tests/DataStoreHostApp/AWSDataStorePluginAuthCognitoTests/Models/TodoCognitoMultiOwner+Schema.swift

@@ -0,0 +1,57 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+// swiftlint:disable all
+import Amplify
+import Foundation
+
+extension TodoCognitoMultiOwner {
+  // MARK: - CodingKeys 
+   public enum CodingKeys: String, ModelKey {
+    case id
+    case title
+    case content
+    case owner
+    case editors
+    case createdAt
+    case updatedAt
+  }
+
+  public static let keys = CodingKeys.self
+  //  MARK: - ModelSchema 
+
+  public static let schema = defineSchema { model in
+    let todoCognitoMultiOwner = TodoCognitoMultiOwner.keys
+
+    model.authRules = [
+      rule(allow: .owner, ownerField: "owner", identityClaim: "cognito:username", provider: .userPools, operations: [.create, .update, .delete, .read]),
+      rule(allow: .owner, ownerField: "editors", identityClaim: "cognito:username", provider: .userPools, operations: [.update, .read])
+    ]
+
+    model.listPluralName = "TodoCognitoMultiOwners"
+    model.syncPluralName = "TodoCognitoMultiOwners"
+
+    model.attributes(
+      .primaryKey(fields: [todoCognitoMultiOwner.id])
+    )
+
+    model.fields(
+      .field(todoCognitoMultiOwner.id, is: .required, ofType: .string),
+      .field(todoCognitoMultiOwner.title, is: .required, ofType: .string),
+      .field(todoCognitoMultiOwner.content, is: .optional, ofType: .string),
+      .field(todoCognitoMultiOwner.owner, is: .optional, ofType: .string),
+      .field(todoCognitoMultiOwner.editors, is: .optional, ofType: .embeddedCollection(of: String.self)),
+      .field(todoCognitoMultiOwner.createdAt, is: .optional, isReadOnly: true, ofType: .dateTime),
+      .field(todoCognitoMultiOwner.updatedAt, is: .optional, isReadOnly: true, ofType: .dateTime)
+    )
+    }
+}
+
+extension TodoCognitoMultiOwner: ModelIdentifiable {
+  public typealias IdentifierFormat = ModelIdentifierFormat.Default
+  public typealias IdentifierProtocol = DefaultModelIdentifier<Self>
+}

AmplifyPlugins/DataStore/Tests/DataStoreHostApp/AWSDataStorePluginAuthCognitoTests/Models/TodoCognitoMultiOwner.swift

@@ -0,0 +1,49 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+// swiftlint:disable all
+import Amplify
+import Foundation
+
+public struct TodoCognitoMultiOwner: Model {
+  public let id: String
+  public var title: String
+  public var content: String?
+  public var owner: String?
+  public var editors: [String?]?
+  public var createdAt: Temporal.DateTime?
+  public var updatedAt: Temporal.DateTime?
+
+  public init(id: String = UUID().uuidString,
+      title: String,
+      content: String? = nil,
+      owner: String? = nil,
+      editors: [String?]? = nil) {
+    self.init(id: id,
+      title: title,
+      content: content,
+      owner: owner,
+      editors: editors,
+      createdAt: nil,
+      updatedAt: nil)
+  }
+  internal init(id: String = UUID().uuidString,
+      title: String,
+      content: String? = nil,
+      owner: String? = nil,
+      editors: [String?]? = nil,
+      createdAt: Temporal.DateTime? = nil,
+      updatedAt: Temporal.DateTime? = nil) {
+      self.id = id
+      self.title = title
+      self.content = content
+      self.owner = owner
+      self.editors = editors
+      self.createdAt = createdAt
+      self.updatedAt = updatedAt
+  }
+}

AmplifyPlugins/DataStore/Tests/DataStoreHostApp/AWSDataStorePluginAuthCognitoTests/Models/TodoCognitoPrivate+Schema.swift

@@ -17,24 +17,34 @@ extension TodoCognitoPrivate {
     case createdAt
     case updatedAt
   }
-
+  
   public static let keys = CodingKeys.self
   //  MARK: - ModelSchema
-
+  
   public static let schema = defineSchema { model in
     let todoCognitoPrivate = TodoCognitoPrivate.keys
-
+    
     model.authRules = [
-        rule(allow: .private, provider: .userPools, operations: [.create, .update, .delete, .read])
+      rule(allow: .private, operations: [.create, .update, .delete, .read])
     ]
-
-    model.pluralName = "TodoCognitoPrivates"
-
+
+    model.listPluralName = "TodoCognitoPrivates"
+    model.syncPluralName = "TodoCognitoPrivates"
+
+    model.attributes(
+      .primaryKey(fields: [todoCognitoPrivate.id])
+    )
+
     model.fields(
-      .id(),
+      .field(todoCognitoPrivate.id, is: .required, ofType: .string),
       .field(todoCognitoPrivate.title, is: .required, ofType: .string),
       .field(todoCognitoPrivate.createdAt, is: .optional, isReadOnly: true, ofType: .dateTime),
       .field(todoCognitoPrivate.updatedAt, is: .optional, isReadOnly: true, ofType: .dateTime)
     )
     }
 }
+
+extension TodoCognitoPrivate: ModelIdentifiable {
+  public typealias IdentifierFormat = ModelIdentifierFormat.Default
+  public typealias IdentifierProtocol = DefaultModelIdentifier<Self>
+}

AmplifyPlugins/DataStore/Tests/DataStoreHostApp/AWSDataStorePluginAuthCognitoTests/Models/TodoCustomOwnerExplicit+Schema.swift

@@ -18,25 +18,35 @@ extension TodoCustomOwnerExplicit {
     case createdAt
     case updatedAt
   }
-
+  
   public static let keys = CodingKeys.self
   //  MARK: - ModelSchema
-
+  
   public static let schema = defineSchema { model in
     let todoCustomOwnerExplicit = TodoCustomOwnerExplicit.keys
-
+    
     model.authRules = [
       rule(allow: .owner, ownerField: "dominus", identityClaim: "cognito:username", provider: .userPools, operations: [.create, .update, .delete, .read])
     ]
-
-    model.pluralName = "TodoCustomOwnerExplicits"
-
+
+    model.listPluralName = "TodoCustomOwnerExplicits"
+    model.syncPluralName = "TodoCustomOwnerExplicits"
+
+    model.attributes(
+      .primaryKey(fields: [todoCustomOwnerExplicit.id])
+    )
+
     model.fields(
-      .id(),
+      .field(todoCustomOwnerExplicit.id, is: .required, ofType: .string),
       .field(todoCustomOwnerExplicit.title, is: .required, ofType: .string),
       .field(todoCustomOwnerExplicit.dominus, is: .optional, ofType: .string),
       .field(todoCustomOwnerExplicit.createdAt, is: .optional, isReadOnly: true, ofType: .dateTime),
       .field(todoCustomOwnerExplicit.updatedAt, is: .optional, isReadOnly: true, ofType: .dateTime)
     )
     }
 }
+
+extension TodoCustomOwnerExplicit: ModelIdentifiable {
+  public typealias IdentifierFormat = ModelIdentifierFormat.Default
+  public typealias IdentifierProtocol = DefaultModelIdentifier<Self>
+}