Amplify Api "Unauthorized" on connection fields

** Which Category is your question related to? ** GraphQL

** What AWS Services are you utilizing? ** API, AppSync

** Provide additional details e.g. code snippets **

I have a schema like this:

type User
      @model 
      @auth(rules: [
          {allow: owner }
          {allow: groups, groups: ["Admins"], queries: [get, list], mutations: [create, update, delete]},
          {allow: groups, groups: ["Users", "Professionals"], queries: [get, list], mutations: [create]}
        ]) {
        id: ID!
        email: AWSEmail!
        type: Int!
        name: String
        surname: String
        address: Address
        contact: AWSJSON
        info: AWSJSON
        professional: Professional @connection(name: "UserProfessional")
        professionalreviews: [ProfessionalReview] @connection(name: "UserProfessionalReviews")
      }

type Professional
      @model 
      @auth(rules: [
          {allow: owner},
          {allow: groups, groups: ["Admins"], queries: [get, list], mutations: [create, update, delete]},
          {allow: groups, groups: ["Professionals", "Users"], queries: [get, list], mutations: null}
        ])
      @searchable {
        id: ID!
        type: Int!
        subtype: String
        name: String!
        socials: [Social]
        profile: Profile
        contacts: AWSJSON
        sourcedocuments: [String]
        documents: [Image]
        patent: AWSJSON
        association: String
        user: User! @connection(name: "UserProfessional")
        reviews: [ProfessionalReview] @connection(name: "ProfessionalReviews")
      }

type ProfessionalReview
      @model 
      @auth(rules: [
          {allow: owner},
          {allow: groups, groups: ["Admins"], queries: [get, list], mutations: [create, update, delete]},
          {allow: groups, groups: ["Users", "Professionals"], queries: [get, list], mutations: [create]}
        ])
      @searchable {
        id: ID!
        user: User! @connection(name: "UserProfessionalReviews")
        professional: Professional! @connection(name: "ProfessionalReviews")
        createdAt: AWSDateTime
        content: String
        rating: Int
}

`

When i try to get the reviews of a professional with

`const getProfessionalReview = `
                query {
                  getProfessional(id:"` + professionalId + `") {
                    reviews {
                      items {
                        createdAt
                        content
                        rating
                        user {
                          id
                        }
                      }
                    }
                  }
                }`;
    return self.amplifyService.api().graphql(graphqlOperation(getProfessionalReview));`


I get an error:
errorType: "Unauthorized"
message: "Not Authorized to access user on type ProfessionalReview"

Where is my error? 
Thanks

[kaustavghosh06]

@bagubits Looks like your User @connection field in ProfessionalReviews model doesn’t have access to the User model. Since you have explicitly mentioned in type User the following auth rules - {allow: groups, groups: ["Users", "Professionals"], queries: [get, list], mutations: [create]}, this would give access to just the get and list resolvers and prevent any other connections to access this User model.

To precent this, the recommended way is to modify that auth rule to {allow: groups, groups: ["Users", "Professionals"], operations: [create, read]} which would allow connection fields from other models to query the User model.

[github-actions[bot]]

This issue has been automatically locked since there hasn’t been any recent activity after it was closed. Please open a new issue for related bugs.

Looking for a help forum? We recommend joining the Amplify Community Discord server *-help channels for those types of questions.