fix: Enhance the "unauthorized" error message with recovery instructions

[stocaaro]

Description of changes

For all graphql calls made through the generateClient interface. When a permission error is returned, this change remaps the error with a clearer error message:

UnauthorizedError: If you're calling an Amplify-generated API, make sure to set the "authMode" in generateClient({ authMode: '...' }) to the backend authorization rule's auth provider ('apiKey', 'userPool', 'iam', 'oidc', 'lambda')

Description of how you validated changes

Tested manually in sample app and by updating unit tests to cover both the call and subscription usecases.

Checklist

• PR description included
• yarn test passes
• Tests are changed or added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[svidgen]

We might want to consider a more generalized "error mapper" like we have in DataStore.

Either way, please take a look at it: https://github.com/aws-amplify/amplify-js/blob/main/packages/datastore/src/sync/processors/errorMaps.ts

We also need to make sure remapping these errors doesn't break customers (like ourselves/DataStore) who might be relying on particular error messages. E.g., will this interfere with DataStore multi-auth? (This is the main reason I'm asking for a look at the mapper regardless of whether you want to so something similar.)

[stocaaro]

I'm not opposed to an error mapper and if something like this existed, I would have used it here. Since this change is localized to this one use-case, I think an error mapper might make a good refactoring as we bring in a second error remapping use-case, right?

[stocaaro]

We've had a discussion about keeping the error message consistent with what came before. Currently these 401's are coming through with the message Unknown error (discovered through manual testing against the API), which doesn't seem specific enough to be valuable. There is prior art indicating that at one time these errors returned with the message Unauthorized. The most recent update adjust to adopt Unauthorized for clarity and consistency.

[svidgen]

Couple nits, q's.

[AllanZhengYP]

The error formation part looks good to me.

[david-mcafee]

With the exception of what Jon pointed out previously, LGTM!