@auth with multiple auth types on nested types not working

I have implemented multiple authentication systems with Cognito pools as the default and ‘IAM’ as the other.

I have a city model:

`type City @model 
@key(name: "cityByName", fields: ["title"], queryField: "findCityByName")
  @auth(rules: [
    { allow: groups, groups: ["admin"], operations: [update, delete, create] },
    { allow: public, provider: iam, operations: [read] }
  ])
@searchable {
  id: ID!
  title: String!
  description: String
  country: String
  continent: String
  location: Location
  timezoneOffset: Float
  currency: String
  images: [String]
  createdAt: Float!
  updatedAt: Float!
}
`

with the nested object type ‘Location’:

type Location { lat: Float lon: Float }

Now if I run the query with IAM as the auth mode, the query gives an error:

message: “Not Authorized to access lat on type Location”

Location is a type and simply outlines the data structure for location, and I cannot apply auth rules to it unless i convert it with the @model directive, which I dont want to do.

If i removed the location fields from the query being called, the data returns just fine.

How am i meant to get the location data if I cannot apply auth rules to the location without adding the @model directive??

[dubchoi]

Oh I see, I thought we were only allowed to use the @auth directive when using amplify-cli, which it then translates to @aws_iam, etc.

For what it’s worth, I would expect the @auth rule to propagate to nested non-model types by default, but thanks for the workaround for now.

[kaustavghosh06]

@dubchoi In the above schema, the type Location is a part of the schema.graphql file defined by the annotated schema. This type Location is not generated or overwritten by the CLI and whatever auth rules like @aws_iam is mentioned out there on this type Location, is passed through as is to the de-compiled schema.