@auth Directive to allow owner AND group

** Which Category is your question related to? ** GraphQL Transform

** What AWS Services are you utilizing? ** AWS AppSync

** Provide additional details e.g. code snippets ** I read the GraphQL Transform doc but I must have missed something. How do I use the @auth directive to allow only the owner who is also in a group Member? So the owner can do all the queries and mutations but must belong to Member group. To put it in another way, If you belong to Member group but you are not the owner, you are not authorized to query or mutate.

type Project @model @auth(rules: [
    { allow: owner },
    { allow: groups group: ["X"] }
]) { ... }

The way I wrote above, I believe, grants owner OR Member group all the rights to every Project? So anyone that belongs to Member group can, for example, delete a Project that doesn’t belong to that person?

Thanks 👍

[rawadrifai]

How do you allow read/write for owner and read only for every other authenticated user?

[ghost]

@mikeparisstuff any answer for @rawadrifai’s question? Consider a common use case, where there are private and public user profiles. The owner of the profile should have full access where the other authenticated users should be able to read a subset of user fields. Ideally there should be something like,

@auth(rules: [
        { allow: owner},
        { allow: everyone, operations: [read], fields: []}
])