認可ルールをカスタマイズする

const schema = a.schema({
  Post: a.model({
    content: a.string()
  }).authorization(allow => [
    // Allow anyone auth'd with an API key to read everyone's posts.
    allow.publicApiKey().to(['read']),
    // Allow signed-in user to create, read, update,
    // and delete their __OWN__ posts.
    allow.owner(),
  ])
})

const schema = a.schema({
  // Because no model-level authorization rule is present
  // this model will use the global authorization rule.
  Todo: a.model({
    content: a.string()
  }),

  // Will use model-level authorization rule
  Notes: a.model({
    content: a.string()
    // [Model-level authorization rule]
  }).authorization(allow => [allow.publicApiKey().to(['read'])])

// [Global authorization rule]
}).authorization(allow => [
  allow.publicApiKey()
])

const schema = a.schema({
  Post: a.model({
    content: a.string(),
    createdBy: a.string()
    // [Model-level authorization rule]
    // All fields (content, createdBy) will be protected by
    // this authorization rule
  }).authorization(allow => [
    allow.publicApiKey().to(['read']),
    allow.owner(),
  ])
})

const schema = a.schema({
  Employee: a.model({
    name: a.string(),
    email: a.string(),
    // [Field-level authorization rule]
    // This auth rule will be used for the "ssn" field
    // All other fields will use the model-level auth rule
    ssn: a.string().authorization(allow => [allow.owner()]),
  })

  // [Model-level authorization rule]
  .authorization(allow => [
    allow.authenticated().to(["read"]),
    allow.owner()
  ]),
});

const schema = a.schema({
  // ...
  listCustomType: a
    .query()
    .returns(a.ref("CustomType").array())
    .handler(
      a.handler.custom({
        entry: "./handler.js",
      })
    )
    .authorization((allow) => [
      // Static auth rules - Supported
      allow.guest(),
      allow.publicApiKey(),
      allow.authenticated(),
      allow.group("Admin"),
      allow.groups(["Teacher", "Student"]),

      // Dynamic auth rules - Not supported
      allow.owner(),
      allow.ownerDefinedIn("owner"),
      allow.ownersDefinedIn("otherOwners"),
      allow.groupDefinedIn("group"),
      allow.groupsDefinedIn("otherGroups"),
    ]),
});

const schema = a.schema({
  Post: a.model({
    title: a.string(),
    content: a.string()
  }).authorization(allow => [
    allow.guest().to(["read"]),
    allow.owner()
  ])
})

import { generateClient } from 'aws-amplify/data'
import type { Schema } from '@/amplify/data/resource' // Path to your backend resource definition

const client = generateClient<Schema>()

// Creating a post is restricted to Cognito User Pools
const { data: newPostResult , errors } = await client.models.Post.create({
	query: queries.createPost,
	variables: { input: { title: 'Hello World' } },
	authMode: 'userPool',
});

// Listing posts is available to unauthenticated users (verified by Amazon Cognito identity pool's unauthenticated role)
const { data: listPostsResult , errors } = await client.models.Post.list({
	query: queries.listPosts,
	authMode: 'identityPool',
});

const schema = a.schema({
  Counter: a.customType({
    value: a.integer(),
  })
  .authorization(...), // <-- not supported
  getCounter: a
    .mutation()
    .arguments({
      id: a.string().required(),
    })
    .returns(a.ref("Counter"))
    .handler(
      a.handler.custom({
        entry: "./getCounter.js",
      })
    )
    .authorization((allow) => [allow.authenticated()]),
});

export type Schema = ClientSchema<typeof schema>;

export const data = defineData({
  schema: schema,
  authorizationModes: {
    defaultAuthorizationMode: "userPool",
  },
});