使用Amplify GraphQL可创建对象但删除遭未授权（Cognito用户池认证）

返回的错误内容：

Amplify.GraphQLError(message: "Not Authorized to access deleteLike on type Mutation", locations: Optional([Amplify.GraphQLError.Location(line: 2, column: 3)]), path: Optional([Amplify.JSONValue.string("deleteLike")])

关联Schema定义 #

type Post @model 
  @auth(rules: [
    {allow: owner, ownerField:"owner", provider: userPools, operations:[read, create, delete]}
    {allow: private, provider: userPools, operations:[read]}
  ])
{
  id: ID! @primaryKey
  type: String @index(name: "postsByDate", queryField: "postsByDate", sortKeyFields: ["createdAt"])
  content: String!
  owner: String
  createdAt: AWSDateTime
  likes: [Like] @hasMany(indexName: "likesByPost", fields: ["id"])
}

type Like @model 
  @auth(rules: [
    {allow: owner, ownerField:"user", provider: userPools, operations: [read, create, delete]}
    {allow: private, provider: userPools, operations:[read]}
  ])
{
  id: ID! @primaryKey
  postID: ID! @index(name: "likesByPost", queryField: "likesByPost", sortKeyFields: ["createdAt"])
  post: Post! @belongsTo(fields: ["postID"])
  user: String @index(name: "likesByUser", queryField: "likesByUser", sortKeyFields: ["postID"])
  createdAt: AWSDateTime
}

删除Like的Swift实现代码 #

private func removeLikeFromPost(post: Post, userID: String) async {
    let like = await getLikeFromPost(post: post, userID: userID) // 可正常获取Like
    do {
        let result = try await Amplify.API.mutate(request: .delete(like)) // 此处报错
        switch result {
        case .success(let like):
            print("INFO successfully deleted like: \(like)")
        case .failure(let error):
            print("ERROR got failed result with \(error)")
        }
    } catch let error as APIError {
        print("ERROR failed to delete a like: ", error)
    } catch {
        print("ERROR unexpected error: \(error)")
    }
}

原因排查与解决方法 #

核心原因 #

1. Like的user字段未正确赋值：Like类型的@auth规则指定ownerField:"user"，但创建Like时可能未将当前用户ID赋值给user字段，导致删除时Auth规则校验不通过——只有user字段值等于当前登录用户ID时，才能触发owner权限的delete操作。
2. Amplify自动赋值规则限制：Amplify默认只会自动将当前用户ID填充到名为owner的字段，自定义的user字段不会自动赋值，必须手动设置。

解决步骤 #

1. 创建Like时显式设置user字段：
   在创建Like的代码中，确保将当前登录用户的ID赋值给Like的user属性，示例：

   let newLike = Like(postID: post.id, user: userID) // userID为当前登录用户的ID
   let result = try await Amplify.API.mutate(request: .create(newLike))
   

2. 验证Like记录的user字段值：
   查询目标Like记录，确认user字段是否正确存储了当前用户的ID，避免空值或错误值导致权限校验失败。
3. 可选：调整Auth规则使用默认owner字段：
   如果不想自定义字段，可以将Like的@auth规则中ownerField改为默认的owner，同时修改Like类型的字段为owner: String，Amplify会自动在创建时填充当前用户ID：

   type Like @model 
     @auth(rules: [
       {allow: owner, ownerField:"owner", provider: userPools, operations: [read, create, delete]}
       {allow: private, provider: userPools, operations:[read]}
     ])
   {
     id: ID! @primaryKey
     postID: ID! @index(name: "likesByPost", queryField: "likesByPost", sortKeyFields: ["createdAt"])
     post: Post! @belongsTo(fields: ["postID"])
     owner: String @index(name: "likesByUser", queryField: "likesByUser", sortKeyFields: ["postID"])
     createdAt: AWSDateTime
   }
   

内容的提问来源于stack exchange，提问作者dauði