@lenne.tech/nest-server 11.42.2 → 11.42.3

package/.claude/rules/configurable-features.md

@@ -320,7 +320,8 @@ This pattern is currently applied to:
 | Response Model Interceptor | `security.responseModelInterceptor` | Boolean Shorthand | `true` (enabled), `debug: false` |
 | Translate Response Interceptor | `security.translateResponseInterceptor` | Boolean Shorthand | `true` (enabled) |
 | Secret Fields Removal | `security.secretFields` | Array | `['password', 'verificationToken', ...]` |
-| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription (an open one keeps its tenant until it reconnects — known limit, shared with removed memberships); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription, and since 11.42.3 an OPEN one is closed with 4403 on `invalidateTenant()` (or at its next event once `graphQl.subscriptionRevalidationMs` has passed — see the GraphQL Subscription Re-check row); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| GraphQL Subscription Re-check | `graphQl.subscriptionRevalidationMs` | Numeric — `0` = STRICTEST, `false` = off, invalid → default (a fifth shape: Family C's "invalid never means unbounded", but `0` asks for MORE checking, not less) | **30000 since 11.42.3.** Before, a WebSocket was authorized once, at the handshake, and every event and operation on it ran on that snapshot until the client reconnected. Every connection a `CoreModule` `onConnect` accepts is now registered (`registerWsConnection()`) and re-checked — at once when an invalidation names it (`CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()`, `CoreUserService.setRoles()` and role/verification `update()`s, the legacy password reset, and Better-Auth deleting a session through `wsSessionRevocationPlugin()`), and otherwise before the next event or operation once the last check is older than this value. The check re-runs the handshake's own authentication (session store, Better-Auth JWT signature/expiry, or for legacy tokens `CoreAuthService.verifyJwt()` — signature/expiry, verified on the WebSocket since 11.42.3 — plus the device binding) and the tenant resolution; any difference in user id, roles, verification state or tenant scope closes the socket with **4403**, which the graphql-ws client retries — the user continues with current rights or is refused at the handshake. `0` re-checks on every event and operation (one session lookup each); `false` switches only the TIME-based check off, invalidations still apply. Process-local registry: an invalidation reaches other replicas only where the tenant guard's Redis broadcast carries it; everything else is bounded by the interval. A project that replaces `onConnect` through `graphQl.driver.subscriptions` must call `registerWsConnection()` itself to keep this. Implementation: `common/helpers/graphql-ws-connection.helper.ts` |
 | API Tokens | `apiTokens` | Boolean Shorthand + Presence Implies Enabled — absent = off | `prefix: 'ltt'`, `scopes: []` (vocabulary; empty = no token creatable, boot warning), `manageRole`: highest hierarchy role, `maxAssertionLifetimeSeconds: 900` (invalid → default, never unbounded — Family C), `rateLimit: { max: 600, windowSeconds: 60 }` per token (**on by default**, `false` disables; Redis-shared when configured), `userTokens: true`, `tenantTokens: true` (effective only with `multiTenancy`), `encryptionKey` → `SECRETS_ENCRYPTION_KEY` → dev default (boot FAILS in production/staging). Top-level, NOT under `multiTenancy`: user tokens must work without it. **Deny by default**: every guard refuses a token on a route without `@ApiTokenScopes()`, public routes included, via ONE shared function (`enforceApiTokenRoute`) called BEFORE each guard's public-route shortcut. USER tokens act as their user with global roles REMOVED (no admin bypass); TENANT tokens act with the lowest hierarchy role in their own tenant, and a route guarded ONLY by `S_SELF` / `S_CREATOR` refuses them (a tenant token is nobody's self — skipping those roles would grant for any target). A tenant token depends on no member, so it outlives an off-boarded or deleted tenant until the project calls `deleteAllForTenant()`. The boot refuses a hierarchy in which that lowest role reaches `manageRole`. A prefixed credential that fails answers 401 on every route (not anonymous); `CoreBetterAuthMiddleware` skips prefixed credentials entirely, cookie fallback included. A password reset that ends the user's sessions ends their USER tokens too (legacy reset always; IAM reset while `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on), wired through `core-api-token.registry.ts` so neither reset path imports the optional module. Implementation: `src/core/modules/api-token/` |
 | BetterAuth Tenant Skip | `betterAuth.skipTenantCheck` | Explicit Boolean | `true` (default). When `true` and no `X-Tenant-Id` header is sent, IAM endpoints (controller + resolver) skip `CoreTenantGuard` tenant validation. When header IS present, normal membership validation runs regardless. Set `false` for tenant-aware auth scenarios (subdomain-based, invite links, SSO per tenant) |
 | Debug Process Input | `debugProcessInput` | Explicit Boolean | `false` (default). When `true`, logs a debug message when `prepareInput()` changes the input type during `process()`. Has performance cost due to `JSON.stringify` on every `process()` call — enable only for debugging |

package/.claude/rules/role-system.md

@@ -444,9 +444,37 @@ account over with an address change and a reset, which is precisely the access `
 withholds.
 
 **Deactivated tenants.** `multiTenancy.isTenantActive` is asked after the membership on every path that
-establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row). A GraphQL
-subscription that is already open keeps its tenant until the client reconnects — a known limit it
-shares with a removed membership.
+establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row).
+
+**Open WebSockets (11.42.3).** A WebSocket is authorized at the handshake, and until 11.42.3 that was
+the only check: a removed membership, a deactivated tenant, a withdrawn role or a revoked session took
+effect on every new request and on none of the sockets already open. Now every connection
+`CoreModule`'s `onConnect` accepts is registered (`registerWsConnection()`,
+`common/helpers/graphql-ws-connection.helper.ts`) with the rights it was authorized with, and is
+checked again
+
+| Trigger | When |
+|---------|------|
+| `CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()` (also when received from another replica), `CoreUserService.setRoles()`, an `update()` touching `roles` / `verified` / `emailVerified`, the legacy password reset | at once |
+| Better-Auth deleting a session (sign-out, revoked session, reset with `revokeSessionsOnPasswordReset`) — through `wsSessionRevocationPlugin()`, a plugin so a project's own `options.databaseHooks` cannot displace it | at once |
+| anything nobody invalidated (a membership edited in the database, an expired session) | before the next event or operation once the last check is older than `graphQl.subscriptionRevalidationMs` (30 s) |
+
+A connection whose rights CHANGED — in either direction — is closed with **4403**, which the
+graphql-ws client retries: it reconnects and resubscribes with its current rights, or is refused at the
+handshake. It is closed rather than patched because a subscription may have picked its topic or filter
+from the tenant at subscribe time. An event is checked after graphql-js executed it and before it is
+sent, so a dropped event's reads happened but none of it reaches the client. Pinned by
+`tests/subscription-revalidation.e2e-spec.ts` (mechanism), `tests/subscription-session-iam.e2e-spec.ts`
+and `tests/subscription-session-legacy.e2e-spec.ts` (assembled stack).
+
+The check re-runs the HANDSHAKE'S authentication, which on the legacy builder means
+`CoreAuthService.verifyJwt()` — signature and expiry, in passport-jwt's key order — before
+`validateUser()`'s device binding. The handshake used `decodeJwt()` until 11.42.3, so an expired or
+re-signed legacy token opened sockets that HTTP refused (mutation `legacy-ws-jwt-unverified`). A legacy
+socket therefore ends with its token: at expiry or at the next token refresh.
+
+**A guard that asks "is this request allowed?" once is not enough for a connection that outlives the
+answer.** When you add a long-lived channel (SSE, a WebSocket of your own), register it the same way.
 
 ## Role Check Implementation
 

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 92 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 94 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 147 mutations.
+at 156 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -330,9 +330,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 55 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 62 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 147 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 156 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/CLAUDE.md

@@ -233,6 +233,11 @@ in services (MCP/AI tools call services directly), tenant-aware tool roles in th
 boundary under `adminBypass: false`. User-entered URLs (webhooks, export targets) go through
 `outboundFetch()` (SSRF guard) — configured targets do not.
 
+Since 11.42.3 an **open GraphQL WebSocket** is re-checked, not trusted for its lifetime: at once on an
+invalidation (tenant guard, role change, password reset, sign-out), otherwise every
+`graphQl.subscriptionRevalidationMs` (30 s); changed rights close it with 4403 and the client
+reconnects. A custom `onConnect` must call `registerWsConnection()` to keep that.
+
 See `.claude/rules/role-system.md` for complete documentation.
 
 ### Versioning

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-04 (v11.42.2)
+> Auto-generated from source code as of 2026-10-04 (v11.42.3)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()

package/dist/core/common/helpers/graphql-ws-connection.helper.d.ts

@@ -0,0 +1,43 @@
+import { ResolvedTenantContext } from '../services/core-tenant-context.registry';
+export declare const WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+export declare const DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30000;
+export interface IWsConnectionSocket {
+    close(code: number, reason?: string): void;
+    once?(event: 'close', listener: (...args: any[]) => void): unknown;
+}
+export interface IWsConnectionRegistration {
+    carrier: object;
+    reauthenticate?: () => any;
+    socket?: IWsConnectionSocket;
+    user: any;
+}
+export interface IWsConnectionIdentity {
+    email?: string;
+    iamId?: string;
+    userId?: string;
+}
+export interface WsConnection {
+    readonly email?: string;
+    readonly iamId?: string;
+    readonly reauthenticate?: () => any;
+    readonly socket?: IWsConnectionSocket;
+    tenant?: ResolvedTenantContext;
+    readonly tenantHeader?: string;
+    terminated: boolean;
+    readonly user: any;
+    readonly userFingerprint: string;
+    readonly userId?: string;
+    inflight?: Promise<boolean>;
+    stale: boolean;
+    tenantFingerprint?: string;
+    validatedAt: number;
+}
+export declare function resolveSubscriptionRevalidationMs(value: unknown): false | number;
+export declare function readWsTenantHeader(contextValue: any): string | undefined;
+export declare function registerWsConnection(registration: IWsConnectionRegistration): void;
+export declare function getWsConnection(contextValue: any): undefined | WsConnection;
+export declare function ensureWsConnectionCurrent(connection: WsConnection): Promise<boolean>;
+export declare function noteWsConnectionTenant(connection: WsConnection, tenant: ResolvedTenantContext | undefined): boolean;
+export declare function revalidateWsConnectionsOf(identity: IWsConnectionIdentity): number;
+export declare function revalidateWsConnectionsForTenant(tenantId: string): number;
+export declare function revalidateAllWsConnections(): number;

package/dist/core/common/helpers/graphql-ws-connection.helper.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = void 0;
+exports.resolveSubscriptionRevalidationMs = resolveSubscriptionRevalidationMs;
+exports.readWsTenantHeader = readWsTenantHeader;
+exports.registerWsConnection = registerWsConnection;
+exports.getWsConnection = getWsConnection;
+exports.ensureWsConnectionCurrent = ensureWsConnectionCurrent;
+exports.noteWsConnectionTenant = noteWsConnectionTenant;
+exports.revalidateWsConnectionsOf = revalidateWsConnectionsOf;
+exports.revalidateWsConnectionsForTenant = revalidateWsConnectionsForTenant;
+exports.revalidateAllWsConnections = revalidateAllWsConnections;
+const common_1 = require("@nestjs/common");
+const config_service_1 = require("../services/config.service");
+const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
+exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30_000;
+const WS_CONNECTION = Symbol('ltWsConnection');
+const liveConnections = new Set();
+const logger = new common_1.Logger('GraphQlWsConnection');
+function resolveSubscriptionRevalidationMs(value) {
+    if (value === false || value === 'false') {
+        return false;
+    }
+    const numeric = typeof value === 'string' && value.trim() !== '' ? Number(value) : value;
+    if (typeof numeric === 'number' && Number.isFinite(numeric) && numeric >= 0) {
+        return numeric;
+    }
+    return exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS;
+}
+function configuredRevalidationMs() {
+    const graphQl = config_service_1.ConfigService.configFastButReadOnly?.graphQl;
+    return resolveSubscriptionRevalidationMs(graphQl ? graphQl.subscriptionRevalidationMs : undefined);
+}
+function fingerprintUser(user) {
+    if (!user) {
+        return '';
+    }
+    const roles = Array.isArray(user.roles) ? user.roles.map((role) => String(role)).sort() : [];
+    const verified = !!(user.verified || user.verifiedAt || user.emailVerified);
+    return JSON.stringify([String(user.id ?? user._id ?? ''), roles, verified]);
+}
+function fingerprintTenant(tenant) {
+    const tenantIds = Array.isArray(tenant?.tenantIds) ? tenant.tenantIds.map((id) => String(id)).sort() : null;
+    return JSON.stringify([tenant?.tenantId ?? null, tenantIds, tenant?.tenantRole ?? null, !!tenant?.isAdminBypass]);
+}
+function readWsTenantHeader(contextValue) {
+    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
+    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
+    for (const source of sources) {
+        if (!source || typeof source !== 'object') {
+            continue;
+        }
+        for (const [key, value] of Object.entries(source)) {
+            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
+                return value;
+            }
+        }
+    }
+    return undefined;
+}
+function registerWsConnection(registration) {
+    const { carrier, reauthenticate, socket, user } = registration;
+    if (!carrier || typeof carrier !== 'object') {
+        return;
+    }
+    const userId = user?.id ?? user?._id;
+    const connection = {
+        email: typeof user?.email === 'string' ? user.email.toLowerCase() : undefined,
+        iamId: typeof user?.iamId === 'string' ? user.iamId : undefined,
+        reauthenticate,
+        socket,
+        stale: false,
+        tenantHeader: readWsTenantHeader(carrier),
+        terminated: false,
+        user,
+        userFingerprint: fingerprintUser(user),
+        userId: userId !== undefined && userId !== null ? String(userId) : undefined,
+        validatedAt: Date.now(),
+    };
+    Object.defineProperty(carrier, WS_CONNECTION, { configurable: true, enumerable: true, value: connection });
+    if (socket && typeof socket.once === 'function') {
+        liveConnections.add(connection);
+        socket.once('close', () => {
+            connection.terminated = true;
+            liveConnections.delete(connection);
+        });
+    }
+}
+function getWsConnection(contextValue) {
+    if (!contextValue || typeof contextValue !== 'object') {
+        return undefined;
+    }
+    const connection = contextValue[WS_CONNECTION];
+    return connection && typeof connection === 'object' ? connection : undefined;
+}
+function terminate(connection, reason) {
+    if (connection.terminated) {
+        return false;
+    }
+    connection.terminated = true;
+    liveConnections.delete(connection);
+    logger.log(`Closing GraphQL WebSocket of user ${connection.userId ?? '(unknown)'}: ${reason}`);
+    try {
+        connection.socket?.close(exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE, reason);
+    }
+    catch {
+    }
+    return false;
+}
+async function revalidate(connection) {
+    connection.stale = false;
+    try {
+        let user = connection.user;
+        if (connection.reauthenticate) {
+            user = await connection.reauthenticate();
+            if (!user) {
+                return terminate(connection, 'Session no longer valid');
+            }
+        }
+        if (fingerprintUser(user) !== connection.userFingerprint) {
+            return terminate(connection, 'User authorization changed');
+        }
+        if (connection.tenantFingerprint !== undefined) {
+            const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
+            const tenant = resolver ? await resolver.resolve(user, connection.tenantHeader) : {};
+            if (fingerprintTenant(tenant) !== connection.tenantFingerprint) {
+                return terminate(connection, 'Tenant access changed');
+            }
+        }
+        if (connection.terminated) {
+            return false;
+        }
+        connection.validatedAt = Date.now();
+        return true;
+    }
+    catch {
+        return terminate(connection, 'Authorization check failed');
+    }
+}
+function ensureWsConnectionCurrent(connection) {
+    if (connection.terminated) {
+        return Promise.resolve(false);
+    }
+    const interval = configuredRevalidationMs();
+    if (!connection.stale && (interval === false || Date.now() - connection.validatedAt < interval)) {
+        return Promise.resolve(true);
+    }
+    if (!connection.inflight) {
+        connection.inflight = revalidate(connection).finally(() => {
+            connection.inflight = undefined;
+            if (connection.stale && !connection.terminated) {
+                void ensureWsConnectionCurrent(connection);
+            }
+        });
+    }
+    return connection.inflight;
+}
+function noteWsConnectionTenant(connection, tenant) {
+    if (connection.terminated) {
+        return false;
+    }
+    const fingerprint = fingerprintTenant(tenant);
+    if (connection.tenantFingerprint === undefined) {
+        connection.tenant = tenant ? { ...tenant } : {};
+        connection.tenantFingerprint = fingerprint;
+        return true;
+    }
+    if (fingerprint !== connection.tenantFingerprint) {
+        return terminate(connection, 'Tenant access changed');
+    }
+    return true;
+}
+function markStale(connection) {
+    connection.stale = true;
+    void ensureWsConnectionCurrent(connection);
+}
+function revalidateWsConnectionsOf(identity) {
+    const userId = identity?.userId !== undefined && identity?.userId !== null ? String(identity.userId) : undefined;
+    const iamId = identity?.iamId || undefined;
+    const email = typeof identity?.email === 'string' ? identity.email.toLowerCase() : undefined;
+    if (!userId && !iamId && !email) {
+        return 0;
+    }
+    let count = 0;
+    for (const connection of liveConnections) {
+        if ((userId && connection.userId === userId) ||
+            (iamId && connection.iamId === iamId) ||
+            (email && connection.email === email)) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateWsConnectionsForTenant(tenantId) {
+    if (!tenantId) {
+        return 0;
+    }
+    const id = String(tenantId);
+    let count = 0;
+    for (const connection of liveConnections) {
+        const tenant = connection.tenant;
+        if (tenant && (tenant.tenantId === id || (Array.isArray(tenant.tenantIds) && tenant.tenantIds.includes(id)))) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateAllWsConnections() {
+    let count = 0;
+    for (const connection of liveConnections) {
+        markStale(connection);
+        count++;
+    }
+    return count;
+}
+//# sourceMappingURL=graphql-ws-connection.helper.js.map

package/dist/core/common/helpers/graphql-ws-connection.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-ws-connection.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-connection.helper.ts"],"names":[],"mappings":";;;AAkIA,8EASC;AAuBD,gDAcC;AAMD,oDA4BC;AAGD,0CAMC;AA6DD,8DAmBC;AASD,wDAcC;AAaD,8DAmBC;AAGD,4EAcC;AAGD,gEAOC;AA7XD,2CAAwC;AAExC,+DAA2D;AAC3D,2FAA2G;AAsC9F,QAAA,mCAAmC,GAAG,IAAI,CAAC;AAG3C,QAAA,oCAAoC,GAAG,MAAM,CAAC;AAmE3D,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAO/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEhD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC;AAUjD,SAAgB,iCAAiC,CAAC,KAAc;IAC9D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,4CAAoC,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,8BAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAC7D,OAAO,iCAAiC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrG,CAAC;AAGD,SAAS,eAAe,CAAC,IAAS;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AACpH,CAAC;AAGD,SAAgB,kBAAkB,CAAC,YAAiB;IAClD,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAMD,SAAgB,oBAAoB,CAAC,YAAuC;IAC1E,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,GAAG,CAAC;IACrC,MAAM,UAAU,GAAiB;QAC/B,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC/D,cAAc;QACd,MAAM;QACN,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACzC,UAAU,EAAE,KAAK;QACjB,IAAI;QACJ,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3G,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;YAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAGD,SAAgB,eAAe,CAAC,YAAiB;IAC/C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAMD,SAAS,SAAS,CAAC,UAAwB,EAAE,MAAc;IACzD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;IAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,qCAAqC,UAAU,CAAC,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC;QAEH,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,2CAAmC,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAwB;IAChD,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAGP,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AASD,SAAgB,yBAAyB,CAAC,UAAwB;IAChE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC;YAGhC,IAAI,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC/C,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC7B,CAAC;AASD,SAAgB,sBAAsB,CAAC,UAAwB,EAAE,MAAyC;IACxG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAS,SAAS,CAAC,UAAwB;IACzC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IACxB,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAA+B;IACvE,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,IACE,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;YACxC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC;YACrC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,EACrC,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,gCAAgC,CAAC,QAAgB;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,0BAA0B;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/common/helpers/graphql-ws-context.helper.d.ts

@@ -1,4 +1,5 @@
 import { IRequestContext } from '../services/request-context.service';
+import { WsConnection } from './graphql-ws-connection.helper';
 interface GraphQlArgs {
     contextValue?: any;
     [key: string]: any;
@@ -7,7 +8,7 @@ type ExecuteFn = (args: GraphQlArgs) => any;
 export declare function buildWsRequestContext(contextValue: any): Promise<IRequestContext | undefined>;
 export declare function withRequestContextAsyncIterator<T>(iterator: AsyncIterator<T> & {
     [Symbol.asyncIterator]?: () => AsyncIterator<T>;
-}, context: IRequestContext): AsyncIterableIterator<T>;
+}, context: IRequestContext, connection?: WsConnection): AsyncIterableIterator<T>;
 export declare function createRequestContextAwareExecute(execute: ExecuteFn): ExecuteFn;
 export declare function createRequestContextAwareSubscribe(subscribe: ExecuteFn): ExecuteFn;
 export declare function buildRequestContextAwareExecute(): (args: GraphQlArgs) => any;

package/dist/core/common/helpers/graphql-ws-context.helper.js

@@ -8,22 +8,10 @@ exports.buildRequestContextAwareExecute = buildRequestContextAwareExecute;
 exports.buildRequestContextAwareSubscribe = buildRequestContextAwareSubscribe;
 const graphql = require("graphql");
 const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
-const config_service_1 = require("../services/config.service");
 const request_context_service_1 = require("../services/request-context.service");
+const graphql_ws_connection_helper_1 = require("./graphql-ws-connection.helper");
 function readTenantHeader(contextValue) {
-    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
-    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
-    for (const source of sources) {
-        if (!source || typeof source !== 'object') {
-            continue;
-        }
-        for (const [key, value] of Object.entries(source)) {
-            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
-                return value;
-            }
-        }
-    }
-    return undefined;
+    return (0, graphql_ws_connection_helper_1.readWsTenantHeader)(contextValue);
 }
 function readUser(contextValue) {
     return contextValue?.user ?? contextValue?.extra?.user ?? undefined;
@@ -42,17 +30,50 @@ async function buildWsRequestContext(contextValue) {
     }
     const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
     if (resolver) {
+        let resolved = {};
         try {
-            Object.assign(context, await resolver.resolve(user, readTenantHeader(contextValue)));
+            resolved = (await resolver.resolve(user, readTenantHeader(contextValue))) ?? {};
+            Object.assign(context, resolved);
         }
         catch {
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+        if (connection) {
+            (0, graphql_ws_connection_helper_1.noteWsConnectionTenant)(connection, resolved);
+        }
     }
     return context;
 }
-function withRequestContextAsyncIterator(iterator, context) {
+function refusedResult() {
+    return {
+        errors: [
+            new graphql.GraphQLError('The authorization of this connection changed — reconnect.', {
+                extensions: { code: 'FORBIDDEN' },
+            }),
+        ],
+    };
+}
+async function connectionStillAuthorized(contextValue) {
+    const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+    return connection ? (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection) : true;
+}
+function withRequestContextAsyncIterator(iterator, context, connection) {
+    const next = (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args));
     const wrapped = {
-        next: (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args)),
+        next: connection
+            ? async (...args) => {
+                const result = await next(...args);
+                if (result.done || (await (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection))) {
+                    return result;
+                }
+                try {
+                    await request_context_service_1.RequestContext.run(context, () => iterator.return?.());
+                }
+                catch {
+                }
+                return { done: true, value: undefined };
+            }
+            : next,
         [Symbol.asyncIterator]() {
             return wrapped;
         },
@@ -70,21 +91,36 @@ function isAsyncIterable(value) {
 }
 function createRequestContextAwareExecute(execute) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return execute(args);
         }
+        if ((0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue)?.terminated) {
+            return refusedResult();
+        }
         return request_context_service_1.RequestContext.run(context, () => execute(args));
     };
 }
 function createRequestContextAwareSubscribe(subscribe) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return subscribe(args);
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue);
+        if (connection?.terminated) {
+            return refusedResult();
+        }
         const result = await request_context_service_1.RequestContext.run(context, () => subscribe(args));
-        return isAsyncIterable(result) ? withRequestContextAsyncIterator(result, context) : result;
+        return isAsyncIterable(result)
+            ? withRequestContextAsyncIterator(result, context, connection)
+            : result;
     };
 }
 function buildRequestContextAwareExecute() {

package/dist/core/common/helpers/graphql-ws-context.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AAyFA,sDA8BC;AAQD,0EAiBC;AAYD,4EAQC;AAGD,gFASC;AASD,0EAEC;AAED,8EAEC;AA1LD,mCAAoC;AAEpC,2FAAoF;AACpF,+DAA2D;AAC3D,iFAAsF;AAoDtF,SAAS,gBAAgB,CAAC,YAAiB;IACzC,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB;IAExB,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC;QACtG,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AA4FA,sDAwCC;AAsCD,0EAgCC;AAYD,4EAcC;AAGD,gFAkBC;AASD,0EAEC;AAED,8EAEC;AAnQD,mCAAoC;AAEpC,2FAA2G;AAC3G,iFAAsF;AACtF,iFAMwC;AA6DxC,SAAS,gBAAgB,CAAC,YAAiB;IACzC,OAAO,IAAA,iDAAkB,EAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,QAAQ,GAA0B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QAKD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,qDAAsB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAS,aAAa;IACpB,OAAO;QACL,MAAM,EAAE;YACN,IAAI,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;gBACpF,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAClC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAMD,KAAK,UAAU,yBAAyB,CAAC,YAAiB;IACxD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAcD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB,EACxB,UAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,UAAU;YACd,CAAC,CAAC,KAAK,EAAE,GAAG,IAAsB,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBACjE,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAuB,CAAC;YAC/D,CAAC;YACH,CAAC,CAAC,IAAI;QACR,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;YAC3B,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,EAAE,UAAU,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -305,6 +305,7 @@ export interface IServerOptions {
         enableSubscriptionAuth?: boolean;
         maxComplexity?: number;
         options?: GqlModuleAsyncOptions;
+        subscriptionRevalidationMs?: false | number;
     };
     healthCheck?: {
         configs?: {

package/dist/core/modules/auth/services/core-auth.service.d.ts

@@ -26,6 +26,7 @@ export declare class CoreAuthService {
     private readonly logger;
     constructor(userService: CoreAuthUserService, jwtService: JwtService, configService: ConfigService, betterAuthService?: CoreBetterAuthService, betterAuthUserMapper?: CoreBetterAuthUserMapper);
     decodeJwt(token: string): JwtPayload;
+    verifyJwt(token: string): Promise<JwtPayload | null>;
     logout(tokenOrRefreshToken: string, serviceOptions: ServiceOptions & {
         allDevices?: boolean;
     }): Promise<boolean>;

package/dist/core/modules/auth/services/core-auth.service.js

@@ -44,6 +44,25 @@ let CoreAuthService = CoreAuthService_1 = class CoreAuthService {
     decodeJwt(token) {
         return this.jwtService.decode(token);
     }
+    async verifyJwt(token) {
+        if (!token || typeof token !== 'string') {
+            return null;
+        }
+        try {
+            const provider = this.configService.getFastButReadOnly('jwt.secretOrKeyProvider');
+            const secret = typeof provider === 'function'
+                ? await new Promise((resolve, reject) => provider({}, token, (error, key) => (error ? reject(error) : resolve(key))))
+                : this.configService.getFastButReadOnly('jwt.secretOrPrivateKey') ||
+                    this.configService.getFastButReadOnly('jwt.secret');
+            if (!secret) {
+                return null;
+            }
+            return (await this.jwtService.verifyAsync(token, { secret }));
+        }
+        catch {
+            return null;
+        }
+    }
     async logout(tokenOrRefreshToken, serviceOptions) {
         const user = serviceOptions.currentUser;
         if (!user || !tokenOrRefreshToken) {