Skip to content

feat(gen2-migration): add additional auth mode config in defineData independent of defaultConfig#14496

Merged
iliapolo merged 14 commits intoaws-amplify:gen2-migrationfrom
dgandhi62:codegen-auth-gen-v6
Feb 26, 2026
Merged

feat(gen2-migration): add additional auth mode config in defineData independent of defaultConfig#14496
iliapolo merged 14 commits intoaws-amplify:gen2-migrationfrom
dgandhi62:codegen-auth-gen-v6

Conversation

@dgandhi62
Copy link
Copy Markdown
Contributor

@dgandhi62 dgandhi62 commented Jan 20, 2026

Resolves #14484

Summary:

  1. This pr detaches additional authorization modes from default authorization modes in the gen2-api. This is because of the intentional design of gen2 which allows this. This removes the need for manual escape hatches.
  2. This pr removes wrong properties configured on the interface for additional auth mode
  3. This pr adds the interface for authorization modes for Gen1 (it isn't currently used, but for future refactoring)

Documentation:
https://docs.amplify.aws/gen1/android/build-a-backend/graphqlapi/customize-authz-modes/

Tests performed: Unit tests

Input

"authConfig": {
          "additionalAuthenticationProviders": [
            {
              "apiKeyConfig": {
                "apiKeyExpirationDate": "2026-02-18T15:26:24.140Z",
                "apiKeyExpirationDays": 7,
                "description": "graphql"
              },
              "authenticationType": "API_KEY"
            }
          ],
          "defaultAuthentication": {
            "authenticationType": "AMAZON_COGNITO_USER_POOLS",
            "userPoolConfig": {
              "userPoolId": "authapp4fitnesstracker1d5522f41d5522f4"
            }
          }
        },

Output

amplify/data/resource.ts

export const data = defineData({
    migratedAmplifyGen1DynamoDbTableMappings: [{
            //The "branchname" variable needs to be the same as your deployment branch if you want to reuse your Gen1 app tables
            branchName: "fitmain",
            modelNameToTableNameMapping: { WorkoutProgram: "WorkoutProgram-jprmvx2dofhndog6pqece572tm-fitmain", Exercise: "Exercise-jprmvx2dofhndog6pqece572tm-fitmain", Meal: "Meal-jprmvx2dofhndog6pqece572tm-fitmain" }
        }],
    authorizationModes: {
        defaultAuthorizationMode: "userPool",
        apiKeyAuthorizationMode: { expiresInDays: 7, description: "graphql" }
    },
    schema
});

amplify/backend.ts

const cfnGraphqlApi = backend.data.resources.cfnResources.cfnGraphqlApi;
cfnGraphqlApi.additionalAuthenticationProviders = [
    {
        authenticationType: "API_KEY"
    }
];

Instructions for future refactoring the data category code:

  1. Use the Gen1 interface as your source of truth defined here - https://github.com/dgandhi62/amplify-cli/blob/661cbac4e3217e1048c90a96de09a3e08f30f76b/packages/amplify-cli/src/commands/gen2-migration/generate/codegen-head/data_definition_fetcher.ts#L11
  2. Remove the dependence on this interface completely - https://github.com/aws-amplify/amplify-cli/pull/14496/changes#diff-b3ee254332921ebae0a8518887122bec57915d417f39e2a14aa3f80303aa9b97L7
    and print escape hatches using the Gen1 interface
  3. Remove all instances of additionalAuthProvider interface, including this function - https://github.com/dgandhi62/amplify-cli/blob/661cbac4e3217e1048c90a96de09a3e08f30f76b/packages/amplify-cli/src/commands/gen2-migration/generate/codegen-head/data_definition_fetcher.ts#L379
  4. Remove all the any typing in the code as seen here - https://github.com/dgandhi62/amplify-cli/blob/661cbac4e3217e1048c90a96de09a3e08f30f76b/packages/amplify-cli/src/commands/gen2-migration/generate/codegen-head/data_definition_fetcher.ts#L459

@dgandhi62 dgandhi62 marked this pull request as ready for review January 20, 2026 19:51
@dgandhi62 dgandhi62 requested a review from a team as a code owner January 20, 2026 19:51
@iliapolo iliapolo changed the title feat: add additional auth mode config in defineData independent of defatulConfig feat(gen2-migration): add additional auth mode config in defineData independent of defatulConfig Jan 21, 2026
@iliapolo iliapolo enabled auto-merge (squash) January 21, 2026 23:02
Copy link
Copy Markdown
Contributor

@iliapolo iliapolo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the migration guides of each individual app to remove the now un-necessary manual steps.

@dgandhi62 dgandhi62 changed the title feat(gen2-migration): add additional auth mode config in defineData independent of defatulConfig feat(gen2-migration): add additional auth mode config in defineData independent of defaultConfig Jan 22, 2026
- Process additionalAuthenticationProviders alongside default auth mode
- Refactor auth mode config generation to eliminate code duplication
- Extract common auth mode logic into reusable helper function
- Add configuration processing for default auth modes that need settings
- Handle cases where default and additional providers use same auth type
- Ensure both defaultAuthorizationMode and specific mode configs are generated
- Fix lambda auth to read ttlSeconds from provider level instead of nested config
- Fix OIDC auth to read openIDIssuerURL/openIDClientID from provider level
- Add tests for both lambda and OIDC auth with correct Gen1 format
@dgandhi62 dgandhi62 requested a review from iliapolo February 20, 2026 15:29
@iliapolo iliapolo merged commit df2cc90 into aws-amplify:gen2-migration Feb 26, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants