AWS Amplify 动态且可扩展的所有者 graphql 架构

Question

I'm struggling to find a way to make a model that can work for multiple organizations within the platform I want to build with AWS Amplify.

The use case is a sort of corporate intranet, where a user registers on the platform and has access to a Workspace. Within the Workspace, posts are created, and posts are commented on.

This is the example model:

type Workspace
@model(subscriptions: null)
@auth(
  rules: [
    { allow: owner, operations: [create, read], ownerField: "owner" }
    { allow: private, provider: iam, operations: [read, delete] }
  ]
) {
  id: ID!
  title: String!
  planCode: PlanType!
  plan: Plan! @connection(fields: ["planCode"])
  posts: [Post]! @connection(name: "workspacePosts", sortField: "createdAt")
  totalPosts: Int!
  owner: String!
}

type Post
@model(subscriptions: null)
@auth(
  rules: [
    { allow: owner, ownerField: "owner", }
  ]
) {
  id: ID!
  title: String
  workspace: Workspace! @connection(name: "workspacePosts")
  comments: [Comment]! @connection(name: "postComments")
  totalComments: Int!
  owner: String!
}

type Comment
@model(subscriptions: null)
@auth(
  rules: [
    { allow: owner, ownerField: "owner", }
  ]
) {
  id: ID!
  content: String
  post: Post! @connection(name: "postComments")
  owner: String!
}

enum PlanType {
  FREE
  BASIC
  PRO
}

The Posts, Comments and the Workspace are private and can only be viewed by the Workspace owner, who will also be the owner of the Posts and comments.

At some point, the user must be able to invite another user into his Workspace, and the new user must then be able to access all the records that the previous owner has generated (Workspace, Posts and Comments).

In this case, with the addition of the new user I am forced to:

• get all the Posts related to the Workspace
• get all the Comments related to the Posts related to the Workspace
• update every record from owner: "User_1" to owner: ["User_1", "User_2"]

Everything related to the Workspace must be visible or "owned" by every new users added to the Workspace.

Is there a more efficient way?

For example, is it possible to add an owner to the Workspace and automatically give access to all Posts and Comments related to the workspace, if the user is the owner of the Workspace?

Are there any other options?

Answer 1

对更有效方法的建议是使用 ControlTower 并且那里的任何规则都适用，特别是如果您想通过 SSO 执行此操作。