AWS Amplify / GraphQl - How to limit auth user api calls based on #auth owner field pointing at a many to many relationship? - amazon-web-services

Question

Which Category is your question related to?
GraphQL Api
Amplify CLI Version
10.5.1
What AWS Services are you utilizing?
AWS, Amplify, Cognito User Pools
I am trying to figure out how to limit an authorized user that is signed into to only be able to make queries like accounts they are assigned to. I do not want a auth user to be able to query accounts they are not associated with if they somehow have their account id.
So the modals I am working with are Account and User and they should have a many to many relationship. I am also using the version of amplify that uses the transformer v2 version for the graphql schema. So I cannot use the V1 setup that most documentation out there uses.
Current Schema
type Account #model #auth(rules: [
{allow: groups, groups: ["Admin"], operations: [read, create, update, delete]}
{allow: owner, ownerField: "users", operations: [read]}
]) {
id: ID!
account_name: String
products: AWSJSON
users: [User] #manyToMany(relationName: "AccountUser")
}
type User #model #auth(rules: [
{allow: groups, groups: ["Admin"], operations: [read, create, update, delete]},
{allow: owner, ownerField: "accounts", operations: [read]}
]) {
id: ID!
last_name: String
first_name: String
accounts: [Account] #manyToMany(relationName: "AccountUser")
email: AWSEmail
}
To break down what is going on the #manyToMany relationship creates a join table called AccountUser.
So the approach I was trying to go with was the multi-owner approach by setting the ownerFields. But the API throws errors like "Validation error of type FieldUndefined: Field 'accounts' in type 'AccountUser' is undefined # 'accountUsersByAccountId/items/accounts'"
I am guessing that this is because I set the ownerFields to data that at some point could have no data in it. This error showed up when I called a join table api endpoint called accountUsersByAccountId. Before I added the ownerField auth rule everything worked just fine but any auth user could query any account if they had the information.
Conclusion
I dont think I am on the right track here. I know the issue of limiting a user's ability to query certain data is a common usecase but I cannot find any examples for what I am trying to do.
From the examples I have looked at they would have me do the following. But there is no relationship for accounts and I dont think that is going to go over well if an account is deleted but the ID still exists in the user.
type User #model
#auth(rules: [
# Authorize the update mutation and both queries.
{ allow: owner, ownerField: "accounts", operations: [read] },
# Admin users can access any operation.
{ allow: groups, groups: ["Admin"] }
]) {
id: ID!
last_name: String
first_name: String
accounts: [String]
email: AWSEmail
}
I also cannot do groups cause I know there is a limit to the number of groups cognito allows and isnt sailable friendly.
Am I going about this the wrong way, can anyone let me know how they handled API limitations based on a users relationship to an account.