GraphQL lambda resolver returning Unauthorized access

Question

I have an Amplify web app configured with Cognito and API Key for authentication.

I'd like to have an un-authenticated user call a Lambda resolver, which returns a JSON response. I am able to have the user call the resolver, which then executes. But I receive the following error on the response in my front-end app:

errorType: "Unauthorized"
message: "Not Authorized to access score on type FormAssessmentResponse"
...
errorType: "Unauthorized"
message: "Not Authorized to access isInCoverageArea on type FormAssessmentResponse"

My GraphQL schema is as follows:

type FormAssessmentResponse {
  score: Int
  isInCoverageArea: Boolean
}
...
type Mutation {
  formAssessment(input: FormAssessmentInput!): FormAssessmentResponse @function(name: "formResolvers-${env}") @auth(rules: [{allow: public, provider: apiKey}])
}

My Lambda resolver (simplified) is as follows:

const formAssessment = async (event, context, callback) => {
  console.log(event.arguments.input)
  callback(null, {
    score: 54,
    isInCoverageArea: true
  })
}

const resolvers = {
  Mutation: {
    formAssessment,
  },
}

exports.handler = async (event, context, callback) => {
  const typeHandler = resolvers[event.typeName]
  if (typeHandler) {
    const resolver = typeHandler[event.fieldName]
    if (resolver) {
      return await resolver(event, context, callback)
    }
  }
  throw new Error("Resolver not found.")
}

In my frontend, I invoke the resolver as follows:

import { API } from '@aws-amplify/api'
import Auth from '@aws-amplify/auth'
import config from '../src/aws-exports'
Amplify.configure(config)

const response = await API.graphql({
        query: mutation,
        variables: variables,
        authMode: 'API_KEY'
      })

If I replace FormAssessmentResponse with simply String or AWSJSON, I can return these types from my Lambda function. Therefore, it seems to be something to do with the use of type FormAssessmentResponse.

Note, I do not want to @model the type FormAssessmentResponse, as this will create DynamoDB tables, and I do not wish for that.

good1492 good1492 · Accepted Answer · 2021-11-20T01:02:12

Turns out all I needed to do was to add @aws_api_key to the type definition:

type FormAssessmentResponse @aws_api_key {
  score: Int
  isInCoverageArea: Boolean
}

GraphQL lambda resolver returning Unauthorized access

1 Answers