@aws-amplify/api-graphql 4.0.23 → 4.0.24-unstable.873a6f4.0

package/src/internals/InternalGraphQLAPI.ts

@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0
 import {
 	DocumentNode,
-	GraphQLError,
 	OperationDefinitionNode,
 	OperationTypeNode,
 	parse,
@@ -25,14 +24,20 @@ import {
 import { CustomHeaders, RequestOptions } from '@aws-amplify/data-schema-types';
 
 import { AWSAppSyncRealTimeProvider } from '../Providers/AWSAppSyncRealTimeProvider';
-import {
-	GraphQLAuthError,
-	GraphQLOperation,
-	GraphQLOptions,
-	GraphQLResult,
-} from '../types';
+import { GraphQLOperation, GraphQLOptions, GraphQLResult } from '../types';
 import { resolveConfig, resolveLibraryOptions } from '../utils';
-import { repackageUnauthError } from '../utils/errors/repackageAuthError';
+import { repackageUnauthorizedError } from '../utils/errors/repackageAuthError';
+import {
+	NO_API_KEY,
+	NO_AUTH_TOKEN_HEADER,
+	NO_ENDPOINT,
+	NO_SIGNED_IN_USER,
+	NO_VALID_AUTH_TOKEN,
+	NO_VALID_CREDENTIALS,
+} from '../utils/errors/constants';
+import { GraphQLApiError, createGraphQLResultWithError } from '../utils/errors';
+
+import { isGraphQLResponseWithErrors } from './utils/runtimeTypeGuards/isGraphQLResponseWithErrors';
 
 const USER_AGENT_HEADER = 'x-amz-user-agent';
 
@@ -76,7 +81,7 @@ export class InternalGraphQLAPIClass {
 		switch (authMode) {
 			case 'apiKey':
 				if (!apiKey) {
-					throw new Error(GraphQLAuthError.NO_API_KEY);
+					throw new GraphQLApiError(NO_API_KEY);
 				}
 				headers = {
 					'X-Api-Key': apiKey,
@@ -85,33 +90,44 @@ export class InternalGraphQLAPIClass {
 			case 'iam': {
 				const session = await amplify.Auth.fetchAuthSession();
 				if (session.credentials === undefined) {
-					throw new Error(GraphQLAuthError.NO_CREDENTIALS);
+					throw new GraphQLApiError(NO_VALID_CREDENTIALS);
 				}
 				break;
 			}
 			case 'oidc':
-			case 'userPool':
+			case 'userPool': {
+				let token: string | undefined;
+
 				try {
-					const token = (
+					token = (
 						await amplify.Auth.fetchAuthSession()
 					).tokens?.accessToken.toString();
-
-					if (!token) {
-						throw new Error(GraphQLAuthError.NO_FEDERATED_JWT);
-					}
-					headers = {
-						Authorization: token,
-					};
 				} catch (e) {
-					throw new Error(GraphQLAuthError.NO_CURRENT_USER);
+					// fetchAuthSession failed
+					throw new GraphQLApiError({
+						...NO_SIGNED_IN_USER,
+						underlyingError: e,
+					});
+				}
+
+				// `fetchAuthSession()` succeeded but didn't return `tokens`.
+				// This may happen when unauthenticated access is enabled and there is
+				// no user signed in.
+				if (!token) {
+					throw new GraphQLApiError(NO_VALID_AUTH_TOKEN);
 				}
+
+				headers = {
+					Authorization: token,
+				};
 				break;
+			}
 			case 'lambda':
 				if (
 					typeof additionalHeaders === 'object' &&
 					!additionalHeaders.Authorization
 				) {
-					throw new Error(GraphQLAuthError.NO_AUTH_TOKEN);
+					throw new GraphQLApiError(NO_AUTH_TOKEN_HEADER);
 				}
 
 				headers = {
@@ -350,18 +366,15 @@ export class InternalGraphQLAPIClass {
 		const endpoint = customEndpoint || appSyncGraphqlEndpoint;
 
 		if (!endpoint) {
-			const error = new GraphQLError('No graphql endpoint provided.');
-			// TODO(Eslint): refactor this to throw an Error instead of a plain object
-			// eslint-disable-next-line no-throw-literal
-			throw {
-				data: {},
-				errors: [error],
-			};
+			throw createGraphQLResultWithError<T>(new GraphQLApiError(NO_ENDPOINT));
 		}
 
 		let response: any;
 
 		try {
+			// See the inline doc of the REST `post()` API for possible errors to be thrown.
+			// As these errors are catastrophic they should be caught and handled by GraphQL
+			// API consumers.
 			const { body: responseBody } = await this._api.post(amplify, {
 				url: new AmplifyUrl(endpoint),
 				options: {
@@ -373,39 +386,20 @@ export class InternalGraphQLAPIClass {
 				abortController,
 			});
 
-			const result = await responseBody.json();
-
-			response = result;
-		} catch (err) {
-			// If the exception is because user intentionally
-			// cancelled the request, do not modify the exception
-			// so that clients can identify the exception correctly.
-			if (this.isCancelError(err)) {
-				throw err;
+			response = await responseBody.json();
+		} catch (error) {
+			if (this.isCancelError(error)) {
+				throw error;
 			}
 
-			response = {
-				data: {},
-				errors: [
-					new GraphQLError(
-						(err as any).message,
-						null,
-						null,
-						null,
-						null,
-						err as any,
-					),
-				],
-			};
+			response = createGraphQLResultWithError<T>(error as any);
 		}
 
-		const { errors } = response;
-
-		if (errors && errors.length) {
-			throw repackageUnauthError(response);
+		if (isGraphQLResponseWithErrors(response)) {
+			throw repackageUnauthorizedError(response);
 		}
 
-		return response;
+		return response as unknown as GraphQLResult<T>;
 	}
 
 	/**
@@ -463,7 +457,7 @@ export class InternalGraphQLAPIClass {
 			.pipe(
 				catchError(e => {
 					if (e.errors) {
-						throw repackageUnauthError(e);
+						throw repackageUnauthorizedError(e);
 					}
 					throw e;
 				}),

package/src/internals/utils/runtimeTypeGuards/isGraphQLResponseWithErrors.ts

@@ -0,0 +1,15 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { GraphQLResult } from '../../../types';
+
+export function isGraphQLResponseWithErrors(
+	response: unknown,
+): response is GraphQLResult {
+	if (!response) {
+		return false;
+	}
+	const r = response as GraphQLResult;
+
+	return Array.isArray(r.errors) && r.errors.length > 0;
+}

package/src/types/index.ts

@@ -7,6 +7,7 @@ import {
 	CustomQueries,
 	CustomSubscriptions,
 	EnumTypes,
+	ModelSortDirection,
 	ModelTypes,
 } from '@aws-amplify/data-schema-types';
 import { DocumentNode, GraphQLError, Source } from 'graphql';
@@ -464,6 +465,7 @@ export type QueryArgs = Record<string, unknown>;
 export interface ListArgs extends Record<string, unknown> {
 	selectionSet?: string[];
 	filter?: Record<string, unknown>;
+	sortDirection?: ModelSortDirection;
 	headers?: CustomHeaders;
 }
 

package/src/utils/errors/constants.ts

@@ -0,0 +1,56 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { AmplifyErrorParams } from '@aws-amplify/core/internals/utils';
+
+import { GraphQLAuthError } from '../../types';
+
+export const NO_API_KEY: AmplifyErrorParams = {
+	name: 'NoApiKey',
+	// ideal: No API key configured.
+	message: GraphQLAuthError.NO_API_KEY,
+	recoverySuggestion:
+		'The API request was made with `authMode: "apiKey"` but no API Key was passed into `Amplify.configure()`. Review if your API key is passed into the `Amplify.configure()` function.',
+};
+
+export const NO_VALID_CREDENTIALS: AmplifyErrorParams = {
+	name: 'NoCredentials',
+	// ideal: No auth credentials available.
+	message: GraphQLAuthError.NO_CREDENTIALS,
+	recoverySuggestion: `The API request was made with \`authMode: "iam"\` but no authentication credentials are available.
+
+If you intended to make a request using an authenticated role, review if your user is signed in before making the request.
+
+If you intend to make a request using an unauthenticated role or also known as "guest access", verify if "Auth.Cognito.allowGuestAccess" is set to "true" in the \`Amplify.configure()\` function.`,
+};
+
+export const NO_VALID_AUTH_TOKEN: AmplifyErrorParams = {
+	name: 'NoValidAuthTokens',
+	// ideal: No valid JWT auth token provided to make the API request..
+	message: GraphQLAuthError.NO_FEDERATED_JWT,
+	recoverySuggestion:
+		'If you intended to make an authenticated API request, review if the current user is signed in.',
+};
+
+export const NO_SIGNED_IN_USER: AmplifyErrorParams = {
+	name: 'NoSignedUser',
+	// ideal: Couldn't retrieve authentication credentials to make the API request.
+	message: GraphQLAuthError.NO_CURRENT_USER,
+	recoverySuggestion:
+		'Review the underlying exception field for more details. If you intended to make an authenticated API request, review if the current user is signed in.',
+};
+
+export const NO_AUTH_TOKEN_HEADER: AmplifyErrorParams = {
+	name: 'NoAuthorizationHeader',
+	// ideal: Authorization header not specified.
+	message: GraphQLAuthError.NO_AUTH_TOKEN,
+	recoverySuggestion:
+		'The API request was made with `authMode: "lambda"` but no `authToken` is set. Review if a valid authToken is passed into the request options or in the `Amplify.configure()` function.',
+};
+
+export const NO_ENDPOINT: AmplifyErrorParams = {
+	name: 'NoEndpoint',
+	message: 'No GraphQL endpoint configured in `Amplify.configure()`.',
+	recoverySuggestion:
+		'Review if the GraphQL API endpoint is set in the `Amplify.configure()` function.',
+};

package/src/utils/errors/createGraphQLResultWithError.ts

@@ -0,0 +1,15 @@
+// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+import { GraphQLError } from 'graphql';
+
+import { GraphQLResult } from '../../types';
+
+export const createGraphQLResultWithError = <T>(
+	error: Error,
+): GraphQLResult<T> => {
+	return {
+		data: {} as T,
+		errors: [new GraphQLError(error.message, null, null, null, null, error)],
+	};
+};

package/src/utils/errors/index.ts

@@ -4,3 +4,4 @@
 export { GraphQLApiError } from './GraphQLApiError';
 export { assertValidationError } from './assertValidationError';
 export { APIValidationErrorCode, validationErrorMap } from './validation';
+export { createGraphQLResultWithError } from './createGraphQLResultWithError';

package/src/utils/errors/repackageAuthError.ts

@@ -1,23 +1,21 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
-import { AmplifyErrorParams } from '@aws-amplify/core/internals/utils';
-
-interface ErrorObject {
-	errors: AmplifyErrorParams[];
-}
+import { GraphQLResult } from '../../types';
 
 /**
  * Checks to see if the given response or subscription message contains an
- * unauth error. If it does, it changes the error message to include instructions
+ * Unauthorized error. If it does, it changes the error message to include instructions
  * for the app developer.
  */
-export function repackageUnauthError<T extends ErrorObject>(content: T): T {
+export function repackageUnauthorizedError<T extends GraphQLResult<any>>(
+	content: T,
+): T {
 	if (content.errors && Array.isArray(content.errors)) {
 		content.errors.forEach(e => {
-			if (isUnauthError(e)) {
+			if (isUnauthorizedError(e)) {
 				e.message = 'Unauthorized';
-				e.recoverySuggestion =
+				(e as any).recoverySuggestion =
 					`If you're calling an Amplify-generated API, make sure ` +
 					`to set the "authMode" in generateClient({ authMode: '...' }) to the backend authorization ` +
 					`rule's auth provider ('apiKey', 'userPool', 'iam', 'oidc', 'lambda')`;
@@ -28,7 +26,7 @@ export function repackageUnauthError<T extends ErrorObject>(content: T): T {
 	return content;
 }
 
-function isUnauthError(error: any): boolean {
+function isUnauthorizedError(error: any): boolean {
 	// Error pattern corresponding to appsync calls
 	if (error?.originalError?.name?.startsWith('UnauthorizedException')) {
 		return true;

package/src/utils/resolveOwnerFields.ts

@@ -42,7 +42,10 @@ export function resolveOwnerFields(model: Model): string[] {
 			for (const rule of attr.properties.rules) {
 				if (rule.allow === 'owner') {
 					ownerFields.add(rule.ownerField || 'owner');
-				} else if (rule.allow === 'groups') {
+				} else if (rule.allow === 'groups' && rule.groupsField !== undefined) {
+					// only valid for dynamic group(s)
+					// static group auth will have an array of predefined groups in the attribute, groups: string[]
+					// but `groupsField` will be undefined
 					ownerFields.add(rule.groupsField);
 				}
 			}