@makerx/graphql-core 3.4.0 → 3.5.0

package/README.md

@@ -382,6 +382,24 @@ This library includes a `subscriptions` module to provide simple setup using the
 
    Pass `includeDeprecatedElements: true` to add [deprecation usage](#collectdeprecatedelementusage) to the operation log entry as `deprecatedElements`. It is collected once, when the subscription is established, rather than per emitted payload — the usage is a property of the operation, not of each event.
 
+   By default a connection's token is verified when the connection is established, and again each time the client subscribes on it. A token that no longer verifies then closes the connection with `4403 Forbidden`, and the operation is not run. Subscriptions already running continue until that happens.
+
+   To give connections a set lifetime instead, pass `connectionExpiry`. It receives the claims `verifyToken` returned and returns the time the connection ends, in milliseconds since the epoch (or `undefined` for the default behaviour). At that time the connection is closed with `4403`, which ends every subscription running on it, and a time already past refuses the connection. Until then the client may subscribe again without the token being verified again: a connection's token cannot change.
+
+   ```ts
+   // End each connection when its token expires
+   connectionExpiry: (claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)
+
+   // A short-lived token (such as a proxy's assertion) that proves a longer session: connections last an hour from when the token was issued
+   connectionExpiry: (claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)
+   ```
+
+   With a lifetime longer than the token's, a revoked session is noticed only when the connection ends.
+
+   graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: pass `connectionParams` to `createClient` as a function that returns a current token, or authenticate the upgrade request afresh (by a cookie and a proxy, for example). A client that sends the same expired token fails again until its `retryAttempts` run out, and its subscriptions then end with an error.
+
+   `keepAlive` sets the milliseconds between the server's websocket pings (default 12 seconds, graphql-ws's default; `0` turns them off). A connection that has not answered a ping by the time the next one is due is terminated. The pings also stop proxies and load balancers from closing an idle connection, so keep the interval below their idle timeouts.
+
    Example for Apollo Server (`wsServerCleanup` called in the `drainServer` plugin callback):
 
    ```ts

package/package.json

@@ -4,7 +4,7 @@
     "**"
   ],
   "name": "@makerx/graphql-core",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "private": false,
   "description": "A set of core GraphQL utilities that MakerX uses to build GraphQL APIs",
   "author": "MakerX",
@@ -42,7 +42,8 @@
     }
   },
   "overrides": {
-    "esbuild": "^0.28.1"
+    "esbuild": "^0.28.1",
+    "@graphql-tools/utils": "12.0.1"
   },
   "main": "./index.js",
   "module": "./index.mjs",

package/subscriptions/server.d.cts

@@ -1,9 +1,9 @@
 import type { Logger } from '@makerx/node-common';
-import type { GraphQLSchema } from 'graphql';
+import { type GraphQLSchema } from 'graphql';
 import type { Server } from 'http';
 import type { GraphQLContext, JwtPayload } from '../context';
 import type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context';
-export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, }: {
+export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, connectionExpiry, keepAlive, }: {
     schema: GraphQLSchema;
     httpServer: Server;
     createSubscriptionContext: CreateSubscriptionContext;
@@ -25,4 +25,39 @@ export declare function useSubscriptionsServer<TLogger extends Logger = Logger>(
      * established. Not collected per emitted payload: the usage is a property of the operation.
      */
     includeDeprecatedElements?: boolean;
+    /**
+     * Returns the time a connection ends, in milliseconds since the epoch, from the claims `verifyToken`
+     * returned when it was established. `undefined` keeps the default behaviour below.
+     *
+     * When it returns a time:
+     * - A time already past refuses the connection with `4403 Forbidden`, as an invalid token does.
+     * - Otherwise at that time the connection is closed with `4403`, which ends every subscription
+     *   running on it.
+     * - Until then the client may subscribe again on the connection, and the token is not verified
+     *   again: it was verified when the connection was established, and it cannot change for the life
+     *   of the connection.
+     *
+     * To end a connection when its token expires: `(claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)`.
+     * When the token is short-lived proof of a longer session, such as an assertion that a proxy adds to
+     * the upgrade request, a later time keeps subscriptions from being cut off every few minutes:
+     * `(claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)`. A connection then
+     * outlives its token, so a revoked session is noticed only when the connection ends.
+     *
+     * By default a connection has no set end. Its token is verified again each time the client
+     * subscribes, and a token that no longer verifies closes the connection with `4403` then.
+     * Subscriptions already running continue until that happens.
+     *
+     * graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: the
+     * client's `connectionParams` must be a function that returns a current token, or the upgrade
+     * request must be authenticated afresh (by a cookie and a proxy, for example). A client that sends
+     * the same expired token fails again until its `retryAttempts` run out, and its subscriptions then
+     * end with an error.
+     */
+    connectionExpiry?: (claims: JwtPayload) => number | undefined;
+    /**
+     * Milliseconds between the server's websocket pings. A connection that has not answered a ping by
+     * the time the next one is due is terminated. `0` turns the pings off. Defaults to graphql-ws's 12
+     * seconds.
+     */
+    keepAlive?: number;
 }): import("graphql-ws").Disposable;

package/subscriptions/server.d.mts

@@ -1,9 +1,9 @@
 import type { Logger } from '@makerx/node-common';
-import type { GraphQLSchema } from 'graphql';
+import { type GraphQLSchema } from 'graphql';
 import type { Server } from 'http';
 import type { GraphQLContext, JwtPayload } from '../context.mjs';
 import type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context.mjs';
-export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, }: {
+export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, connectionExpiry, keepAlive, }: {
     schema: GraphQLSchema;
     httpServer: Server;
     createSubscriptionContext: CreateSubscriptionContext;
@@ -25,4 +25,39 @@ export declare function useSubscriptionsServer<TLogger extends Logger = Logger>(
      * established. Not collected per emitted payload: the usage is a property of the operation.
      */
     includeDeprecatedElements?: boolean;
+    /**
+     * Returns the time a connection ends, in milliseconds since the epoch, from the claims `verifyToken`
+     * returned when it was established. `undefined` keeps the default behaviour below.
+     *
+     * When it returns a time:
+     * - A time already past refuses the connection with `4403 Forbidden`, as an invalid token does.
+     * - Otherwise at that time the connection is closed with `4403`, which ends every subscription
+     *   running on it.
+     * - Until then the client may subscribe again on the connection, and the token is not verified
+     *   again: it was verified when the connection was established, and it cannot change for the life
+     *   of the connection.
+     *
+     * To end a connection when its token expires: `(claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)`.
+     * When the token is short-lived proof of a longer session, such as an assertion that a proxy adds to
+     * the upgrade request, a later time keeps subscriptions from being cut off every few minutes:
+     * `(claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)`. A connection then
+     * outlives its token, so a revoked session is noticed only when the connection ends.
+     *
+     * By default a connection has no set end. Its token is verified again each time the client
+     * subscribes, and a token that no longer verifies closes the connection with `4403` then.
+     * Subscriptions already running continue until that happens.
+     *
+     * graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: the
+     * client's `connectionParams` must be a function that returns a current token, or the upgrade
+     * request must be authenticated afresh (by a cookie and a proxy, for example). A client that sends
+     * the same expired token fails again until its `retryAttempts` run out, and its subscriptions then
+     * end with an error.
+     */
+    connectionExpiry?: (claims: JwtPayload) => number | undefined;
+    /**
+     * Milliseconds between the server's websocket pings. A connection that has not answered a ping by
+     * the time the next one is due is terminated. `0` turns the pings off. Defaults to graphql-ws's 12
+     * seconds.
+     */
+    keepAlive?: number;
 }): import("graphql-ws").Disposable;

package/subscriptions/server.d.ts

@@ -1,9 +1,9 @@
 import type { Logger } from '@makerx/node-common';
-import type { GraphQLSchema } from 'graphql';
+import { type GraphQLSchema } from 'graphql';
 import type { Server } from 'http';
 import type { GraphQLContext, JwtPayload } from '../context';
 import type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context';
-export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, }: {
+export declare function useSubscriptionsServer<TLogger extends Logger = Logger>({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel, path, verifyToken, extractToken, requireAuth, jwtClaimsToLog, resolveSubscriptionOperationLogger, includeDeprecatedElements, connectionExpiry, keepAlive, }: {
     schema: GraphQLSchema;
     httpServer: Server;
     createSubscriptionContext: CreateSubscriptionContext;
@@ -25,4 +25,39 @@ export declare function useSubscriptionsServer<TLogger extends Logger = Logger>(
      * established. Not collected per emitted payload: the usage is a property of the operation.
      */
     includeDeprecatedElements?: boolean;
+    /**
+     * Returns the time a connection ends, in milliseconds since the epoch, from the claims `verifyToken`
+     * returned when it was established. `undefined` keeps the default behaviour below.
+     *
+     * When it returns a time:
+     * - A time already past refuses the connection with `4403 Forbidden`, as an invalid token does.
+     * - Otherwise at that time the connection is closed with `4403`, which ends every subscription
+     *   running on it.
+     * - Until then the client may subscribe again on the connection, and the token is not verified
+     *   again: it was verified when the connection was established, and it cannot change for the life
+     *   of the connection.
+     *
+     * To end a connection when its token expires: `(claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)`.
+     * When the token is short-lived proof of a longer session, such as an assertion that a proxy adds to
+     * the upgrade request, a later time keeps subscriptions from being cut off every few minutes:
+     * `(claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)`. A connection then
+     * outlives its token, so a revoked session is noticed only when the connection ends.
+     *
+     * By default a connection has no set end. Its token is verified again each time the client
+     * subscribes, and a token that no longer verifies closes the connection with `4403` then.
+     * Subscriptions already running continue until that happens.
+     *
+     * graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: the
+     * client's `connectionParams` must be a function that returns a current token, or the upgrade
+     * request must be authenticated afresh (by a cookie and a proxy, for example). A client that sends
+     * the same expired token fails again until its `retryAttempts` run out, and its subscriptions then
+     * end with an error.
+     */
+    connectionExpiry?: (claims: JwtPayload) => number | undefined;
+    /**
+     * Milliseconds between the server's websocket pings. A connection that has not answered a ping by
+     * the time the next one is due is terminated. `0` turns the pings off. Defaults to graphql-ws's 12
+     * seconds.
+     */
+    keepAlive?: number;
 }): import("graphql-ws").Disposable;

package/subscriptions/server.js

@@ -1,23 +1,66 @@
 'use strict';
 
 var compat = require('es-toolkit/compat');
+var graphql = require('graphql');
 var graphqlWs = require('graphql-ws');
 var ws$1 = require('graphql-ws/use/ws');
 var ws = require('ws');
 var logging = require('../logging.js');
 var utils = require('./utils.js');
 
-function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel = 'info', path = '/graphql', verifyToken, extractToken = utils.defaultExtractSubscriptionToken, requireAuth, jwtClaimsToLog = ['oid', 'iss'], resolveSubscriptionOperationLogger, includeDeprecatedElements, }) {
+// The longest delay setTimeout accepts. A connection that ends later than this is timed in steps.
+const maxTimeoutMs = 2 ** 31 - 1;
+// What onSubscribe returns for an operation it refuses, so onError can tell a refusal from a real error.
+class SubscriptionRefusedError extends graphql.GraphQLError {
+    constructor() {
+        super('Forbidden', { extensions: { code: 'FORBIDDEN' } });
+    }
+}
+function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel = 'info', path = '/graphql', verifyToken, extractToken = utils.defaultExtractSubscriptionToken, requireAuth, jwtClaimsToLog = ['oid', 'iss'], resolveSubscriptionOperationLogger, includeDeprecatedElements, connectionExpiry, keepAlive = 12000, }) {
     if (requireAuth && !verifyToken)
         throw new Error('verifyToken must be supplied when requireAuth is true');
     const wsServer = new ws.WebSocketServer({
         server: httpServer,
         path,
     });
+    // When each connection ends, for the connections that connectionExpiry gave a time.
+    const connectionEnds = new WeakMap();
+    const endConnectionAt = (socket, endsAt, claims) => {
+        // A client that went away while its token was being verified has already closed the socket.
+        if (socket.readyState !== socket.OPEN)
+            return;
+        connectionEnds.set(socket, endsAt);
+        let timer;
+        // The socket's own close event, not graphql-ws's onClose, which waits for every subscription on the connection to
+        // return. A subscription waiting for its next event can hold that up indefinitely.
+        socket.once('close', () => clearTimeout(timer));
+        const schedule = () => {
+            const remaining = endsAt - Date.now();
+            timer = setTimeout(() => {
+                if (remaining > maxTimeoutMs)
+                    return schedule();
+                if (socket.readyState !== socket.OPEN)
+                    return;
+                logger.info('Subscription connection expired', { claims: compat.pick(claims, jwtClaimsToLog) });
+                socket.close(graphqlWs.CloseCode.Forbidden, 'Forbidden');
+            }, Math.min(Math.max(remaining, 0), maxTimeoutMs));
+            timer.unref();
+        };
+        schedule();
+    };
+    // Closes the connection, and keeps graphql-ws from running the operation: it would run it after the
+    // close if onSubscribe returned nothing.
+    const refuse = (socket) => {
+        socket.close(graphqlWs.CloseCode.Forbidden, 'Forbidden');
+        return [new SubscriptionRefusedError()];
+    };
     return ws$1.useServer({
         schema,
-        onError(_ctx, message, errors) {
-            logger.error('GraphQL subscriptions server error', { message, errors });
+        onError(_ctx, id, _payload, errors) {
+            // A refusal is already logged, and is not a server error.
+            if (errors.every((error) => error instanceof SubscriptionRefusedError))
+                return;
+            logger.error('GraphQL subscriptions server error', { id, errors });
         },
         onConnect: async (ctx) => {
             const connectionEstablished = 'Subscription connection established';
@@ -34,27 +77,53 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
                 logger.info(connectionEstablished);
                 return true;
             }
+            let claims;
             try {
-                const claims = await verifyToken(utils.getHost(ctx.extra.request), token);
-                ctx.extra.claims = claims;
-                logger.info(connectionEstablished, {
-                    claims: compat.pick(claims, jwtClaimsToLog),
-                });
-                return true;
+                claims = await verifyToken(utils.getHost(ctx.extra.request), token);
             }
             catch (error) {
                 logger.error('Failed to verify subscription connection auth token', { error });
                 return false;
             }
+            let endsAt;
+            try {
+                endsAt = connectionExpiry?.(claims);
+            }
+            catch (error) {
+                logger.error('Failed to compute subscription connection expiry', { claims: compat.pick(claims, jwtClaimsToLog), error });
+                return false;
+            }
+            // Refused before the connection is acknowledged: an acknowledged connection resets a graphql-ws
+            // client's retry count, so closing it at once would have the client reconnect without end.
+            if (endsAt !== undefined && !(endsAt > Date.now())) {
+                logger.warn('Subscription connection has already expired', { claims: compat.pick(claims, jwtClaimsToLog) });
+                return false;
+            }
+            ctx.extra.claims = claims;
+            logger.info(connectionEstablished, {
+                claims: compat.pick(claims, jwtClaimsToLog),
+            });
+            if (endsAt !== undefined)
+                endConnectionAt(ctx.extra.socket, endsAt, claims);
+            return true;
         },
         onSubscribe: async (ctx) => {
             if (!verifyToken)
                 return;
+            const endsAt = connectionEnds.get(ctx.extra.socket);
+            if (endsAt !== undefined) {
+                // The token stands for the life connectionExpiry gave the connection. This covers an operation that
+                // arrives before the timer closes the connection.
+                if (Date.now() < endsAt)
+                    return;
+                logger.warn('Subscription connection has expired', { claims: compat.pick(ctx.extra.claims, jwtClaimsToLog) });
+                return refuse(ctx.extra.socket);
+            }
             const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams });
             if (!token) {
                 if (requireAuth) {
                     logger.error('No auth token was supplied with the websocket connection');
-                    ctx.extra.socket.close(graphqlWs.CloseCode.Forbidden, 'Forbidden');
+                    return refuse(ctx.extra.socket);
                 }
                 return;
             }
@@ -63,7 +132,7 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
             }
             catch (error) {
                 logger.warn('Subscription connection auth token is no longer valid', { claims: compat.pick(ctx.extra.claims, jwtClaimsToLog), error });
-                ctx.extra.socket.close(graphqlWs.CloseCode.Forbidden, 'Forbidden');
+                return refuse(ctx.extra.socket);
             }
         },
         onDisconnect({ extra: { claims } }) {
@@ -88,7 +157,7 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
         onNext(_ctx, id, _payload, args, { data, ...result }) {
             logging.logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger });
         },
-    }, wsServer);
+    }, wsServer, keepAlive);
 }
 
 exports.useSubscriptionsServer = useSubscriptionsServer;

package/subscriptions/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sources":["../../src/subscriptions/server.ts"],"sourcesContent":["import type { Logger } from '@makerx/node-common'\nimport { pick } from 'es-toolkit/compat'\nimport type { GraphQLSchema } from 'graphql'\nimport { CloseCode } from 'graphql-ws'\nimport { useServer } from 'graphql-ws/use/ws'\nimport type { Server } from 'http'\nimport { WebSocketServer } from 'ws'\nimport type { GraphQLContext, JwtPayload } from '../context'\nimport { logSubscriptionOperation } from '../logging'\nimport type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context'\nimport { defaultExtractSubscriptionToken, getHost } from './utils'\n\nexport function useSubscriptionsServer<TLogger extends Logger = Logger>({\n  schema,\n  httpServer,\n  createSubscriptionContext,\n  logger,\n  operationLogLevel = 'info',\n  path = '/graphql',\n  verifyToken,\n  extractToken = defaultExtractSubscriptionToken,\n  requireAuth,\n  jwtClaimsToLog = ['oid', 'iss'],\n  resolveSubscriptionOperationLogger,\n  includeDeprecatedElements,\n}: {\n  schema: GraphQLSchema\n  httpServer: Server\n  createSubscriptionContext: CreateSubscriptionContext\n  logger: TLogger\n  operationLogLevel?: keyof TLogger\n  path?: string\n  verifyToken?: (host: string, token: string) => Promise<JwtPayload>\n  /**\n   * Returns the token to pass to `verifyToken`, e.g. from a JWT assertion header that a proxy adds\n   * to the connect request. Defaults to the bearer token in the `authorization` or `Authorization`\n   * connection parameter. Pass the same function to `createSubscriptionContextFactory`.\n   */\n  extractToken?: ExtractSubscriptionToken\n  requireAuth?: boolean\n  jwtClaimsToLog?: string[]\n  resolveSubscriptionOperationLogger?: (context: GraphQLContext) => TLogger\n  /**\n   * If true, deprecated schema elements a subscription uses are collected and logged when it is\n   * established. Not collected per emitted payload: the usage is a property of the operation.\n   */\n  includeDeprecatedElements?: boolean\n}) {\n  if (requireAuth && !verifyToken) throw new Error('verifyToken must be supplied when requireAuth is true')\n\n  const wsServer = new WebSocketServer({\n    server: httpServer,\n    path,\n  })\n\n  return useServer(\n    {\n      schema,\n      onError(_ctx, message, errors) {\n        logger.error('GraphQL subscriptions server error', { message, errors })\n      },\n      onConnect: async (ctx) => {\n        const connectionEstablished = 'Subscription connection established'\n        if (!verifyToken) {\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return false\n          }\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        try {\n          const claims = await verifyToken(getHost(ctx.extra.request), token)\n          ctx.extra.claims = claims as unknown as undefined\n          logger.info(connectionEstablished, {\n            claims: pick(claims, jwtClaimsToLog),\n          })\n          return true\n        } catch (error) {\n          logger.error('Failed to verify subscription connection auth token', { error })\n          return false\n        }\n      },\n      onSubscribe: async (ctx) => {\n        if (!verifyToken) return\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden')\n          }\n          return\n        }\n        try {\n          await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.warn('Subscription connection auth token is no longer valid', { claims: pick(ctx.extra.claims, jwtClaimsToLog), error })\n          ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden')\n        }\n      },\n      onDisconnect({ extra: { claims } }) {\n        logger.info('Subscription connection disconnected', { claims: pick(claims, jwtClaimsToLog) })\n      },\n      context: async (ctx) => {\n        return createSubscriptionContext({\n          connectRequest: ctx.extra.request,\n          connectionParams: ctx.connectionParams,\n          claims: ctx.extra.claims as JwtPayload | undefined,\n        })\n      },\n      onOperation(_ctx, id, _payload, args) {\n        logSubscriptionOperation({\n          id,\n          args,\n          logLevel: operationLogLevel,\n          resolveLogger: resolveSubscriptionOperationLogger,\n          includeDeprecatedElements,\n        })\n      },\n      onNext(_ctx, id, _payload, args, { data, ...result }) {\n        logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger })\n      },\n    },\n    wsServer,\n  )\n}\n"],"names":["defaultExtractSubscriptionToken","WebSocketServer","useServer","getHost","pick","CloseCode","logSubscriptionOperation"],"mappings":";;;;;;;;;SAYgB,sBAAsB,CAAkC,EACtE,MAAM,EACN,UAAU,EACV,yBAAyB,EACzB,MAAM,EACN,iBAAiB,GAAG,MAAM,EAC1B,IAAI,GAAG,UAAU,EACjB,WAAW,EACX,YAAY,GAAGA,qCAA+B,EAC9C,WAAW,EACX,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,kCAAkC,EAClC,yBAAyB,GAuB1B,EAAA;IACC,IAAI,WAAW,IAAI,CAAC,WAAW;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC;AAEzG,IAAA,MAAM,QAAQ,GAAG,IAAIC,kBAAe,CAAC;AACnC,QAAA,MAAM,EAAE,UAAU;QAClB,IAAI;AACL,KAAA,CAAC;AAEF,IAAA,OAAOC,cAAS,CACd;QACE,MAAM;AACN,QAAA,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAA;YAC3B,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACzE,CAAC;AACD,QAAA,SAAS,EAAE,OAAO,GAAG,KAAI;YACvB,MAAM,qBAAqB,GAAG,qCAAqC;YACnE,IAAI,CAAC,WAAW,EAAE;AAChB,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;YAEA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,OAAO,KAAK;gBACd;AACA,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;AAEA,YAAA,IAAI;AACF,gBAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAACC,aAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;AACnE,gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,MAA8B;AACjD,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;AACjC,oBAAA,MAAM,EAAEC,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACrC,iBAAA,CAAC;AACF,gBAAA,OAAO,IAAI;YACb;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC;AAC9E,gBAAA,OAAO,KAAK;YACd;QACF,CAAC;AACD,QAAA,WAAW,EAAE,OAAO,GAAG,KAAI;AACzB,YAAA,IAAI,CAAC,WAAW;gBAAE;YAClB,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAACC,mBAAS,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1D;gBACA;YACF;AACA,YAAA,IAAI;AACF,gBAAA,MAAM,WAAW,CAACF,aAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YACtD;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAEC,WAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/H,gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAACC,mBAAS,CAAC,SAAS,EAAE,WAAW,CAAC;YAC1D;QACF,CAAC;AACD,QAAA,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAA;AAChC,YAAA,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAED,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/F,CAAC;AACD,QAAA,OAAO,EAAE,OAAO,GAAG,KAAI;AACrB,YAAA,OAAO,yBAAyB,CAAC;AAC/B,gBAAA,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;gBACjC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;AACtC,gBAAA,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAgC;AACnD,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAA;AAClC,YAAAE,gCAAwB,CAAC;gBACvB,EAAE;gBACF,IAAI;AACJ,gBAAA,QAAQ,EAAE,iBAAiB;AAC3B,gBAAA,aAAa,EAAE,kCAAkC;gBACjD,yBAAyB;AAC1B,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAA;AAClD,YAAAA,gCAAwB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,kCAAkC,EAAE,CAAC;QAChI,CAAC;KACF,EACD,QAAQ,CACT;AACH;;;;"}
+{"version":3,"file":"server.js","sources":["../../src/subscriptions/server.ts"],"sourcesContent":["import type { Logger } from '@makerx/node-common'\nimport { pick } from 'es-toolkit/compat'\nimport { GraphQLError, type GraphQLSchema } from 'graphql'\nimport { CloseCode } from 'graphql-ws'\nimport { useServer } from 'graphql-ws/use/ws'\nimport type { Server } from 'http'\nimport { WebSocketServer, type WebSocket } from 'ws'\nimport type { GraphQLContext, JwtPayload } from '../context'\nimport { logSubscriptionOperation } from '../logging'\nimport type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context'\nimport { defaultExtractSubscriptionToken, getHost } from './utils'\n\n// The longest delay setTimeout accepts. A connection that ends later than this is timed in steps.\nconst maxTimeoutMs = 2 ** 31 - 1\n\n// What onSubscribe returns for an operation it refuses, so onError can tell a refusal from a real error.\nclass SubscriptionRefusedError extends GraphQLError {\n  constructor() {\n    super('Forbidden', { extensions: { code: 'FORBIDDEN' } })\n  }\n}\n\nexport function useSubscriptionsServer<TLogger extends Logger = Logger>({\n  schema,\n  httpServer,\n  createSubscriptionContext,\n  logger,\n  operationLogLevel = 'info',\n  path = '/graphql',\n  verifyToken,\n  extractToken = defaultExtractSubscriptionToken,\n  requireAuth,\n  jwtClaimsToLog = ['oid', 'iss'],\n  resolveSubscriptionOperationLogger,\n  includeDeprecatedElements,\n  connectionExpiry,\n  keepAlive = 12_000,\n}: {\n  schema: GraphQLSchema\n  httpServer: Server\n  createSubscriptionContext: CreateSubscriptionContext\n  logger: TLogger\n  operationLogLevel?: keyof TLogger\n  path?: string\n  verifyToken?: (host: string, token: string) => Promise<JwtPayload>\n  /**\n   * Returns the token to pass to `verifyToken`, e.g. from a JWT assertion header that a proxy adds\n   * to the connect request. Defaults to the bearer token in the `authorization` or `Authorization`\n   * connection parameter. Pass the same function to `createSubscriptionContextFactory`.\n   */\n  extractToken?: ExtractSubscriptionToken\n  requireAuth?: boolean\n  jwtClaimsToLog?: string[]\n  resolveSubscriptionOperationLogger?: (context: GraphQLContext) => TLogger\n  /**\n   * If true, deprecated schema elements a subscription uses are collected and logged when it is\n   * established. Not collected per emitted payload: the usage is a property of the operation.\n   */\n  includeDeprecatedElements?: boolean\n  /**\n   * Returns the time a connection ends, in milliseconds since the epoch, from the claims `verifyToken`\n   * returned when it was established. `undefined` keeps the default behaviour below.\n   *\n   * When it returns a time:\n   * - A time already past refuses the connection with `4403 Forbidden`, as an invalid token does.\n   * - Otherwise at that time the connection is closed with `4403`, which ends every subscription\n   *   running on it.\n   * - Until then the client may subscribe again on the connection, and the token is not verified\n   *   again: it was verified when the connection was established, and it cannot change for the life\n   *   of the connection.\n   *\n   * To end a connection when its token expires: `(claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)`.\n   * When the token is short-lived proof of a longer session, such as an assertion that a proxy adds to\n   * the upgrade request, a later time keeps subscriptions from being cut off every few minutes:\n   * `(claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)`. A connection then\n   * outlives its token, so a revoked session is noticed only when the connection ends.\n   *\n   * By default a connection has no set end. Its token is verified again each time the client\n   * subscribes, and a token that no longer verifies closes the connection with `4403` then.\n   * Subscriptions already running continue until that happens.\n   *\n   * graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: the\n   * client's `connectionParams` must be a function that returns a current token, or the upgrade\n   * request must be authenticated afresh (by a cookie and a proxy, for example). A client that sends\n   * the same expired token fails again until its `retryAttempts` run out, and its subscriptions then\n   * end with an error.\n   */\n  connectionExpiry?: (claims: JwtPayload) => number | undefined\n  /**\n   * Milliseconds between the server's websocket pings. A connection that has not answered a ping by\n   * the time the next one is due is terminated. `0` turns the pings off. Defaults to graphql-ws's 12\n   * seconds.\n   */\n  keepAlive?: number\n}) {\n  if (requireAuth && !verifyToken) throw new Error('verifyToken must be supplied when requireAuth is true')\n\n  const wsServer = new WebSocketServer({\n    server: httpServer,\n    path,\n  })\n\n  // When each connection ends, for the connections that connectionExpiry gave a time.\n  const connectionEnds = new WeakMap<WebSocket, number>()\n\n  const endConnectionAt = (socket: WebSocket, endsAt: number, claims: JwtPayload) => {\n    // A client that went away while its token was being verified has already closed the socket.\n    if (socket.readyState !== socket.OPEN) return\n    connectionEnds.set(socket, endsAt)\n    let timer: NodeJS.Timeout | undefined\n    // The socket's own close event, not graphql-ws's onClose, which waits for every subscription on the connection to\n    // return. A subscription waiting for its next event can hold that up indefinitely.\n    socket.once('close', () => clearTimeout(timer))\n    const schedule = () => {\n      const remaining = endsAt - Date.now()\n      timer = setTimeout(\n        () => {\n          if (remaining > maxTimeoutMs) return schedule()\n          if (socket.readyState !== socket.OPEN) return\n          logger.info('Subscription connection expired', { claims: pick(claims, jwtClaimsToLog) })\n          socket.close(CloseCode.Forbidden, 'Forbidden')\n        },\n        Math.min(Math.max(remaining, 0), maxTimeoutMs),\n      )\n      timer.unref()\n    }\n    schedule()\n  }\n\n  // Closes the connection, and keeps graphql-ws from running the operation: it would run it after the\n  // close if onSubscribe returned nothing.\n  const refuse = (socket: WebSocket) => {\n    socket.close(CloseCode.Forbidden, 'Forbidden')\n    return [new SubscriptionRefusedError()]\n  }\n\n  return useServer(\n    {\n      schema,\n      onError(_ctx, id, _payload, errors) {\n        // A refusal is already logged, and is not a server error.\n        if (errors.every((error) => error instanceof SubscriptionRefusedError)) return\n        logger.error('GraphQL subscriptions server error', { id, errors })\n      },\n      onConnect: async (ctx) => {\n        const connectionEstablished = 'Subscription connection established'\n        if (!verifyToken) {\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return false\n          }\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        let claims: JwtPayload\n        try {\n          claims = await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.error('Failed to verify subscription connection auth token', { error })\n          return false\n        }\n\n        let endsAt: number | undefined\n        try {\n          endsAt = connectionExpiry?.(claims)\n        } catch (error) {\n          logger.error('Failed to compute subscription connection expiry', { claims: pick(claims, jwtClaimsToLog), error })\n          return false\n        }\n        // Refused before the connection is acknowledged: an acknowledged connection resets a graphql-ws\n        // client's retry count, so closing it at once would have the client reconnect without end.\n        if (endsAt !== undefined && !(endsAt > Date.now())) {\n          logger.warn('Subscription connection has already expired', { claims: pick(claims, jwtClaimsToLog) })\n          return false\n        }\n\n        ctx.extra.claims = claims as unknown as undefined\n        logger.info(connectionEstablished, {\n          claims: pick(claims, jwtClaimsToLog),\n        })\n        if (endsAt !== undefined) endConnectionAt(ctx.extra.socket, endsAt, claims)\n        return true\n      },\n      onSubscribe: async (ctx) => {\n        if (!verifyToken) return\n        const endsAt = connectionEnds.get(ctx.extra.socket)\n        if (endsAt !== undefined) {\n          // The token stands for the life connectionExpiry gave the connection. This covers an operation that\n          // arrives before the timer closes the connection.\n          if (Date.now() < endsAt) return\n          logger.warn('Subscription connection has expired', { claims: pick(ctx.extra.claims, jwtClaimsToLog) })\n          return refuse(ctx.extra.socket)\n        }\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return refuse(ctx.extra.socket)\n          }\n          return\n        }\n        try {\n          await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.warn('Subscription connection auth token is no longer valid', { claims: pick(ctx.extra.claims, jwtClaimsToLog), error })\n          return refuse(ctx.extra.socket)\n        }\n      },\n      onDisconnect({ extra: { claims } }) {\n        logger.info('Subscription connection disconnected', { claims: pick(claims, jwtClaimsToLog) })\n      },\n      context: async (ctx) => {\n        return createSubscriptionContext({\n          connectRequest: ctx.extra.request,\n          connectionParams: ctx.connectionParams,\n          claims: ctx.extra.claims as JwtPayload | undefined,\n        })\n      },\n      onOperation(_ctx, id, _payload, args) {\n        logSubscriptionOperation({\n          id,\n          args,\n          logLevel: operationLogLevel,\n          resolveLogger: resolveSubscriptionOperationLogger,\n          includeDeprecatedElements,\n        })\n      },\n      onNext(_ctx, id, _payload, args, { data, ...result }) {\n        logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger })\n      },\n    },\n    wsServer,\n    keepAlive,\n  )\n}\n"],"names":["GraphQLError","defaultExtractSubscriptionToken","WebSocketServer","pick","CloseCode","useServer","getHost","logSubscriptionOperation"],"mappings":";;;;;;;;;;AAYA;AACA,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;AAEhC;AACA,MAAM,wBAAyB,SAAQA,oBAAY,CAAA;AACjD,IAAA,WAAA,GAAA;AACE,QAAA,KAAK,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IAC3D;AACD;AAEK,SAAU,sBAAsB,CAAkC,EACtE,MAAM,EACN,UAAU,EACV,yBAAyB,EACzB,MAAM,EACN,iBAAiB,GAAG,MAAM,EAC1B,IAAI,GAAG,UAAU,EACjB,WAAW,EACX,YAAY,GAAGC,qCAA+B,EAC9C,WAAW,EACX,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,gBAAgB,EAChB,SAAS,GAAG,KAAM,GA0DnB,EAAA;IACC,IAAI,WAAW,IAAI,CAAC,WAAW;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC;AAEzG,IAAA,MAAM,QAAQ,GAAG,IAAIC,kBAAe,CAAC;AACnC,QAAA,MAAM,EAAE,UAAU;QAClB,IAAI;AACL,KAAA,CAAC;;AAGF,IAAA,MAAM,cAAc,GAAG,IAAI,OAAO,EAAqB;IAEvD,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,MAAc,EAAE,MAAkB,KAAI;;AAEhF,QAAA,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;YAAE;AACvC,QAAA,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;AAClC,QAAA,IAAI,KAAiC;;;AAGrC,QAAA,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAK;YACpB,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AACrC,YAAA,KAAK,GAAG,UAAU,CAChB,MAAK;gBACH,IAAI,SAAS,GAAG,YAAY;oBAAE,OAAO,QAAQ,EAAE;AAC/C,gBAAA,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;oBAAE;AACvC,gBAAA,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAEC,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;gBACxF,MAAM,CAAC,KAAK,CAACC,mBAAS,CAAC,SAAS,EAAE,WAAW,CAAC;AAChD,YAAA,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAC/C;YACD,KAAK,CAAC,KAAK,EAAE;AACf,QAAA,CAAC;AACD,QAAA,QAAQ,EAAE;AACZ,IAAA,CAAC;;;AAID,IAAA,MAAM,MAAM,GAAG,CAAC,MAAiB,KAAI;QACnC,MAAM,CAAC,KAAK,CAACA,mBAAS,CAAC,SAAS,EAAE,WAAW,CAAC;AAC9C,QAAA,OAAO,CAAC,IAAI,wBAAwB,EAAE,CAAC;AACzC,IAAA,CAAC;AAED,IAAA,OAAOC,cAAS,CACd;QACE,MAAM;AACN,QAAA,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAA;;AAEhC,YAAA,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,YAAY,wBAAwB,CAAC;gBAAE;YACxE,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;AACD,QAAA,SAAS,EAAE,OAAO,GAAG,KAAI;YACvB,MAAM,qBAAqB,GAAG,qCAAqC;YACnE,IAAI,CAAC,WAAW,EAAE;AAChB,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;YAEA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,OAAO,KAAK;gBACd;AACA,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;AAEA,YAAA,IAAI,MAAkB;AACtB,YAAA,IAAI;AACF,gBAAA,MAAM,GAAG,MAAM,WAAW,CAACC,aAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAC/D;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC;AAC9E,gBAAA,OAAO,KAAK;YACd;AAEA,YAAA,IAAI,MAA0B;AAC9B,YAAA,IAAI;AACF,gBAAA,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC;YACrC;YAAE,OAAO,KAAK,EAAE;AACd,gBAAA,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAEH,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AACjH,gBAAA,OAAO,KAAK;YACd;;;AAGA,YAAA,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;AAClD,gBAAA,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAEA,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;AACpG,gBAAA,OAAO,KAAK;YACd;AAEA,YAAA,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,MAA8B;AACjD,YAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;AACjC,gBAAA,MAAM,EAAEA,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACrC,aAAA,CAAC;YACF,IAAI,MAAM,KAAK,SAAS;gBAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;AAC3E,YAAA,OAAO,IAAI;QACb,CAAC;AACD,QAAA,WAAW,EAAE,OAAO,GAAG,KAAI;AACzB,YAAA,IAAI,CAAC,WAAW;gBAAE;AAClB,YAAA,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;AACnD,YAAA,IAAI,MAAM,KAAK,SAAS,EAAE;;;AAGxB,gBAAA,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;oBAAE;gBACzB,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAEA,WAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;gBACtG,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC;YACA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;oBACxE,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACjC;gBACA;YACF;AACA,YAAA,IAAI;AACF,gBAAA,MAAM,WAAW,CAACG,aAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YACtD;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAEH,WAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/H,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC;QACF,CAAC;AACD,QAAA,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAA;AAChC,YAAA,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAEA,WAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/F,CAAC;AACD,QAAA,OAAO,EAAE,OAAO,GAAG,KAAI;AACrB,YAAA,OAAO,yBAAyB,CAAC;AAC/B,gBAAA,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;gBACjC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;AACtC,gBAAA,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAgC;AACnD,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAA;AAClC,YAAAI,gCAAwB,CAAC;gBACvB,EAAE;gBACF,IAAI;AACJ,gBAAA,QAAQ,EAAE,iBAAiB;AAC3B,gBAAA,aAAa,EAAE,kCAAkC;gBACjD,yBAAyB;AAC1B,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAA;AAClD,YAAAA,gCAAwB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,kCAAkC,EAAE,CAAC;QAChI,CAAC;AACF,KAAA,EACD,QAAQ,EACR,SAAS,CACV;AACH;;;;"}

package/subscriptions/server.mjs

@@ -1,21 +1,64 @@
 import { pick } from 'es-toolkit/compat';
+import { GraphQLError } from 'graphql';
 import { CloseCode } from 'graphql-ws';
 import { useServer } from 'graphql-ws/use/ws';
 import { WebSocketServer } from 'ws';
 import { logSubscriptionOperation } from '../logging.mjs';
 import { defaultExtractSubscriptionToken, getHost } from './utils.mjs';
 
-function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel = 'info', path = '/graphql', verifyToken, extractToken = defaultExtractSubscriptionToken, requireAuth, jwtClaimsToLog = ['oid', 'iss'], resolveSubscriptionOperationLogger, includeDeprecatedElements, }) {
+// The longest delay setTimeout accepts. A connection that ends later than this is timed in steps.
+const maxTimeoutMs = 2 ** 31 - 1;
+// What onSubscribe returns for an operation it refuses, so onError can tell a refusal from a real error.
+class SubscriptionRefusedError extends GraphQLError {
+    constructor() {
+        super('Forbidden', { extensions: { code: 'FORBIDDEN' } });
+    }
+}
+function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext, logger, operationLogLevel = 'info', path = '/graphql', verifyToken, extractToken = defaultExtractSubscriptionToken, requireAuth, jwtClaimsToLog = ['oid', 'iss'], resolveSubscriptionOperationLogger, includeDeprecatedElements, connectionExpiry, keepAlive = 12000, }) {
     if (requireAuth && !verifyToken)
         throw new Error('verifyToken must be supplied when requireAuth is true');
     const wsServer = new WebSocketServer({
         server: httpServer,
         path,
     });
+    // When each connection ends, for the connections that connectionExpiry gave a time.
+    const connectionEnds = new WeakMap();
+    const endConnectionAt = (socket, endsAt, claims) => {
+        // A client that went away while its token was being verified has already closed the socket.
+        if (socket.readyState !== socket.OPEN)
+            return;
+        connectionEnds.set(socket, endsAt);
+        let timer;
+        // The socket's own close event, not graphql-ws's onClose, which waits for every subscription on the connection to
+        // return. A subscription waiting for its next event can hold that up indefinitely.
+        socket.once('close', () => clearTimeout(timer));
+        const schedule = () => {
+            const remaining = endsAt - Date.now();
+            timer = setTimeout(() => {
+                if (remaining > maxTimeoutMs)
+                    return schedule();
+                if (socket.readyState !== socket.OPEN)
+                    return;
+                logger.info('Subscription connection expired', { claims: pick(claims, jwtClaimsToLog) });
+                socket.close(CloseCode.Forbidden, 'Forbidden');
+            }, Math.min(Math.max(remaining, 0), maxTimeoutMs));
+            timer.unref();
+        };
+        schedule();
+    };
+    // Closes the connection, and keeps graphql-ws from running the operation: it would run it after the
+    // close if onSubscribe returned nothing.
+    const refuse = (socket) => {
+        socket.close(CloseCode.Forbidden, 'Forbidden');
+        return [new SubscriptionRefusedError()];
+    };
     return useServer({
         schema,
-        onError(_ctx, message, errors) {
-            logger.error('GraphQL subscriptions server error', { message, errors });
+        onError(_ctx, id, _payload, errors) {
+            // A refusal is already logged, and is not a server error.
+            if (errors.every((error) => error instanceof SubscriptionRefusedError))
+                return;
+            logger.error('GraphQL subscriptions server error', { id, errors });
         },
         onConnect: async (ctx) => {
             const connectionEstablished = 'Subscription connection established';
@@ -32,27 +75,53 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
                 logger.info(connectionEstablished);
                 return true;
             }
+            let claims;
             try {
-                const claims = await verifyToken(getHost(ctx.extra.request), token);
-                ctx.extra.claims = claims;
-                logger.info(connectionEstablished, {
-                    claims: pick(claims, jwtClaimsToLog),
-                });
-                return true;
+                claims = await verifyToken(getHost(ctx.extra.request), token);
             }
             catch (error) {
                 logger.error('Failed to verify subscription connection auth token', { error });
                 return false;
             }
+            let endsAt;
+            try {
+                endsAt = connectionExpiry?.(claims);
+            }
+            catch (error) {
+                logger.error('Failed to compute subscription connection expiry', { claims: pick(claims, jwtClaimsToLog), error });
+                return false;
+            }
+            // Refused before the connection is acknowledged: an acknowledged connection resets a graphql-ws
+            // client's retry count, so closing it at once would have the client reconnect without end.
+            if (endsAt !== undefined && !(endsAt > Date.now())) {
+                logger.warn('Subscription connection has already expired', { claims: pick(claims, jwtClaimsToLog) });
+                return false;
+            }
+            ctx.extra.claims = claims;
+            logger.info(connectionEstablished, {
+                claims: pick(claims, jwtClaimsToLog),
+            });
+            if (endsAt !== undefined)
+                endConnectionAt(ctx.extra.socket, endsAt, claims);
+            return true;
         },
         onSubscribe: async (ctx) => {
             if (!verifyToken)
                 return;
+            const endsAt = connectionEnds.get(ctx.extra.socket);
+            if (endsAt !== undefined) {
+                // The token stands for the life connectionExpiry gave the connection. This covers an operation that
+                // arrives before the timer closes the connection.
+                if (Date.now() < endsAt)
+                    return;
+                logger.warn('Subscription connection has expired', { claims: pick(ctx.extra.claims, jwtClaimsToLog) });
+                return refuse(ctx.extra.socket);
+            }
             const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams });
             if (!token) {
                 if (requireAuth) {
                     logger.error('No auth token was supplied with the websocket connection');
-                    ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden');
+                    return refuse(ctx.extra.socket);
                 }
                 return;
             }
@@ -61,7 +130,7 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
             }
             catch (error) {
                 logger.warn('Subscription connection auth token is no longer valid', { claims: pick(ctx.extra.claims, jwtClaimsToLog), error });
-                ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden');
+                return refuse(ctx.extra.socket);
             }
         },
         onDisconnect({ extra: { claims } }) {
@@ -86,7 +155,7 @@ function useSubscriptionsServer({ schema, httpServer, createSubscriptionContext,
         onNext(_ctx, id, _payload, args, { data, ...result }) {
             logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger });
         },
-    }, wsServer);
+    }, wsServer, keepAlive);
 }
 
 export { useSubscriptionsServer };

package/subscriptions/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","sources":["../../src/subscriptions/server.ts"],"sourcesContent":["import type { Logger } from '@makerx/node-common'\nimport { pick } from 'es-toolkit/compat'\nimport type { GraphQLSchema } from 'graphql'\nimport { CloseCode } from 'graphql-ws'\nimport { useServer } from 'graphql-ws/use/ws'\nimport type { Server } from 'http'\nimport { WebSocketServer } from 'ws'\nimport type { GraphQLContext, JwtPayload } from '../context'\nimport { logSubscriptionOperation } from '../logging'\nimport type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context'\nimport { defaultExtractSubscriptionToken, getHost } from './utils'\n\nexport function useSubscriptionsServer<TLogger extends Logger = Logger>({\n  schema,\n  httpServer,\n  createSubscriptionContext,\n  logger,\n  operationLogLevel = 'info',\n  path = '/graphql',\n  verifyToken,\n  extractToken = defaultExtractSubscriptionToken,\n  requireAuth,\n  jwtClaimsToLog = ['oid', 'iss'],\n  resolveSubscriptionOperationLogger,\n  includeDeprecatedElements,\n}: {\n  schema: GraphQLSchema\n  httpServer: Server\n  createSubscriptionContext: CreateSubscriptionContext\n  logger: TLogger\n  operationLogLevel?: keyof TLogger\n  path?: string\n  verifyToken?: (host: string, token: string) => Promise<JwtPayload>\n  /**\n   * Returns the token to pass to `verifyToken`, e.g. from a JWT assertion header that a proxy adds\n   * to the connect request. Defaults to the bearer token in the `authorization` or `Authorization`\n   * connection parameter. Pass the same function to `createSubscriptionContextFactory`.\n   */\n  extractToken?: ExtractSubscriptionToken\n  requireAuth?: boolean\n  jwtClaimsToLog?: string[]\n  resolveSubscriptionOperationLogger?: (context: GraphQLContext) => TLogger\n  /**\n   * If true, deprecated schema elements a subscription uses are collected and logged when it is\n   * established. Not collected per emitted payload: the usage is a property of the operation.\n   */\n  includeDeprecatedElements?: boolean\n}) {\n  if (requireAuth && !verifyToken) throw new Error('verifyToken must be supplied when requireAuth is true')\n\n  const wsServer = new WebSocketServer({\n    server: httpServer,\n    path,\n  })\n\n  return useServer(\n    {\n      schema,\n      onError(_ctx, message, errors) {\n        logger.error('GraphQL subscriptions server error', { message, errors })\n      },\n      onConnect: async (ctx) => {\n        const connectionEstablished = 'Subscription connection established'\n        if (!verifyToken) {\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return false\n          }\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        try {\n          const claims = await verifyToken(getHost(ctx.extra.request), token)\n          ctx.extra.claims = claims as unknown as undefined\n          logger.info(connectionEstablished, {\n            claims: pick(claims, jwtClaimsToLog),\n          })\n          return true\n        } catch (error) {\n          logger.error('Failed to verify subscription connection auth token', { error })\n          return false\n        }\n      },\n      onSubscribe: async (ctx) => {\n        if (!verifyToken) return\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden')\n          }\n          return\n        }\n        try {\n          await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.warn('Subscription connection auth token is no longer valid', { claims: pick(ctx.extra.claims, jwtClaimsToLog), error })\n          ctx.extra.socket.close(CloseCode.Forbidden, 'Forbidden')\n        }\n      },\n      onDisconnect({ extra: { claims } }) {\n        logger.info('Subscription connection disconnected', { claims: pick(claims, jwtClaimsToLog) })\n      },\n      context: async (ctx) => {\n        return createSubscriptionContext({\n          connectRequest: ctx.extra.request,\n          connectionParams: ctx.connectionParams,\n          claims: ctx.extra.claims as JwtPayload | undefined,\n        })\n      },\n      onOperation(_ctx, id, _payload, args) {\n        logSubscriptionOperation({\n          id,\n          args,\n          logLevel: operationLogLevel,\n          resolveLogger: resolveSubscriptionOperationLogger,\n          includeDeprecatedElements,\n        })\n      },\n      onNext(_ctx, id, _payload, args, { data, ...result }) {\n        logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger })\n      },\n    },\n    wsServer,\n  )\n}\n"],"names":[],"mappings":";;;;;;;SAYgB,sBAAsB,CAAkC,EACtE,MAAM,EACN,UAAU,EACV,yBAAyB,EACzB,MAAM,EACN,iBAAiB,GAAG,MAAM,EAC1B,IAAI,GAAG,UAAU,EACjB,WAAW,EACX,YAAY,GAAG,+BAA+B,EAC9C,WAAW,EACX,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,kCAAkC,EAClC,yBAAyB,GAuB1B,EAAA;IACC,IAAI,WAAW,IAAI,CAAC,WAAW;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC;AAEzG,IAAA,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;AACnC,QAAA,MAAM,EAAE,UAAU;QAClB,IAAI;AACL,KAAA,CAAC;AAEF,IAAA,OAAO,SAAS,CACd;QACE,MAAM;AACN,QAAA,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAA;YAC3B,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACzE,CAAC;AACD,QAAA,SAAS,EAAE,OAAO,GAAG,KAAI;YACvB,MAAM,qBAAqB,GAAG,qCAAqC;YACnE,IAAI,CAAC,WAAW,EAAE;AAChB,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;YAEA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,OAAO,KAAK;gBACd;AACA,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;AAEA,YAAA,IAAI;AACF,gBAAA,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;AACnE,gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,MAA8B;AACjD,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;AACjC,oBAAA,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACrC,iBAAA,CAAC;AACF,gBAAA,OAAO,IAAI;YACb;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC;AAC9E,gBAAA,OAAO,KAAK;YACd;QACF,CAAC;AACD,QAAA,WAAW,EAAE,OAAO,GAAG,KAAI;AACzB,YAAA,IAAI,CAAC,WAAW;gBAAE;YAClB,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1D;gBACA;YACF;AACA,YAAA,IAAI;AACF,gBAAA,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YACtD;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AAC/H,gBAAA,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC;YAC1D;QACF,CAAC;AACD,QAAA,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAA;AAChC,YAAA,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/F,CAAC;AACD,QAAA,OAAO,EAAE,OAAO,GAAG,KAAI;AACrB,YAAA,OAAO,yBAAyB,CAAC;AAC/B,gBAAA,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;gBACjC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;AACtC,gBAAA,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAgC;AACnD,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAA;AAClC,YAAA,wBAAwB,CAAC;gBACvB,EAAE;gBACF,IAAI;AACJ,gBAAA,QAAQ,EAAE,iBAAiB;AAC3B,gBAAA,aAAa,EAAE,kCAAkC;gBACjD,yBAAyB;AAC1B,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAA;AAClD,YAAA,wBAAwB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,kCAAkC,EAAE,CAAC;QAChI,CAAC;KACF,EACD,QAAQ,CACT;AACH;;;;"}
+{"version":3,"file":"server.mjs","sources":["../../src/subscriptions/server.ts"],"sourcesContent":["import type { Logger } from '@makerx/node-common'\nimport { pick } from 'es-toolkit/compat'\nimport { GraphQLError, type GraphQLSchema } from 'graphql'\nimport { CloseCode } from 'graphql-ws'\nimport { useServer } from 'graphql-ws/use/ws'\nimport type { Server } from 'http'\nimport { WebSocketServer, type WebSocket } from 'ws'\nimport type { GraphQLContext, JwtPayload } from '../context'\nimport { logSubscriptionOperation } from '../logging'\nimport type { CreateSubscriptionContext, ExtractSubscriptionToken } from './context'\nimport { defaultExtractSubscriptionToken, getHost } from './utils'\n\n// The longest delay setTimeout accepts. A connection that ends later than this is timed in steps.\nconst maxTimeoutMs = 2 ** 31 - 1\n\n// What onSubscribe returns for an operation it refuses, so onError can tell a refusal from a real error.\nclass SubscriptionRefusedError extends GraphQLError {\n  constructor() {\n    super('Forbidden', { extensions: { code: 'FORBIDDEN' } })\n  }\n}\n\nexport function useSubscriptionsServer<TLogger extends Logger = Logger>({\n  schema,\n  httpServer,\n  createSubscriptionContext,\n  logger,\n  operationLogLevel = 'info',\n  path = '/graphql',\n  verifyToken,\n  extractToken = defaultExtractSubscriptionToken,\n  requireAuth,\n  jwtClaimsToLog = ['oid', 'iss'],\n  resolveSubscriptionOperationLogger,\n  includeDeprecatedElements,\n  connectionExpiry,\n  keepAlive = 12_000,\n}: {\n  schema: GraphQLSchema\n  httpServer: Server\n  createSubscriptionContext: CreateSubscriptionContext\n  logger: TLogger\n  operationLogLevel?: keyof TLogger\n  path?: string\n  verifyToken?: (host: string, token: string) => Promise<JwtPayload>\n  /**\n   * Returns the token to pass to `verifyToken`, e.g. from a JWT assertion header that a proxy adds\n   * to the connect request. Defaults to the bearer token in the `authorization` or `Authorization`\n   * connection parameter. Pass the same function to `createSubscriptionContextFactory`.\n   */\n  extractToken?: ExtractSubscriptionToken\n  requireAuth?: boolean\n  jwtClaimsToLog?: string[]\n  resolveSubscriptionOperationLogger?: (context: GraphQLContext) => TLogger\n  /**\n   * If true, deprecated schema elements a subscription uses are collected and logged when it is\n   * established. Not collected per emitted payload: the usage is a property of the operation.\n   */\n  includeDeprecatedElements?: boolean\n  /**\n   * Returns the time a connection ends, in milliseconds since the epoch, from the claims `verifyToken`\n   * returned when it was established. `undefined` keeps the default behaviour below.\n   *\n   * When it returns a time:\n   * - A time already past refuses the connection with `4403 Forbidden`, as an invalid token does.\n   * - Otherwise at that time the connection is closed with `4403`, which ends every subscription\n   *   running on it.\n   * - Until then the client may subscribe again on the connection, and the token is not verified\n   *   again: it was verified when the connection was established, and it cannot change for the life\n   *   of the connection.\n   *\n   * To end a connection when its token expires: `(claims) => (claims.exp === undefined ? undefined : claims.exp * 1000)`.\n   * When the token is short-lived proof of a longer session, such as an assertion that a proxy adds to\n   * the upgrade request, a later time keeps subscriptions from being cut off every few minutes:\n   * `(claims) => (claims.iat === undefined ? undefined : (claims.iat + 3600) * 1000)`. A connection then\n   * outlives its token, so a revoked session is noticed only when the connection ends.\n   *\n   * By default a connection has no set end. Its token is verified again each time the client\n   * subscribes, and a token that no longer verifies closes the connection with `4403` then.\n   * Subscriptions already running continue until that happens.\n   *\n   * graphql-ws clients retry `4403` by default, but a retry succeeds only with a fresh token: the\n   * client's `connectionParams` must be a function that returns a current token, or the upgrade\n   * request must be authenticated afresh (by a cookie and a proxy, for example). A client that sends\n   * the same expired token fails again until its `retryAttempts` run out, and its subscriptions then\n   * end with an error.\n   */\n  connectionExpiry?: (claims: JwtPayload) => number | undefined\n  /**\n   * Milliseconds between the server's websocket pings. A connection that has not answered a ping by\n   * the time the next one is due is terminated. `0` turns the pings off. Defaults to graphql-ws's 12\n   * seconds.\n   */\n  keepAlive?: number\n}) {\n  if (requireAuth && !verifyToken) throw new Error('verifyToken must be supplied when requireAuth is true')\n\n  const wsServer = new WebSocketServer({\n    server: httpServer,\n    path,\n  })\n\n  // When each connection ends, for the connections that connectionExpiry gave a time.\n  const connectionEnds = new WeakMap<WebSocket, number>()\n\n  const endConnectionAt = (socket: WebSocket, endsAt: number, claims: JwtPayload) => {\n    // A client that went away while its token was being verified has already closed the socket.\n    if (socket.readyState !== socket.OPEN) return\n    connectionEnds.set(socket, endsAt)\n    let timer: NodeJS.Timeout | undefined\n    // The socket's own close event, not graphql-ws's onClose, which waits for every subscription on the connection to\n    // return. A subscription waiting for its next event can hold that up indefinitely.\n    socket.once('close', () => clearTimeout(timer))\n    const schedule = () => {\n      const remaining = endsAt - Date.now()\n      timer = setTimeout(\n        () => {\n          if (remaining > maxTimeoutMs) return schedule()\n          if (socket.readyState !== socket.OPEN) return\n          logger.info('Subscription connection expired', { claims: pick(claims, jwtClaimsToLog) })\n          socket.close(CloseCode.Forbidden, 'Forbidden')\n        },\n        Math.min(Math.max(remaining, 0), maxTimeoutMs),\n      )\n      timer.unref()\n    }\n    schedule()\n  }\n\n  // Closes the connection, and keeps graphql-ws from running the operation: it would run it after the\n  // close if onSubscribe returned nothing.\n  const refuse = (socket: WebSocket) => {\n    socket.close(CloseCode.Forbidden, 'Forbidden')\n    return [new SubscriptionRefusedError()]\n  }\n\n  return useServer(\n    {\n      schema,\n      onError(_ctx, id, _payload, errors) {\n        // A refusal is already logged, and is not a server error.\n        if (errors.every((error) => error instanceof SubscriptionRefusedError)) return\n        logger.error('GraphQL subscriptions server error', { id, errors })\n      },\n      onConnect: async (ctx) => {\n        const connectionEstablished = 'Subscription connection established'\n        if (!verifyToken) {\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return false\n          }\n          logger.info(connectionEstablished)\n          return true\n        }\n\n        let claims: JwtPayload\n        try {\n          claims = await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.error('Failed to verify subscription connection auth token', { error })\n          return false\n        }\n\n        let endsAt: number | undefined\n        try {\n          endsAt = connectionExpiry?.(claims)\n        } catch (error) {\n          logger.error('Failed to compute subscription connection expiry', { claims: pick(claims, jwtClaimsToLog), error })\n          return false\n        }\n        // Refused before the connection is acknowledged: an acknowledged connection resets a graphql-ws\n        // client's retry count, so closing it at once would have the client reconnect without end.\n        if (endsAt !== undefined && !(endsAt > Date.now())) {\n          logger.warn('Subscription connection has already expired', { claims: pick(claims, jwtClaimsToLog) })\n          return false\n        }\n\n        ctx.extra.claims = claims as unknown as undefined\n        logger.info(connectionEstablished, {\n          claims: pick(claims, jwtClaimsToLog),\n        })\n        if (endsAt !== undefined) endConnectionAt(ctx.extra.socket, endsAt, claims)\n        return true\n      },\n      onSubscribe: async (ctx) => {\n        if (!verifyToken) return\n        const endsAt = connectionEnds.get(ctx.extra.socket)\n        if (endsAt !== undefined) {\n          // The token stands for the life connectionExpiry gave the connection. This covers an operation that\n          // arrives before the timer closes the connection.\n          if (Date.now() < endsAt) return\n          logger.warn('Subscription connection has expired', { claims: pick(ctx.extra.claims, jwtClaimsToLog) })\n          return refuse(ctx.extra.socket)\n        }\n        const token = extractToken({ connectRequest: ctx.extra.request, connectionParams: ctx.connectionParams })\n        if (!token) {\n          if (requireAuth) {\n            logger.error('No auth token was supplied with the websocket connection')\n            return refuse(ctx.extra.socket)\n          }\n          return\n        }\n        try {\n          await verifyToken(getHost(ctx.extra.request), token)\n        } catch (error) {\n          logger.warn('Subscription connection auth token is no longer valid', { claims: pick(ctx.extra.claims, jwtClaimsToLog), error })\n          return refuse(ctx.extra.socket)\n        }\n      },\n      onDisconnect({ extra: { claims } }) {\n        logger.info('Subscription connection disconnected', { claims: pick(claims, jwtClaimsToLog) })\n      },\n      context: async (ctx) => {\n        return createSubscriptionContext({\n          connectRequest: ctx.extra.request,\n          connectionParams: ctx.connectionParams,\n          claims: ctx.extra.claims as JwtPayload | undefined,\n        })\n      },\n      onOperation(_ctx, id, _payload, args) {\n        logSubscriptionOperation({\n          id,\n          args,\n          logLevel: operationLogLevel,\n          resolveLogger: resolveSubscriptionOperationLogger,\n          includeDeprecatedElements,\n        })\n      },\n      onNext(_ctx, id, _payload, args, { data, ...result }) {\n        logSubscriptionOperation({ id, args, logLevel: operationLogLevel, result, resolveLogger: resolveSubscriptionOperationLogger })\n      },\n    },\n    wsServer,\n    keepAlive,\n  )\n}\n"],"names":[],"mappings":";;;;;;;;AAYA;AACA,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;AAEhC;AACA,MAAM,wBAAyB,SAAQ,YAAY,CAAA;AACjD,IAAA,WAAA,GAAA;AACE,QAAA,KAAK,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IAC3D;AACD;AAEK,SAAU,sBAAsB,CAAkC,EACtE,MAAM,EACN,UAAU,EACV,yBAAyB,EACzB,MAAM,EACN,iBAAiB,GAAG,MAAM,EAC1B,IAAI,GAAG,UAAU,EACjB,WAAW,EACX,YAAY,GAAG,+BAA+B,EAC9C,WAAW,EACX,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,gBAAgB,EAChB,SAAS,GAAG,KAAM,GA0DnB,EAAA;IACC,IAAI,WAAW,IAAI,CAAC,WAAW;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC;AAEzG,IAAA,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;AACnC,QAAA,MAAM,EAAE,UAAU;QAClB,IAAI;AACL,KAAA,CAAC;;AAGF,IAAA,MAAM,cAAc,GAAG,IAAI,OAAO,EAAqB;IAEvD,MAAM,eAAe,GAAG,CAAC,MAAiB,EAAE,MAAc,EAAE,MAAkB,KAAI;;AAEhF,QAAA,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;YAAE;AACvC,QAAA,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;AAClC,QAAA,IAAI,KAAiC;;;AAGrC,QAAA,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAK;YACpB,MAAM,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;AACrC,YAAA,KAAK,GAAG,UAAU,CAChB,MAAK;gBACH,IAAI,SAAS,GAAG,YAAY;oBAAE,OAAO,QAAQ,EAAE;AAC/C,gBAAA,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;oBAAE;AACvC,gBAAA,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;gBACxF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC;AAChD,YAAA,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC,CAC/C;YACD,KAAK,CAAC,KAAK,EAAE;AACf,QAAA,CAAC;AACD,QAAA,QAAQ,EAAE;AACZ,IAAA,CAAC;;;AAID,IAAA,MAAM,MAAM,GAAG,CAAC,MAAiB,KAAI;QACnC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC;AAC9C,QAAA,OAAO,CAAC,IAAI,wBAAwB,EAAE,CAAC;AACzC,IAAA,CAAC;AAED,IAAA,OAAO,SAAS,CACd;QACE,MAAM;AACN,QAAA,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAA;;AAEhC,YAAA,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,KAAK,YAAY,wBAAwB,CAAC;gBAAE;YACxE,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QACpE,CAAC;AACD,QAAA,SAAS,EAAE,OAAO,GAAG,KAAI;YACvB,MAAM,qBAAqB,GAAG,qCAAqC;YACnE,IAAI,CAAC,WAAW,EAAE;AAChB,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;YAEA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;AACxE,oBAAA,OAAO,KAAK;gBACd;AACA,gBAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAClC,gBAAA,OAAO,IAAI;YACb;AAEA,YAAA,IAAI,MAAkB;AACtB,YAAA,IAAI;AACF,gBAAA,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YAC/D;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC;AAC9E,gBAAA,OAAO,KAAK;YACd;AAEA,YAAA,IAAI,MAA0B;AAC9B,YAAA,IAAI;AACF,gBAAA,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC;YACrC;YAAE,OAAO,KAAK,EAAE;AACd,gBAAA,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;AACjH,gBAAA,OAAO,KAAK;YACd;;;AAGA,YAAA,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;AAClD,gBAAA,MAAM,CAAC,IAAI,CAAC,6CAA6C,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;AACpG,gBAAA,OAAO,KAAK;YACd;AAEA,YAAA,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,MAA8B;AACjD,YAAA,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;AACjC,gBAAA,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC;AACrC,aAAA,CAAC;YACF,IAAI,MAAM,KAAK,SAAS;gBAAE,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;AAC3E,YAAA,OAAO,IAAI;QACb,CAAC;AACD,QAAA,WAAW,EAAE,OAAO,GAAG,KAAI;AACzB,YAAA,IAAI,CAAC,WAAW;gBAAE;AAClB,YAAA,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;AACnD,YAAA,IAAI,MAAM,KAAK,SAAS,EAAE;;;AAGxB,gBAAA,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;oBAAE;gBACzB,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;gBACtG,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC;YACA,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACzG,IAAI,CAAC,KAAK,EAAE;gBACV,IAAI,WAAW,EAAE;AACf,oBAAA,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC;oBACxE,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBACjC;gBACA;YACF;AACA,YAAA,IAAI;AACF,gBAAA,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;YACtD;YAAE,OAAO,KAAK,EAAE;gBACd,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/H,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC;QACF,CAAC;AACD,QAAA,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAA;AAChC,YAAA,MAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/F,CAAC;AACD,QAAA,OAAO,EAAE,OAAO,GAAG,KAAI;AACrB,YAAA,OAAO,yBAAyB,CAAC;AAC/B,gBAAA,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO;gBACjC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;AACtC,gBAAA,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAgC;AACnD,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAA;AAClC,YAAA,wBAAwB,CAAC;gBACvB,EAAE;gBACF,IAAI;AACJ,gBAAA,QAAQ,EAAE,iBAAiB;AAC3B,gBAAA,aAAa,EAAE,kCAAkC;gBACjD,yBAAyB;AAC1B,aAAA,CAAC;QACJ,CAAC;AACD,QAAA,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAA;AAClD,YAAA,wBAAwB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,aAAa,EAAE,kCAAkC,EAAE,CAAC;QAChI,CAAC;AACF,KAAA,EACD,QAAQ,EACR,SAAS,CACV;AACH;;;;"}