@aws-amplify/datastore 4.7.6-api-v6-models.b3abc9b.0 → 5.0.0

package/lib-esm/sync/processors/subscription.js

@@ -1,19 +1,14 @@
-import { __assign, __awaiter, __generator, __read, __spread } from "tslib";
-// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0
-import { GRAPHQL_AUTH_MODE } from '@aws-amplify/api';
 import { InternalAPI } from '@aws-amplify/api/internals';
-import { Auth } from '@aws-amplify/auth';
-import { Cache } from '@aws-amplify/cache';
-import { Category, ConsoleLogger as Logger, DataStoreAction, Hub, BackgroundProcessManager, } from '@aws-amplify/core';
-import { CONTROL_MSG as PUBSUB_CONTROL_MSG } from '@aws-amplify/pubsub';
-import Observable from 'zen-observable-ts';
+import { Hub, fetchAuthSession, ConsoleLogger, } from '@aws-amplify/core';
+import { Category, DataStoreAction, BackgroundProcessManager, } from '@aws-amplify/core/internals/utils';
+import { Observable } from 'rxjs';
 import { ProcessName, } from '../../types';
 import { buildSubscriptionGraphQLOperation, getAuthorizationRules, getModelAuthModes, getUserGroupsFromToken, TransformerMutationType, getTokenForCustomAuth, predicateToGraphQLFilter, RTFError, generateRTFRemediation, } from '../utils';
 import { ModelPredicateCreator } from '../../predicates';
 import { validatePredicate } from '../../util';
 import { getSubscriptionErrorType } from './errorMaps';
-var logger = new Logger('DataStore');
+import { CONTROL_MSG as PUBSUB_CONTROL_MSG } from '@aws-amplify/api-graphql';
+const logger = new ConsoleLogger('DataStore');
 export var CONTROL_MSG;
 (function (CONTROL_MSG) {
     CONTROL_MSG["CONNECTED"] = "CONNECTED";
@@ -24,14 +19,10 @@ export var USER_CREDENTIALS;
     USER_CREDENTIALS[USER_CREDENTIALS["unauth"] = 1] = "unauth";
     USER_CREDENTIALS[USER_CREDENTIALS["auth"] = 2] = "auth";
 })(USER_CREDENTIALS || (USER_CREDENTIALS = {}));
-var SubscriptionProcessor = /** @class */ (function () {
-    function SubscriptionProcessor(schema, syncPredicates, amplifyConfig, authModeStrategy, errorHandler, amplifyContext) {
-        if (amplifyConfig === void 0) { amplifyConfig = {}; }
-        if (amplifyContext === void 0) { amplifyContext = {
-            Auth: Auth,
-            InternalAPI: InternalAPI,
-            Cache: Cache,
-        }; }
+class SubscriptionProcessor {
+    constructor(schema, syncPredicates, amplifyConfig = {}, authModeStrategy, errorHandler, amplifyContext = {
+        InternalAPI,
+    }) {
         this.schema = schema;
         this.syncPredicates = syncPredicates;
         this.amplifyConfig = amplifyConfig;
@@ -42,20 +33,17 @@ var SubscriptionProcessor = /** @class */ (function () {
         this.buffer = [];
         this.runningProcesses = new BackgroundProcessManager();
     }
-    SubscriptionProcessor.prototype.buildSubscription = function (namespace, model, transformerMutationType, userCredentials, cognitoTokenPayload, oidcTokenPayload, authMode, filterArg) {
-        if (filterArg === void 0) { filterArg = false; }
-        var aws_appsync_authenticationType = this.amplifyConfig.aws_appsync_authenticationType;
-        var _a = this.getAuthorizationInfo(model, userCredentials, aws_appsync_authenticationType, cognitoTokenPayload, oidcTokenPayload, authMode) || {}, isOwner = _a.isOwner, ownerField = _a.ownerField, ownerValue = _a.ownerValue;
-        var _b = __read(buildSubscriptionGraphQLOperation(namespace, model, transformerMutationType, isOwner, ownerField, filterArg), 3), opType = _b[0], opName = _b[1], query = _b[2];
-        return { authMode: authMode, opType: opType, opName: opName, query: query, isOwner: isOwner, ownerField: ownerField, ownerValue: ownerValue };
-    };
-    SubscriptionProcessor.prototype.getAuthorizationInfo = function (model, userCredentials, defaultAuthType, cognitoTokenPayload, oidcTokenPayload, authMode) {
-        if (cognitoTokenPayload === void 0) { cognitoTokenPayload = {}; }
-        if (oidcTokenPayload === void 0) { oidcTokenPayload = {}; }
-        var rules = getAuthorizationRules(model);
+    buildSubscription(namespace, model, transformerMutationType, userCredentials, oidcTokenPayload, authMode, filterArg = false) {
+        const { aws_appsync_authenticationType } = this.amplifyConfig;
+        const { isOwner, ownerField, ownerValue } = this.getAuthorizationInfo(model, userCredentials, aws_appsync_authenticationType, oidcTokenPayload, authMode) || {};
+        const [opType, opName, query] = buildSubscriptionGraphQLOperation(namespace, model, transformerMutationType, isOwner, ownerField, filterArg);
+        return { authMode, opType, opName, query, isOwner, ownerField, ownerValue };
+    }
+    getAuthorizationInfo(model, userCredentials, defaultAuthType, oidcTokenPayload, authMode) {
+        const rules = getAuthorizationRules(model);
         // Return null if user doesn't have proper credentials for private API with IAM auth
-        var iamPrivateAuth = authMode === GRAPHQL_AUTH_MODE.AWS_IAM &&
-            rules.find(function (rule) { return rule.authStrategy === 'private' && rule.provider === 'iam'; });
+        const iamPrivateAuth = authMode === 'iam' &&
+            rules.find(rule => rule.authStrategy === 'private' && rule.provider === 'iam');
         if (iamPrivateAuth && userCredentials === USER_CREDENTIALS.unauth) {
             return null;
         }
@@ -63,72 +51,45 @@ var SubscriptionProcessor = /** @class */ (function () {
         // if rule(s) have group authorization as well as if either the Cognito or
         // OIDC token has a groupClaim. If so, we are returning auth info before
         // any further owner-based auth checks.
-        var groupAuthRules = rules.filter(function (rule) {
-            return rule.authStrategy === 'groups' &&
-                ['userPools', 'oidc'].includes(rule.provider);
-        });
-        var validGroup = (authMode === GRAPHQL_AUTH_MODE.AMAZON_COGNITO_USER_POOLS ||
-            authMode === GRAPHQL_AUTH_MODE.OPENID_CONNECT) &&
-            groupAuthRules.find(function (groupAuthRule) {
+        const groupAuthRules = rules.filter(rule => rule.authStrategy === 'groups' &&
+            ['userPools', 'oidc'].includes(rule.provider));
+        const validGroup = (authMode === 'oidc' || authMode === 'userPool') &&
+            groupAuthRules.find(groupAuthRule => {
                 // validate token against groupClaim
-                var cognitoUserGroups = getUserGroupsFromToken(cognitoTokenPayload, groupAuthRule);
-                var oidcUserGroups = getUserGroupsFromToken(oidcTokenPayload, groupAuthRule);
-                return __spread(cognitoUserGroups, oidcUserGroups).find(function (userGroup) {
-                    return groupAuthRule.groups.find(function (group) { return group === userGroup; });
-                });
+                if (oidcTokenPayload) {
+                    const oidcUserGroups = getUserGroupsFromToken(oidcTokenPayload, groupAuthRule);
+                    return [...oidcUserGroups].find(userGroup => {
+                        return groupAuthRule.groups.find(group => group === userGroup);
+                    });
+                }
             });
         if (validGroup) {
             return {
-                authMode: authMode,
+                authMode,
                 isOwner: false,
             };
         }
-        // Owner auth needs additional values to be returned in order to create the subscription with
-        // the correct parameters so we are getting the owner value from the Cognito token via the
-        // identityClaim from the auth rule.
-        var cognitoOwnerAuthRules = authMode === GRAPHQL_AUTH_MODE.AMAZON_COGNITO_USER_POOLS
-            ? rules.filter(function (rule) {
-                return rule.authStrategy === 'owner' && rule.provider === 'userPools';
-            })
-            : [];
-        var ownerAuthInfo;
-        cognitoOwnerAuthRules.forEach(function (ownerAuthRule) {
-            var _a;
-            var ownerValue = cognitoTokenPayload[ownerAuthRule.identityClaim];
-            // AuthZ for "list of owners" is handled dynamically in the subscription auth request
-            // resolver. It doesn't rely on a subscription arg.
-            // Only pass a subscription arg for single owner auth
-            var singleOwner = ((_a = model.fields[ownerAuthRule.ownerField]) === null || _a === void 0 ? void 0 : _a.isArray) !== true;
-            var isOwnerArgRequired = singleOwner && !ownerAuthRule.areSubscriptionsPublic;
-            if (ownerValue) {
-                ownerAuthInfo = {
-                    authMode: GRAPHQL_AUTH_MODE.AMAZON_COGNITO_USER_POOLS,
-                    isOwner: isOwnerArgRequired,
-                    ownerField: ownerAuthRule.ownerField,
-                    ownerValue: ownerValue,
-                };
-            }
-        });
+        let ownerAuthInfo;
         if (ownerAuthInfo) {
             return ownerAuthInfo;
         }
         // Owner auth needs additional values to be returned in order to create the subscription with
         // the correct parameters so we are getting the owner value from the OIDC token via the
         // identityClaim from the auth rule.
-        var oidcOwnerAuthRules = authMode === GRAPHQL_AUTH_MODE.OPENID_CONNECT
-            ? rules.filter(function (rule) { return rule.authStrategy === 'owner' && rule.provider === 'oidc'; })
+        const oidcOwnerAuthRules = authMode === 'oidc' || authMode === 'userPool'
+            ? rules.filter(rule => rule.authStrategy === 'owner' &&
+                (rule.provider === 'oidc' || rule.provider === 'userPools'))
             : [];
-        oidcOwnerAuthRules.forEach(function (ownerAuthRule) {
-            var _a;
-            var ownerValue = oidcTokenPayload[ownerAuthRule.identityClaim];
-            var singleOwner = ((_a = model.fields[ownerAuthRule.ownerField]) === null || _a === void 0 ? void 0 : _a.isArray) !== true;
-            var isOwnerArgRequired = singleOwner && !ownerAuthRule.areSubscriptionsPublic;
+        oidcOwnerAuthRules.forEach(ownerAuthRule => {
+            const ownerValue = oidcTokenPayload[ownerAuthRule.identityClaim];
+            const singleOwner = model.fields[ownerAuthRule.ownerField]?.isArray !== true;
+            const isOwnerArgRequired = singleOwner && !ownerAuthRule.areSubscriptionsPublic;
             if (ownerValue) {
                 ownerAuthInfo = {
-                    authMode: GRAPHQL_AUTH_MODE.OPENID_CONNECT,
+                    authMode,
                     isOwner: isOwnerArgRequired,
                     ownerField: ownerAuthRule.ownerField,
-                    ownerValue: ownerValue,
+                    ownerValue: String(ownerValue),
                 };
             }
         });
@@ -140,366 +101,255 @@ var SubscriptionProcessor = /** @class */ (function () {
             authMode: authMode || defaultAuthType,
             isOwner: false,
         };
-    };
-    SubscriptionProcessor.prototype.hubQueryCompletionListener = function (completed, capsule) {
-        var event = capsule.payload.event;
+    }
+    hubQueryCompletionListener(completed, capsule) {
+        const { payload: { event }, } = capsule;
         if (event === PUBSUB_CONTROL_MSG.SUBSCRIPTION_ACK) {
             completed();
         }
-    };
-    SubscriptionProcessor.prototype.start = function () {
-        var _this = this;
+    }
+    start() {
         this.runningProcesses =
             this.runningProcesses || new BackgroundProcessManager();
-        var ctlObservable = new Observable(function (observer) {
-            var promises = [];
+        const ctlObservable = new Observable(observer => {
+            const promises = [];
             // Creating subs for each model/operation combo so they can be unsubscribed
             // independently, since the auth retry behavior is asynchronous.
-            var subscriptions = {};
-            var cognitoTokenPayload, oidcTokenPayload;
-            var userCredentials = USER_CREDENTIALS.none;
-            _this.runningProcesses.add(function () { return __awaiter(_this, void 0, void 0, function () {
-                var credentials, err_1, session, err_2, _a, aws_cognito_region, AuthConfig, token, federatedInfo, currentUser, payload, err_3;
-                var _this = this;
-                return __generator(this, function (_b) {
-                    switch (_b.label) {
-                        case 0:
-                            _b.trys.push([0, 2, , 3]);
-                            return [4 /*yield*/, this.amplifyContext.Auth.currentCredentials()];
-                        case 1:
-                            credentials = _b.sent();
-                            userCredentials = credentials.authenticated
-                                ? USER_CREDENTIALS.auth
-                                : USER_CREDENTIALS.unauth;
-                            return [3 /*break*/, 3];
-                        case 2:
-                            err_1 = _b.sent();
-                            return [3 /*break*/, 3];
-                        case 3:
-                            _b.trys.push([3, 5, , 6]);
-                            return [4 /*yield*/, this.amplifyContext.Auth.currentSession()];
-                        case 4:
-                            session = _b.sent();
-                            cognitoTokenPayload = session.getIdToken().decodePayload();
-                            return [3 /*break*/, 6];
-                        case 5:
-                            err_2 = _b.sent();
-                            return [3 /*break*/, 6];
-                        case 6:
-                            _b.trys.push([6, 11, , 12]);
-                            _a = this.amplifyConfig, aws_cognito_region = _a.aws_cognito_region, AuthConfig = _a.Auth;
-                            if (!aws_cognito_region || (AuthConfig && !AuthConfig.region)) {
-                                throw 'Auth is not configured';
-                            }
-                            token = void 0;
-                            return [4 /*yield*/, this.amplifyContext.Cache.getItem('federatedInfo')];
-                        case 7:
-                            federatedInfo = _b.sent();
-                            if (!federatedInfo) return [3 /*break*/, 8];
-                            token = federatedInfo.token;
-                            return [3 /*break*/, 10];
-                        case 8: return [4 /*yield*/, this.amplifyContext.Auth.currentAuthenticatedUser()];
-                        case 9:
-                            currentUser = _b.sent();
-                            if (currentUser) {
-                                token = currentUser.token;
-                            }
-                            _b.label = 10;
-                        case 10:
-                            if (token) {
-                                payload = token.split('.')[1];
-                                oidcTokenPayload = JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
-                            }
-                            return [3 /*break*/, 12];
-                        case 11:
-                            err_3 = _b.sent();
-                            logger.debug('error getting OIDC JWT', err_3);
-                            return [3 /*break*/, 12];
-                        case 12:
-                            Object.values(this.schema.namespaces).forEach(function (namespace) {
-                                Object.values(namespace.models)
-                                    .filter(function (_a) {
-                                    var syncable = _a.syncable;
-                                    return syncable;
-                                })
-                                    .forEach(function (modelDefinition) {
-                                    return _this.runningProcesses.isOpen &&
-                                        _this.runningProcesses.add(function () { return __awaiter(_this, void 0, void 0, function () {
-                                            var modelAuthModes, readAuthModes, operations, operationAuthModeAttempts, predicatesGroup, addFilterArg, subscriptionRetry;
-                                            var _a, _b, _c;
-                                            var _this = this;
-                                            return __generator(this, function (_d) {
-                                                switch (_d.label) {
-                                                    case 0: return [4 /*yield*/, getModelAuthModes({
-                                                            authModeStrategy: this.authModeStrategy,
-                                                            defaultAuthMode: this.amplifyConfig.aws_appsync_authenticationType,
-                                                            modelName: modelDefinition.name,
-                                                            schema: this.schema,
-                                                        })];
-                                                    case 1:
-                                                        modelAuthModes = _d.sent();
-                                                        readAuthModes = modelAuthModes.READ;
-                                                        subscriptions = __assign(__assign({}, subscriptions), (_a = {}, _a[modelDefinition.name] = (_b = {},
-                                                            _b[TransformerMutationType.CREATE] = [],
-                                                            _b[TransformerMutationType.UPDATE] = [],
-                                                            _b[TransformerMutationType.DELETE] = [],
-                                                            _b), _a));
-                                                        operations = [
-                                                            TransformerMutationType.CREATE,
-                                                            TransformerMutationType.UPDATE,
-                                                            TransformerMutationType.DELETE,
-                                                        ];
-                                                        operationAuthModeAttempts = (_c = {},
-                                                            _c[TransformerMutationType.CREATE] = 0,
-                                                            _c[TransformerMutationType.UPDATE] = 0,
-                                                            _c[TransformerMutationType.DELETE] = 0,
-                                                            _c);
-                                                        predicatesGroup = ModelPredicateCreator.getPredicates(this.syncPredicates.get(modelDefinition), false);
-                                                        addFilterArg = predicatesGroup !== undefined;
-                                                        subscriptionRetry = function (operation, addFilter) {
-                                                            if (addFilter === void 0) { addFilter = addFilterArg; }
-                                                            return __awaiter(_this, void 0, void 0, function () {
-                                                                var _a, transformerMutationType, opName, query, isOwner, ownerField, ownerValue, authMode, authToken, variables, customUserAgentDetails, queryObservable, subscriptionReadyCallback;
-                                                                var _this = this;
-                                                                return __generator(this, function (_b) {
-                                                                    switch (_b.label) {
-                                                                        case 0:
-                                                                            _a = this.buildSubscription(namespace, modelDefinition, operation, userCredentials, cognitoTokenPayload, oidcTokenPayload, readAuthModes[operationAuthModeAttempts[operation]], addFilter), transformerMutationType = _a.opType, opName = _a.opName, query = _a.query, isOwner = _a.isOwner, ownerField = _a.ownerField, ownerValue = _a.ownerValue, authMode = _a.authMode;
-                                                                            return [4 /*yield*/, getTokenForCustomAuth(authMode, this.amplifyConfig)];
-                                                                        case 1:
-                                                                            authToken = _b.sent();
-                                                                            variables = {};
-                                                                            customUserAgentDetails = {
-                                                                                category: Category.DataStore,
-                                                                                action: DataStoreAction.Subscribe,
-                                                                            };
-                                                                            if (addFilter && predicatesGroup) {
-                                                                                variables['filter'] =
-                                                                                    predicateToGraphQLFilter(predicatesGroup);
-                                                                            }
-                                                                            if (isOwner) {
-                                                                                if (!ownerValue) {
-                                                                                    observer.error('Owner field required, sign in is needed in order to perform this operation');
-                                                                                    return [2 /*return*/];
-                                                                                }
-                                                                                variables[ownerField] = ownerValue;
-                                                                            }
-                                                                            logger.debug("Attempting " + operation + " subscription with authMode: " + readAuthModes[operationAuthModeAttempts[operation]]);
-                                                                            queryObservable = this.amplifyContext.InternalAPI.graphql(__assign(__assign({ query: query,
-                                                                                variables: variables }, { authMode: authMode }), { authToken: authToken }), undefined, customUserAgentDetails);
-                                                                            // TODO: consider onTerminate.then(() => API.cancel(...))
-                                                                            subscriptions[modelDefinition.name][transformerMutationType].push(queryObservable
-                                                                                .map(function (_a) {
-                                                                                var value = _a.value;
-                                                                                return value;
-                                                                            })
-                                                                                .subscribe({
-                                                                                next: function (_a) {
-                                                                                    var data = _a.data, errors = _a.errors;
-                                                                                    if (Array.isArray(errors) && errors.length > 0) {
-                                                                                        var messages = errors.map(function (_a) {
-                                                                                            var message = _a.message;
-                                                                                            return message;
-                                                                                        });
-                                                                                        logger.warn("Skipping incoming subscription. Messages: " + messages.join('\n'));
-                                                                                        _this.drainBuffer();
-                                                                                        return;
-                                                                                    }
-                                                                                    var predicatesGroup = ModelPredicateCreator.getPredicates(_this.syncPredicates.get(modelDefinition), false);
-                                                                                    // @ts-ignore
-                                                                                    var _b = data, _c = opName, record = _b[_c];
-                                                                                    // checking incoming subscription against syncPredicate.
-                                                                                    // once AppSync implements filters on subscriptions, we'll be
-                                                                                    // able to set these when establishing the subscription instead.
-                                                                                    // Until then, we'll need to filter inbound
-                                                                                    if (_this.passesPredicateValidation(record, predicatesGroup)) {
-                                                                                        _this.pushToBuffer(transformerMutationType, modelDefinition, record);
-                                                                                    }
-                                                                                    _this.drainBuffer();
-                                                                                },
-                                                                                error: function (subscriptionError) { return __awaiter(_this, void 0, void 0, function () {
-                                                                                    var _a, _b, _c, _d, message, isRTFError, e_1;
-                                                                                    return __generator(this, function (_e) {
-                                                                                        switch (_e.label) {
-                                                                                            case 0:
-                                                                                                _a = subscriptionError.error, _b = __read((_a === void 0 ? {
-                                                                                                    errors: [],
-                                                                                                } : _a).errors, 1), _c = _b[0], _d = (_c === void 0 ? {} : _c).message, message = _d === void 0 ? '' : _d;
-                                                                                                isRTFError = 
-                                                                                                // only attempt catch if a filter variable was added to the subscription query
-                                                                                                addFilter &&
-                                                                                                    this.catchRTFError(message, modelDefinition, predicatesGroup);
-                                                                                                // Catch RTF errors
-                                                                                                if (isRTFError) {
-                                                                                                    // Unsubscribe and clear subscription array for model/operation
-                                                                                                    subscriptions[modelDefinition.name][transformerMutationType].forEach(function (subscription) {
-                                                                                                        return subscription.unsubscribe();
-                                                                                                    });
-                                                                                                    subscriptions[modelDefinition.name][transformerMutationType] = [];
-                                                                                                    // retry subscription connection without filter
-                                                                                                    subscriptionRetry(operation, false);
-                                                                                                    return [2 /*return*/];
-                                                                                                }
-                                                                                                if (message.includes(PUBSUB_CONTROL_MSG.REALTIME_SUBSCRIPTION_INIT_ERROR) ||
-                                                                                                    message.includes(PUBSUB_CONTROL_MSG.CONNECTION_FAILED)) {
-                                                                                                    // Unsubscribe and clear subscription array for model/operation
-                                                                                                    subscriptions[modelDefinition.name][transformerMutationType].forEach(function (subscription) {
-                                                                                                        return subscription.unsubscribe();
-                                                                                                    });
-                                                                                                    subscriptions[modelDefinition.name][transformerMutationType] = [];
-                                                                                                    operationAuthModeAttempts[operation]++;
-                                                                                                    if (operationAuthModeAttempts[operation] >=
-                                                                                                        readAuthModes.length) {
-                                                                                                        // last auth mode retry. Continue with error
-                                                                                                        logger.debug(operation + " subscription failed with authMode: " + readAuthModes[operationAuthModeAttempts[operation] - 1]);
-                                                                                                    }
-                                                                                                    else {
-                                                                                                        // retry with different auth mode. Do not trigger
-                                                                                                        // observer error or error handler
-                                                                                                        logger.debug(operation + " subscription failed with authMode: " + readAuthModes[operationAuthModeAttempts[operation] - 1] + ". Retrying with authMode: " + readAuthModes[operationAuthModeAttempts[operation]]);
-                                                                                                        subscriptionRetry(operation);
-                                                                                                        return [2 /*return*/];
-                                                                                                    }
-                                                                                                }
-                                                                                                logger.warn('subscriptionError', message);
-                                                                                                _e.label = 1;
-                                                                                            case 1:
-                                                                                                _e.trys.push([1, 3, , 4]);
-                                                                                                return [4 /*yield*/, this.errorHandler({
-                                                                                                        recoverySuggestion: 'Ensure app code is up to date, auth directives exist and are correct on each model, and that server-side data has not been invalidated by a schema change. If the problem persists, search for or create an issue: https://github.com/aws-amplify/amplify-js/issues',
-                                                                                                        localModel: null,
-                                                                                                        message: message,
-                                                                                                        model: modelDefinition.name,
-                                                                                                        operation: operation,
-                                                                                                        errorType: getSubscriptionErrorType(subscriptionError),
-                                                                                                        process: ProcessName.subscribe,
-                                                                                                        remoteModel: null,
-                                                                                                        cause: subscriptionError,
-                                                                                                    })];
-                                                                                            case 2:
-                                                                                                _e.sent();
-                                                                                                return [3 /*break*/, 4];
-                                                                                            case 3:
-                                                                                                e_1 = _e.sent();
-                                                                                                logger.error('Subscription error handler failed with:', e_1);
-                                                                                                return [3 /*break*/, 4];
-                                                                                            case 4:
-                                                                                                if (typeof subscriptionReadyCallback === 'function') {
-                                                                                                    subscriptionReadyCallback();
-                                                                                                }
-                                                                                                if (message.includes('"errorType":"Unauthorized"') ||
-                                                                                                    message.includes('"errorType":"OperationDisabled"')) {
-                                                                                                    return [2 /*return*/];
-                                                                                                }
-                                                                                                observer.error(message);
-                                                                                                return [2 /*return*/];
-                                                                                        }
-                                                                                    });
-                                                                                }); },
-                                                                            }));
-                                                                            promises.push((function () { return __awaiter(_this, void 0, void 0, function () {
-                                                                                var boundFunction;
-                                                                                var _this = this;
-                                                                                return __generator(this, function (_a) {
-                                                                                    switch (_a.label) {
-                                                                                        case 0: return [4 /*yield*/, new Promise(function (res) {
-                                                                                                subscriptionReadyCallback = res;
-                                                                                                boundFunction = _this.hubQueryCompletionListener.bind(_this, res);
-                                                                                                Hub.listen('api', boundFunction);
-                                                                                            })];
-                                                                                        case 1:
-                                                                                            _a.sent();
-                                                                                            Hub.remove('api', boundFunction);
-                                                                                            return [2 /*return*/];
-                                                                                    }
-                                                                                });
-                                                                            }); })());
-                                                                            return [2 /*return*/];
-                                                                    }
-                                                                });
-                                                            });
-                                                        };
-                                                        operations.forEach(function (op) { return subscriptionRetry(op); });
-                                                        return [2 /*return*/];
-                                                }
-                                            });
-                                        }); });
-                                });
+            let subscriptions = {};
+            let oidcTokenPayload;
+            let userCredentials = USER_CREDENTIALS.none;
+            this.runningProcesses.add(async () => {
+                try {
+                    // retrieving current AWS Credentials
+                    const credentials = (await fetchAuthSession()).tokens?.accessToken;
+                    userCredentials = credentials
+                        ? USER_CREDENTIALS.auth
+                        : USER_CREDENTIALS.unauth;
+                }
+                catch (err) {
+                    // best effort to get AWS credentials
+                }
+                try {
+                    // retrieving current token info from Cognito UserPools
+                    const session = await await fetchAuthSession();
+                    oidcTokenPayload = session.tokens?.idToken?.payload;
+                }
+                catch (err) {
+                    // best effort to get jwt from Cognito
+                }
+                Object.values(this.schema.namespaces).forEach(namespace => {
+                    Object.values(namespace.models)
+                        .filter(({ syncable }) => syncable)
+                        .forEach(modelDefinition => this.runningProcesses.isOpen &&
+                        this.runningProcesses.add(async () => {
+                            const modelAuthModes = await getModelAuthModes({
+                                authModeStrategy: this.authModeStrategy,
+                                defaultAuthMode: this.amplifyConfig.aws_appsync_authenticationType,
+                                modelName: modelDefinition.name,
+                                schema: this.schema,
                             });
-                            this.runningProcesses.isOpen &&
-                                this.runningProcesses.add(function () {
-                                    return Promise.all(promises).then(function () {
-                                        observer.next(CONTROL_MSG.CONNECTED);
+                            // subscriptions are created only based on the READ auth mode(s)
+                            const readAuthModes = modelAuthModes.READ;
+                            subscriptions = {
+                                ...subscriptions,
+                                [modelDefinition.name]: {
+                                    [TransformerMutationType.CREATE]: [],
+                                    [TransformerMutationType.UPDATE]: [],
+                                    [TransformerMutationType.DELETE]: [],
+                                },
+                            };
+                            const operations = [
+                                TransformerMutationType.CREATE,
+                                TransformerMutationType.UPDATE,
+                                TransformerMutationType.DELETE,
+                            ];
+                            const operationAuthModeAttempts = {
+                                [TransformerMutationType.CREATE]: 0,
+                                [TransformerMutationType.UPDATE]: 0,
+                                [TransformerMutationType.DELETE]: 0,
+                            };
+                            const predicatesGroup = ModelPredicateCreator.getPredicates(this.syncPredicates.get(modelDefinition), false);
+                            const addFilterArg = predicatesGroup !== undefined;
+                            // Retry subscriptions that failed for one of the following reasons:
+                            // 1. unauthorized - retry with next auth mode (if available)
+                            // 2. RTF error - retry without sending filter arg. (filtering will fall back to clientside)
+                            const subscriptionRetry = async (operation, addFilter = addFilterArg) => {
+                                const { opType: transformerMutationType, opName, query, isOwner, ownerField, ownerValue, authMode, } = this.buildSubscription(namespace, modelDefinition, operation, userCredentials, oidcTokenPayload, readAuthModes[operationAuthModeAttempts[operation]], addFilter);
+                                const authToken = await getTokenForCustomAuth(authMode, this.amplifyConfig);
+                                const variables = {};
+                                const customUserAgentDetails = {
+                                    category: Category.DataStore,
+                                    action: DataStoreAction.Subscribe,
+                                };
+                                if (addFilter && predicatesGroup) {
+                                    variables['filter'] =
+                                        predicateToGraphQLFilter(predicatesGroup);
+                                }
+                                if (isOwner) {
+                                    if (!ownerValue) {
+                                        observer.error('Owner field required, sign in is needed in order to perform this operation');
+                                        return;
+                                    }
+                                    variables[ownerField] = ownerValue;
+                                }
+                                logger.debug(`Attempting ${operation} subscription with authMode: ${readAuthModes[operationAuthModeAttempts[operation]]}`);
+                                const queryObservable = this.amplifyContext.InternalAPI.graphql({
+                                    query,
+                                    variables,
+                                    ...{ authMode },
+                                    authToken,
+                                }, undefined, customUserAgentDetails);
+                                let subscriptionReadyCallback;
+                                // TODO: consider onTerminate.then(() => API.cancel(...))
+                                subscriptions[modelDefinition.name][transformerMutationType].push(queryObservable.subscribe({
+                                    next: result => {
+                                        const { data, errors } = result;
+                                        if (Array.isArray(errors) && errors.length > 0) {
+                                            const messages = errors.map(({ message }) => message);
+                                            logger.warn(`Skipping incoming subscription. Messages: ${messages.join('\n')}`);
+                                            this.drainBuffer();
+                                            return;
+                                        }
+                                        const predicatesGroup = ModelPredicateCreator.getPredicates(this.syncPredicates.get(modelDefinition), false);
+                                        // @ts-ignore
+                                        const { [opName]: record } = data;
+                                        // checking incoming subscription against syncPredicate.
+                                        // once AppSync implements filters on subscriptions, we'll be
+                                        // able to set these when establishing the subscription instead.
+                                        // Until then, we'll need to filter inbound
+                                        if (this.passesPredicateValidation(record, predicatesGroup)) {
+                                            this.pushToBuffer(transformerMutationType, modelDefinition, record);
+                                        }
+                                        this.drainBuffer();
+                                    },
+                                    error: async (subscriptionError) => {
+                                        const { errors: [{ message = '' } = {}], } = ({
+                                            errors: [],
+                                        } = subscriptionError);
+                                        const isRTFError = 
+                                        // only attempt catch if a filter variable was added to the subscription query
+                                        addFilter &&
+                                            this.catchRTFError(message, modelDefinition, predicatesGroup);
+                                        // Catch RTF errors
+                                        if (isRTFError) {
+                                            // Unsubscribe and clear subscription array for model/operation
+                                            subscriptions[modelDefinition.name][transformerMutationType].forEach(subscription => subscription.unsubscribe());
+                                            subscriptions[modelDefinition.name][transformerMutationType] = [];
+                                            // retry subscription connection without filter
+                                            subscriptionRetry(operation, false);
+                                            return;
+                                        }
+                                        if (message.includes(PUBSUB_CONTROL_MSG.REALTIME_SUBSCRIPTION_INIT_ERROR) ||
+                                            message.includes(PUBSUB_CONTROL_MSG.CONNECTION_FAILED)) {
+                                            // Unsubscribe and clear subscription array for model/operation
+                                            subscriptions[modelDefinition.name][transformerMutationType].forEach(subscription => subscription.unsubscribe());
+                                            subscriptions[modelDefinition.name][transformerMutationType] = [];
+                                            operationAuthModeAttempts[operation]++;
+                                            if (operationAuthModeAttempts[operation] >=
+                                                readAuthModes.length) {
+                                                // last auth mode retry. Continue with error
+                                                logger.debug(`${operation} subscription failed with authMode: ${readAuthModes[operationAuthModeAttempts[operation] - 1]}`);
+                                            }
+                                            else {
+                                                // retry with different auth mode. Do not trigger
+                                                // observer error or error handler
+                                                logger.debug(`${operation} subscription failed with authMode: ${readAuthModes[operationAuthModeAttempts[operation] - 1]}. Retrying with authMode: ${readAuthModes[operationAuthModeAttempts[operation]]}`);
+                                                subscriptionRetry(operation);
+                                                return;
+                                            }
+                                        }
+                                        logger.warn('subscriptionError', message);
+                                        try {
+                                            await this.errorHandler({
+                                                recoverySuggestion: 'Ensure app code is up to date, auth directives exist and are correct on each model, and that server-side data has not been invalidated by a schema change. If the problem persists, search for or create an issue: https://github.com/aws-amplify/amplify-js/issues',
+                                                localModel: null,
+                                                message,
+                                                model: modelDefinition.name,
+                                                operation,
+                                                errorType: getSubscriptionErrorType(subscriptionError),
+                                                process: ProcessName.subscribe,
+                                                remoteModel: null,
+                                                cause: subscriptionError,
+                                            });
+                                        }
+                                        catch (e) {
+                                            logger.error('Subscription error handler failed with:', e);
+                                        }
+                                        if (typeof subscriptionReadyCallback === 'function') {
+                                            subscriptionReadyCallback();
+                                        }
+                                        if (message.includes('"errorType":"Unauthorized"') ||
+                                            message.includes('"errorType":"OperationDisabled"')) {
+                                            return;
+                                        }
+                                        observer.error(message);
+                                    },
+                                }));
+                                promises.push((async () => {
+                                    let boundFunction;
+                                    let removeBoundFunctionListener;
+                                    await new Promise(res => {
+                                        subscriptionReadyCallback = res;
+                                        boundFunction = this.hubQueryCompletionListener.bind(this, res);
+                                        removeBoundFunctionListener = Hub.listen('api', boundFunction);
                                     });
-                                });
-                            return [2 /*return*/];
-                    }
+                                    removeBoundFunctionListener();
+                                })());
+                            };
+                            operations.forEach(op => subscriptionRetry(op));
+                        }));
                 });
-            }); }, 'subscription processor new subscriber');
-            return _this.runningProcesses.addCleaner(function () { return __awaiter(_this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    Object.keys(subscriptions).forEach(function (modelName) {
-                        subscriptions[modelName][TransformerMutationType.CREATE].forEach(function (subscription) { return subscription.unsubscribe(); });
-                        subscriptions[modelName][TransformerMutationType.UPDATE].forEach(function (subscription) { return subscription.unsubscribe(); });
-                        subscriptions[modelName][TransformerMutationType.DELETE].forEach(function (subscription) { return subscription.unsubscribe(); });
-                    });
-                    return [2 /*return*/];
-                });
-            }); });
-        });
-        var dataObservable = new Observable(function (observer) {
-            _this.dataObserver = observer;
-            _this.drainBuffer();
-            return _this.runningProcesses.addCleaner(function () { return __awaiter(_this, void 0, void 0, function () {
-                return __generator(this, function (_a) {
-                    this.dataObserver = null;
-                    return [2 /*return*/];
+                this.runningProcesses.isOpen &&
+                    this.runningProcesses.add(() => Promise.all(promises).then(() => {
+                        observer.next(CONTROL_MSG.CONNECTED);
+                    }));
+            }, 'subscription processor new subscriber');
+            return this.runningProcesses.addCleaner(async () => {
+                Object.keys(subscriptions).forEach(modelName => {
+                    subscriptions[modelName][TransformerMutationType.CREATE].forEach(subscription => subscription.unsubscribe());
+                    subscriptions[modelName][TransformerMutationType.UPDATE].forEach(subscription => subscription.unsubscribe());
+                    subscriptions[modelName][TransformerMutationType.DELETE].forEach(subscription => subscription.unsubscribe());
                 });
-            }); });
+            });
         });
-        return [ctlObservable, dataObservable];
-    };
-    SubscriptionProcessor.prototype.stop = function () {
-        return __awaiter(this, void 0, void 0, function () {
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, this.runningProcesses.close()];
-                    case 1:
-                        _a.sent();
-                        return [4 /*yield*/, this.runningProcesses.open()];
-                    case 2:
-                        _a.sent();
-                        return [2 /*return*/];
-                }
+        const dataObservable = new Observable(observer => {
+            this.dataObserver = observer;
+            this.drainBuffer();
+            return this.runningProcesses.addCleaner(async () => {
+                this.dataObserver = null;
             });
         });
-    };
-    SubscriptionProcessor.prototype.passesPredicateValidation = function (record, predicatesGroup) {
+        return [ctlObservable, dataObservable];
+    }
+    async stop() {
+        await this.runningProcesses.close();
+        await this.runningProcesses.open();
+    }
+    passesPredicateValidation(record, predicatesGroup) {
         if (!predicatesGroup) {
             return true;
         }
-        var predicates = predicatesGroup.predicates, type = predicatesGroup.type;
+        const { predicates, type } = predicatesGroup;
         return validatePredicate(record, type, predicates);
-    };
-    SubscriptionProcessor.prototype.pushToBuffer = function (transformerMutationType, modelDefinition, data) {
+    }
+    pushToBuffer(transformerMutationType, modelDefinition, data) {
         this.buffer.push([transformerMutationType, modelDefinition, data]);
-    };
-    SubscriptionProcessor.prototype.drainBuffer = function () {
-        var _this = this;
+    }
+    drainBuffer() {
         if (this.dataObserver) {
-            this.buffer.forEach(function (data) { return _this.dataObserver.next(data); });
+            this.buffer.forEach(data => this.dataObserver.next(data));
             this.buffer = [];
         }
-    };
+    }
     /**
      * @returns true if the service returned an RTF subscription error
      * @remarks logs a warning with remediation instructions
      *
      */
-    SubscriptionProcessor.prototype.catchRTFError = function (message, modelDefinition, predicatesGroup) {
-        var header = 'Backend subscriptions filtering error.\n' +
+    catchRTFError(message, modelDefinition, predicatesGroup) {
+        const header = 'Backend subscriptions filtering error.\n' +
             'Subscriptions filtering will be applied clientside.\n';
-        var messageErrorTypeMap = {
+        const messageErrorTypeMap = {
             'UnknownArgument: Unknown field argument filter': RTFError.UnknownField,
             'Filters exceed maximum attributes limit': RTFError.MaxAttributes,
             'Filters combination exceed maximum limit': RTFError.MaxCombinations,
@@ -507,18 +357,13 @@ var SubscriptionProcessor = /** @class */ (function () {
             "The variables input contains a field name 'not'": RTFError.NotGroup,
             'The variables input contains a field that is not defined for input object type': RTFError.FieldNotInType,
         };
-        var _a = __read(Object.entries(messageErrorTypeMap).find(function (_a) {
-            var _b = __read(_a, 1), errorMsg = _b[0];
-            return message.includes(errorMsg);
-        }) || [], 2), _errorMsg = _a[0], errorType = _a[1];
+        const [_errorMsg, errorType] = Object.entries(messageErrorTypeMap).find(([errorMsg]) => message.includes(errorMsg)) || [];
         if (errorType !== undefined) {
-            var remediationMessage = generateRTFRemediation(errorType, modelDefinition, predicatesGroup);
-            logger.warn(header + "\n" + message + "\n" + remediationMessage);
+            const remediationMessage = generateRTFRemediation(errorType, modelDefinition, predicatesGroup);
+            logger.warn(`${header}\n${message}\n${remediationMessage}`);
             return true;
         }
         return false;
-    };
-    return SubscriptionProcessor;
-}());
+    }
+}
 export { SubscriptionProcessor };
-//# sourceMappingURL=subscription.js.map