fix: forward authFilter in RDS index query to prevent cross-tenant data exposure (#3504)

Author: Simone319

packages/amplify-graphql-index-transformer/src/__tests__/amplify-graphql-index-transformer.test.ts

@@ -1479,6 +1479,8 @@ describe('Index query resolver creation', () => {
       },
       output: {
         getQueryTypeName: jest.fn().mockReturnValue('Query'),
+        getObject: jest.fn().mockReturnValue(undefined),
+        getTypeDefinitionsOfKind: jest.fn().mockReturnValue([]),
       },
       resolvers: {
         generateQueryResolver: jest.fn().mockReturnValue(mockResolver),
@@ -1502,6 +1504,30 @@ describe('Index query resolver creation', () => {
   };
 });
 
+describe('RDS index query template includes authFilter', () => {
+  it('generates VTL that forwards ctx.stash.authFilter to the SQL Lambda payload', () => {
+    const { RDSIndexVTLGenerator } = require('../resolvers/generators/rds-vtl-generator');
+    const generator = new RDSIndexVTLGenerator();
+    const mockCtx: any = {
+      resourceHelper: {
+        getModelNameMapping: jest.fn().mockReturnValue('customer'),
+      },
+      output: {
+        getObject: jest.fn().mockReturnValue(undefined),
+        getTypeDefinitionsOfKind: jest.fn().mockReturnValue([]),
+      },
+    };
+    const vtl = generator.generateIndexQueryRequestTemplate(
+      { name: 'byRep', queryField: 'listByRep' } as any,
+      mockCtx,
+      'Customer',
+      'listByRep',
+    );
+    expect(vtl).toContain('$ctx.stash.authFilter');
+    expect(vtl).toContain('lambdaInput.args.metadata.authFilter');
+  });
+});
+
 describe('auth', () => {
   const API_KEY = 'API Key Authorization';
   const IAM_AUTH_TYPE = 'IAM Authorization';

packages/amplify-graphql-index-transformer/src/resolvers/generators/rds-vtl-generator.ts

@@ -1,4 +1,10 @@
 import { TransformerContextProvider, TransformerResolverProvider } from '@aws-amplify/graphql-transformer-interfaces';
+import {
+  constructAuthFilterStatement,
+  constructNonScalarFieldsStatement,
+  constructArrayFieldsStatement,
+  constructFieldMappingInput,
+} from '@aws-amplify/graphql-transformer-core';
 import { Expression, printBlock, compoundExpression, set, ref, list, qref, methodCall, str, obj } from 'graphql-mapping-template';
 import _ from 'lodash';
 import { IndexDirectiveConfiguration, PrimaryKeyDirectiveConfiguration } from '../../types';
@@ -22,13 +28,10 @@ export class RDSIndexVTLGenerator implements IndexVTLGenerator {
         set(ref('lambdaInput.operationName'), str(operationName)),
         set(ref('lambdaInput.args.metadata'), obj({})),
         set(ref('lambdaInput.args.metadata.keys'), list([])),
-        set(ref('lambdaInput.args.metadata.fieldMap'), obj({})),
-        qref(
-          methodCall(
-            ref('lambdaInput.args.metadata.fieldMap.putAll'),
-            methodCall(ref('util.defaultIfNull'), ref('context.stash.fieldMap'), obj({})),
-          ),
-        ),
+        constructAuthFilterStatement('lambdaInput.args.metadata.authFilter'),
+        constructNonScalarFieldsStatement(tableName, ctx),
+        constructArrayFieldsStatement(tableName, ctx),
+        constructFieldMappingInput(),
         qref(
           methodCall(ref('lambdaInput.args.metadata.keys.addAll'), methodCall(ref('util.defaultIfNull'), ref('ctx.stash.keys'), list([]))),
         ),