Multiple auth rules on owner field

[HansKVeri99]

Amplify CLI Version

14.1.1

Question

Hi team!

I am migrating IdPs from Cognito User Pools to Auth0. For backward compatibility, I would like tokens from both providers to be valid for Appsync auth temporarily.
I have a working solution with 2 fields, one containing the Cognito sub, and the other containing an Auth0 sub.

@auth(rules: [
{allow: owner, ownerField: "auth0_sub_id", provider: oidc, identityClaim: "sub" }, 
{allow: owner, ownerField: "owner", provider: userPools}
])

However, configuring our backend to be compatible with the 2 field solution requires an extensive amount of work. Ideally, we would like a setup where the owner field could contain a sub from either provider.

Is it possible to achieve the same dual auth mode with just one field? Something like

  { allow: owner, ownerField: "owners", provider: userPools, identityClaim: "sub" },
  { allow: owner, ownerField: "owners", provider: oidc, identityClaim: "sub" }
...
  owners: [String]

This currently doesn't deploy, as running amplify push results in

• Schema Creation Status is FAILED with details: Found 1 problem(s) with the schema: The type 'ModelSubscriptionResponsesEntityFilterInput' has declared an input field with a non unique name 'owners'.

Is there any way to use the owner field for both auth rules from different providers?

[pahud]

Hi @HansKVeri99,

Issue at a Glance

┌───────────────────────────┐     ┌──────────────────────────────┐
│ Schema with 2 owner rules │──>  │ addSubscriptionArguments()   │
│ same ownerField: "owners" │     │ maps BOTH roles to input     │
│ provider: userPools + oidc│     │ fields named "owners"        │
└───────────────────────────┘     └──────────────────────────────┘
                                                │
                                                v
                                  ┌──────────────────────────────┐
                                  │ AppSync Schema Validation    │
                                  │ FAILS: duplicate field name  │
                                  │ "owners" in FilterInput      │
                                  └──────────────────────────────┘

Thank you for the detailed report. I reproduced this locally with @aws-amplify/graphql-api-construct@1.21.0 — the generated GraphQL schema produces onCreateResponses(..., owner: String, owner: String) with a duplicate subscription argument, which AppSync rejects at deploy time.

It appears this is a bug in the GraphQL auth transformer's subscription argument generation.

In my opinion, the root cause is in the addSubscriptionArguments function in amplify-category-api. When two owner auth rules share the same ownerField, the function generates duplicate input field definitions without deduplication. This causes AppSync to reject the schema with the "non unique name" error.

Interestingly, the subscription filter input generation in graphql-auth-transformer.ts (around line 449) already has deduplication logic, but the subscription argument generation path does not.

From my view, the fix would be to deduplicate the subscription arguments by entity name before creating input definitions. This would be a small change in addSubscriptionArguments or at the caller site.

For now, your current workaround with separate owner fields is the recommended approach:

@auth(rules: [
  {allow: owner, ownerField: "auth0_sub_id", provider: oidc, identityClaim: "sub"},
  {allow: owner, ownerField: "owner", provider: userPools}
])

Note: This issue is in the GraphQL transformer. Moving this issue to aws-amplify/amplify-category-api repository.