@aws-amplify/datastore
Version:
AppSyncLocal support for aws-amplify
144 lines • 6.52 kB
JavaScript
;
Object.defineProperty(exports, "__esModule", { value: true });
var tslib_1 = require("tslib");
var auth_1 = require("@aws-amplify/auth");
var api_graphql_1 = require("@aws-amplify/api-graphql");
var types_1 = require("../types");
function getProviderFromRule(rule) {
// private with no provider means userPools
if (rule.allow === 'private' && !rule.provider) {
return types_1.ModelAttributeAuthProvider.USER_POOLS;
}
// public with no provider means apiKey
if (rule.allow === 'public' && !rule.provider) {
return types_1.ModelAttributeAuthProvider.API_KEY;
}
return rule.provider;
}
function sortAuthRulesWithPriority(rules) {
var allowSortPriority = [
types_1.ModelAttributeAuthAllow.CUSTOM,
types_1.ModelAttributeAuthAllow.OWNER,
types_1.ModelAttributeAuthAllow.GROUPS,
types_1.ModelAttributeAuthAllow.PRIVATE,
types_1.ModelAttributeAuthAllow.PUBLIC,
];
var providerSortPriority = [
types_1.ModelAttributeAuthProvider.FUNCTION,
types_1.ModelAttributeAuthProvider.USER_POOLS,
types_1.ModelAttributeAuthProvider.OIDC,
types_1.ModelAttributeAuthProvider.IAM,
types_1.ModelAttributeAuthProvider.API_KEY,
];
return tslib_1.__spread(rules).sort(function (a, b) {
if (a.allow === b.allow) {
return (providerSortPriority.indexOf(getProviderFromRule(a)) -
providerSortPriority.indexOf(getProviderFromRule(b)));
}
return (allowSortPriority.indexOf(a.allow) - allowSortPriority.indexOf(b.allow));
});
}
function getAuthRules(_a) {
var rules = _a.rules, currentUser = _a.currentUser;
// Using Set to ensure uniqueness
var authModes = new Set();
rules.forEach(function (rule) {
switch (rule.allow) {
case types_1.ModelAttributeAuthAllow.CUSTOM:
// custom with no provider -> function
if (!rule.provider ||
rule.provider === types_1.ModelAttributeAuthProvider.FUNCTION) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.AWS_LAMBDA);
}
break;
case types_1.ModelAttributeAuthAllow.GROUPS:
case types_1.ModelAttributeAuthAllow.OWNER: {
// We shouldn't attempt User Pool or OIDC if there isn't an authenticated user
if (currentUser) {
if (rule.provider === types_1.ModelAttributeAuthProvider.USER_POOLS) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.AMAZON_COGNITO_USER_POOLS);
}
else if (rule.provider === types_1.ModelAttributeAuthProvider.OIDC) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.OPENID_CONNECT);
}
}
break;
}
case types_1.ModelAttributeAuthAllow.PRIVATE: {
// We shouldn't attempt private if there isn't an authenticated user
if (currentUser) {
// private with no provider means userPools
if (!rule.provider ||
rule.provider === types_1.ModelAttributeAuthProvider.USER_POOLS) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.AMAZON_COGNITO_USER_POOLS);
}
else if (rule.provider === types_1.ModelAttributeAuthProvider.IAM) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.AWS_IAM);
}
}
break;
}
case types_1.ModelAttributeAuthAllow.PUBLIC: {
if (rule.provider === types_1.ModelAttributeAuthProvider.IAM) {
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.AWS_IAM);
}
else if (!rule.provider ||
rule.provider === types_1.ModelAttributeAuthProvider.API_KEY) {
// public with no provider means apiKey
authModes.add(api_graphql_1.GRAPHQL_AUTH_MODE.API_KEY);
}
break;
}
default:
break;
}
});
return Array.from(authModes);
}
/**
* Returns an array of auth modes to try based on the schema, model, and
* authenticated user (or lack thereof). Rules are sourced from `getAuthRules`
* and returned in the order they ought to be attempted.
*
* @see sortAuthRulesWithPriority
* @see getAuthRules
*
* @param param0 The `{schema, modelName}` to inspect.
* @returns A sorted array of auth modes to attempt.
*/
exports.multiAuthStrategy = function (amplifyContext) {
return function (_a) {
var schema = _a.schema, modelName = _a.modelName;
return tslib_1.__awaiter(void 0, void 0, void 0, function () {
var currentUser, e_1, attributes, authAttribute, sortedRules;
var _b;
return tslib_1.__generator(this, function (_c) {
switch (_c.label) {
case 0:
amplifyContext.Auth = amplifyContext.Auth || auth_1.Auth;
_c.label = 1;
case 1:
_c.trys.push([1, 3, , 4]);
return [4 /*yield*/, amplifyContext.Auth.currentAuthenticatedUser()];
case 2:
currentUser = _c.sent();
return [3 /*break*/, 4];
case 3:
e_1 = _c.sent();
return [3 /*break*/, 4];
case 4:
attributes = schema.namespaces.user.models[modelName].attributes;
if (attributes) {
authAttribute = attributes.find(function (attr) { return attr.type === 'auth'; });
if ((_b = authAttribute === null || authAttribute === void 0 ? void 0 : authAttribute.properties) === null || _b === void 0 ? void 0 : _b.rules) {
sortedRules = sortAuthRulesWithPriority(authAttribute.properties.rules);
return [2 /*return*/, getAuthRules({ currentUser: currentUser, rules: sortedRules })];
}
}
return [2 /*return*/, []];
}
});
});
};
};
//# sourceMappingURL=multiAuthStrategy.js.map