Skip to content

Updated docs for real-time multi-group authorization #5087

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 22, 2023
Merged

Updated docs for real-time multi-group authorization #5087

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4566806
Updated docs for real-time multi-group authorization
Feb 3, 2023
a91c5cf
Update authorization-rules.mdx
renebrandel Feb 3, 2023
ed649de
fixed typo
Feb 3, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions src/pages/cli-legacy/graphql-transformer/auth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -570,10 +570,6 @@ When `@auth` is used subscriptions have a few subtle behavior differences than q

Alternatively, when the model is protected using the static group auth strategy, the subscription request will only succeed if the user is in an allowed group. Further, the user will only get notifications of updates to records if they are in an allowed group. Note: You don't need to pass the user as an argument in the subscription request, since the resolver will instead check the contents of your JWT token.

<Callout>
Dynamic groups have no impact to subscriptions. You will not get notified of any updates to them.
</Callout>

For example suppose you have the following schema:

```graphql
Expand Down
6 changes: 5 additions & 1 deletion src/pages/cli/graphql/authorization-rules.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,11 @@ With dynamic group authorization, each record contains an attribute specifying w

By default, `group` authorization leverages Amazon Cognito user pool groups but you can also use OpenID Connect with `group` authorization. See [OpenID Connect as an authorization provider](#using-oidc-authorization-provider).

**Known limitation**: Real-time subscriptions are not supported for dynamic group authorization.
**Known limitations for real-time subscriptions when using dynamic group authorization**:
1. If you authorize based on a single group per record, then subscriptions are only supported if the user is part of 5 or fewer user groups
2. If you authorize via an array of groups (`groups: [String]` example above),
- subscriptions are only supported if the user is part of 20 or fewer groups
- you can only authorize 20 or fewer user groups per record

### Custom authorization rule

Expand Down