From 1c213c44123ebe69b1f6ffaa4fddd959ca3d6e14 Mon Sep 17 00:00:00 2001
From: Danielle Adams <damsnmd@amazon.com>
Date: Mon, 18 Apr 2022 14:10:36 -0400
Subject: [PATCH] fix: match identifier values when populating input

---
 .../src/resolvers/field.ts                    | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/packages/amplify-graphql-auth-transformer/src/resolvers/field.ts b/packages/amplify-graphql-auth-transformer/src/resolvers/field.ts
index 7013a5a3f5f..bb010c29904 100644
--- a/packages/amplify-graphql-auth-transformer/src/resolvers/field.ts
+++ b/packages/amplify-graphql-auth-transformer/src/resolvers/field.ts
@@ -21,6 +21,7 @@ import {
   notEquals,
   obj,
   list,
+  or,
 } from 'graphql-mapping-template';
 import {
   RoleDefinition,
@@ -40,6 +41,7 @@ import {
   lambdaExpression,
   getIdentityClaimExp,
   generateOwnerClaimExpression,
+  generateOwnerClaimListExpression,
 } from './helpers';
 
 // Field Read VTL Functions
@@ -55,16 +57,29 @@ const generateDynamicAuthReadExpression = (roles: Array<RoleDefinition>, fields:
           compoundExpression([
             set(ref(`ownerEntity${idx}`), methodCall(ref('util.defaultIfNull'), ref(`ctx.source.${role.entity!}`), nul())),
             generateOwnerClaimExpression(role.claim!, `ownerClaim${idx}`),
+            generateOwnerClaimListExpression(role.claim!, idx),
             ...(entityIsList
               ? [
                 forEach(ref('allowedOwner'), ref(`ownerEntity${idx}`), [
                   iff(
-                    equals(ref('allowedOwner'), ref(`ownerClaim${idx}`)),
+                    or([
+                      equals(ref('allowedOwner'), ref(`ownerClaim${idx}`)),
+                      methodCall(ref(`ownerClaimsList${idx}.contains`), ref(`ownerEntity${idx}`)),
+                    ]),
                     compoundExpression([set(ref(IS_AUTHORIZED_FLAG), bool(true)), raw('#break')]),
                   ),
                 ]),
               ]
-              : [iff(equals(ref(`ownerEntity${idx}`), ref(`ownerClaim${idx}`)), set(ref(IS_AUTHORIZED_FLAG), bool(true)))]),
+              : [
+                iff(
+                  or([
+                    equals(ref('allowedOwner'), ref(`ownerClaim${idx}`)),
+                    methodCall(ref(`ownerClaimsList${idx}.contains`), ref(`ownerEntity${idx}`)),
+                  ]),
+                  set(ref(IS_AUTHORIZED_FLAG), bool(true)),
+                ),
+              ]
+            ),
           ]),
         ),
       );