Fetching with predicates ignores models auth rules (DataStore)

Describe the bug Using predicates with DataStore, auth rules seem to be totally ignored if you are setting a model only accessible by the owner, and the query is call using predicates the auth owner rules is ignored and every item from the DB that fulfills the predicate logic and all items that satisfy the predicates are returned even those owned by another user.

To Reproduce Steps to reproduce the behavior:

1. Create a model with simple owner base auth rule Ex. type Item @model @auth(rules: [{ allow: owner }]) {...}
2. Generate your model and deploy your schema (pm run amplify-modelgen and amplify push)
3. Create Items from 2 different users
4. Now query those the Items using predicates Ex. await DataStore.query(Property, (c) => c.available("eq", false))
5. The response will return all the Items with key “available” false, even those from created by the other user

Expected behavior Predicates should not violate models auth rules, returning only the filtered owner models

[alexandprivate]

Hi there @ashika01 it works like a charm! I’m leaving a hint here just in case someone needs to use it

@manueliglesias this could be closed if you want.

[manueliglesias]

Hi @alexandprivate

Every operation you do on the DataStore happens locally first. What you are seeing is that your local data still has data from another user.

Here the recomendation is to clear the DataStore when a user signs out/in with:

DataStore.clear();

I noticed you brought this up in https://github.com/aws-amplify/amplify-js/issues/6108#issuecomment-664751765 too I’ll add a note there pointing here.