Best way to handle many to one ownership over an item?

[timber willow]

So I have two tables:

const Org = a
.model({
orgId: a.id().required()
users: a.hasMany('User', 'OrgId')
})
.identifier(['orgId'])
.authorization((allow) => [
allow...
])

const User = a
.model({
userId: a.id().required()
users: a.belongsTo('Org', 'orgId')
})
.identifier(['userId'])
.authorization((allow) => [
allow.ownerDefinedIn('userId').to(['read'])
])

So the idea is that the org contains details associated with that org and then each org has many users that can access the org's data.

The problem is, I'm not sure how to handle this in an elegant way. Ideally, the owners would just be defined by the userIds of all the user entries that are attached to the Org but I'm not sure how to do that automatically... The closest I can see is the ownersDefinedIn() method, but that requires me to add userIds manually to the generated owners array? Which seems like a hacky way of doing it.

Any thoughts?

[timber willow]

What I have atm is ownersDefinedIn('authUsers') and then when a new user is created, I append their userId to the authUsers array on the Org entry

Is this the best way to do it?

[timber willow]

I am now also trying to find the best way of managing a many to one to many relationship

Allowing users to access other table entries that are linked to the Org based upon whether that user has ownership over that Org

The options seem to be either adding authUser entries in all children table entries to the Org (not a great approach as if a new user is added, all the entries need to be updated) or use a lambda function as a middleman to check whether they have auth rather than calling the appsync API directly

The first approach is just not feasible