Honestly.. i find this is pretty annoying too. And thats not the only one where its restricted.. i cant even use @auth directives with tokens.

But.. if you do it from your cloud functions, and basically generate your query as a string, instead of passing that array as a variable.. it works.

ugly workaround :/