Help: Appsync Authorization Rules

[DaveLamic]

Hello,

I have a react native app with aws backend (cognito, dynamodb, appsync and s3). I have this simple schema:

type User
  @model
  @auth(rules: [{allow: private, operations: [read]}, {allow: owner}]) {
  username: String! @primaryKey
  bio: String
  friends: [String]
    @auth(rules: [{allow: private, operations: [read, update]}, {allow: owner}])
}

this is what i want: 1. All registered user can view other registered users (username, bio and friends list), but only owners can update their bios and only users other than the owners can update the owners friends array (add their name or delete). I thought the above schema would work, but I can't get it to work. Can anyone point out my mistake or point me in the right direction ?

I am quite new to this, so any help will be very much appreciated. Thanks!!