feat: graphql auth v2 add schemaChanges, iam policy generation, and q…

…uery/read resolvers

packages/amplify-graphql-auth-transformer/package.json

@@ -30,7 +30,10 @@
     "@aws-amplify/graphql-transformer-core": "0.8.1",
     "@aws-amplify/graphql-transformer-interfaces": "1.8.1",
     "@aws-amplify/graphql-model-transformer": "0.5.1",
+    "@aws-cdk/aws-appsync": "~1.72.0",
+    "@aws-cdk/aws-dynamodb": "~1.72.0",
     "@aws-cdk/core": "~1.72.0",
+    "@aws-cdk/aws-iam": "~1.72.0",
     "constructs": "^3.0.12",
     "graphql": "^14.5.8",
     "graphql-mapping-template": "4.18.2",
@@ -39,6 +42,7 @@
   },
   "devDependencies": {
     "@types/fs-extra": "^8.0.1",
+    "@aws-cdk/assert": "~1.72.0",
     "@types/node": "^12.12.6"
   },
   "jest": {

packages/amplify-graphql-auth-transformer/src/accesscontrol/acm.ts

@@ -63,7 +63,11 @@ export class AccessControlMatrix {
     return this.roles.includes(role);
   }
 
-  public getResources(): Array<string> {
+  public getRoles(): Array<string> {
+    return this.roles;
+  }
+
+  public getResources(): Readonly<Array<string>> {
     return this.resources;
   }
 
@@ -83,6 +87,33 @@ export class AccessControlMatrix {
     }
   }
 
+  /**
+   * Given an operation returns the roles which have access to at least one resource
+   * If fullAccess is true then it returns roles which have operation access on all resources
+   * @param operation string
+   * @param fullAccess boolean
+   * @returns array of roles
+   */
+  public getRolesPerOperation(operation: string, fullAccess: boolean = false): Array<string> {
+    this.validate({ operations: [operation] });
+    const operationIndex = this.operations.indexOf(operation);
+    const roles = new Array<string>();
+    for (let x = 0; x < this.roles.length; x++) {
+      let hasOperation: boolean = false;
+      if (fullAccess) {
+        hasOperation = this.resources.every((resource, idx) => {
+          return this.matrix[x][idx][operationIndex];
+        });
+      } else {
+        hasOperation = this.resources.some((resource, idx) => {
+          return this.matrix[x][idx][operationIndex];
+        });
+      }
+      if (hasOperation) roles.push(this.roles[x]);
+    }
+    return roles;
+  }
+
   /**
    * @returns a map of role and their access
    * this object can then be used in console.table()