@nifrajs/graphql 4.0.2 → 5.0.0

package/src/index.ts

@@ -22,7 +22,12 @@ export type {
 } from "./context.ts"
 export { buildContext } from "./context.ts"
 export { type GraphqlHttpOptions, respondGraphql } from "./http.ts"
-export { createPubSub, type GraphqlPubSub } from "./pubsub.ts"
+export {
+  createPubSub,
+  type GraphqlPubSub,
+  type GraphqlPubSubOptions,
+  GraphqlPubSubOverflowError,
+} from "./pubsub.ts"
 export { type GraphqlWsOptions, graphqlWebSocket } from "./ws.ts"
 
 /** The structural slice of a nifra server `mountGraphql` needs. Kept loose so core stays a peer dep. */
@@ -43,12 +48,42 @@ export interface MountGraphqlOptions<Context = unknown, Env = unknown>
   /** Enable `GET /graphql` (queries only). Default `true`. */
   readonly enableGet?: boolean
   /**
-   * Enable `graphql-transport-ws` subscriptions on the same path. Pass the WS options (or `true` to
-   * reuse `schema`/`context`). Requires the app to have `.use(websocket())` and `graphql-ws` installed.
+   * Enable `graphql-transport-ws` subscriptions on the same path. Pass `true` to reuse `schema`,
+   * `context`, `authorize` (run on the upgrade request) and the query limits, or pass the WS options.
+   * With `authorize` set, WS options must bring their own `authorize` or `onConnect`; the mount throws
+   * otherwise, since every socket would be admitted. Requires `.use(websocket())` and `graphql-ws`.
    */
   readonly subscriptions?: boolean | GraphqlWsOptions<Record<string, unknown>>
 }
 
+type Writable<T> = { -readonly [K in keyof T]: T[K] }
+
+const SHARED_LIMITS = [
+  "maxQueryBytes",
+  "maxVariablesBytes",
+  "maxDepth",
+  "maxAliases",
+  "maxComplexity",
+  "maxOperations",
+  "maxFieldOverlaps",
+  "executionTimeoutMs",
+] as const
+
+/** The socket transport of `subscriptions: true`: the HTTP endpoint's schema, context, authorization and limits. */
+function sharedWsOptions<Context, Env>(
+  options: MountGraphqlOptions<Context, Env>,
+): GraphqlWsOptions<Record<string, unknown>> {
+  const shared: Writable<GraphqlWsOptions<Record<string, unknown>>> = { schema: options.schema }
+  const ctx = options.context as GraphqlContextBuilder<Record<string, unknown>> | undefined
+  if (ctx !== undefined) shared.context = ctx
+  if (options.authorize !== undefined) shared.authorize = options.authorize
+  for (const limit of SHARED_LIMITS) {
+    const value = options[limit]
+    if (value !== undefined) shared[limit] = value
+  }
+  return shared
+}
+
 /**
  * Mount a GraphQL endpoint. Wires `POST` (and `GET`, unless disabled) on `path`, injecting the nifra
  * route context into your resolver context, and - when `subscriptions` is set - a `graphql-ws` WebSocket
@@ -87,13 +122,18 @@ export function mountGraphql<Context = unknown, Env = unknown>(
         "mountGraphql: subscriptions require a WebSocket-enabled app - call `.use(websocket())` first.",
       )
     }
-    let wsOptions: GraphqlWsOptions<Record<string, unknown>>
-    if (options.subscriptions === true) {
-      const ctx = options.context as GraphqlContextBuilder<Record<string, unknown>> | undefined
-      wsOptions =
-        ctx !== undefined ? { schema: options.schema, context: ctx } : { schema: options.schema }
-    } else {
-      wsOptions = options.subscriptions
+    const wsOptions =
+      options.subscriptions === true ? sharedWsOptions(options) : options.subscriptions
+    if (
+      options.authorize !== undefined &&
+      wsOptions.authorize === undefined &&
+      wsOptions.onConnect === undefined
+    ) {
+      throw new Error(
+        "mountGraphql: `authorize` guards the HTTP endpoint only, and these subscription options " +
+          "admit every socket. Give them their own `authorize` or `onConnect`, or pass " +
+          "`subscriptions: true` to reuse `authorize`.",
+      )
     }
     app.ws(path, graphqlWebSocket(wsOptions))
   }

package/src/limits.ts

@@ -1,4 +1,11 @@
-import { type DocumentNode, type GraphQLError, Kind, type SelectionNode } from "graphql"
+import {
+  type DocumentNode,
+  type GraphQLError,
+  Kind,
+  type SelectionNode,
+  type SelectionSetNode,
+  visit,
+} from "graphql"
 
 export const DEFAULT_GRAPHQL_LIMITS = Object.freeze({
   maxQueryBytes: 64 * 1024,
@@ -7,6 +14,7 @@ export const DEFAULT_GRAPHQL_LIMITS = Object.freeze({
   maxAliases: 100,
   maxComplexity: 1_000,
   maxOperations: 10,
+  maxFieldOverlaps: 2_000,
 })
 
 export interface GraphqlLimitsOptions {
@@ -16,6 +24,7 @@ export interface GraphqlLimitsOptions {
   readonly maxAliases?: number
   readonly maxComplexity?: number
   readonly maxOperations?: number
+  readonly maxFieldOverlaps?: number
 }
 
 export interface GraphqlLimits {
@@ -25,6 +34,7 @@ export interface GraphqlLimits {
   readonly maxAliases: number
   readonly maxComplexity: number
   readonly maxOperations: number
+  readonly maxFieldOverlaps: number
 }
 
 function limit(value: number | undefined, fallback: number, name: string, minimum: number): number {
@@ -63,6 +73,12 @@ export function graphqlLimits(options: GraphqlLimitsOptions = {}): GraphqlLimits
       "maxOperations",
       1,
     ),
+    maxFieldOverlaps: limit(
+      options.maxFieldOverlaps,
+      DEFAULT_GRAPHQL_LIMITS.maxFieldOverlaps,
+      "maxFieldOverlaps",
+      0,
+    ),
   }
 }
 
@@ -172,6 +188,113 @@ export function requestLimitError(
   return undefined
 }
 
+/**
+ * Pairs of same-named fields across every selection set, the work graphql-js's
+ * OverlappingFieldsCanBeMerged rule does: it compares every two fields that share a response name in
+ * one selection set, counting the fields its fragment spreads and inline fragments bring in. A few
+ * thousand bytes of `b(x: 1) b(x: 2) ...` hold within the depth and complexity limits yet cost seconds
+ * of synchronous validation, so this is counted, and refused, before `validate()` runs. Measured
+ * once {@link documentLimitError} passes and no fragment is unused, the fields it walks are bounded
+ * by `maxComplexity`.
+ */
+export function fieldOverlaps(document: DocumentNode): number {
+  const fragments = new Map<string, readonly SelectionNode[]>()
+  for (const definition of document.definitions) {
+    if (definition.kind === Kind.FRAGMENT_DEFINITION) {
+      fragments.set(definition.name.value, definition.selectionSet.selections)
+    }
+  }
+  const fragmentNames = new Map<string, ReadonlyMap<string, number>>()
+  const expanding = new Set<string>()
+  const add = (
+    selections: readonly SelectionNode[],
+    names: Map<string, number>,
+    spread: Set<string>,
+  ): void => {
+    for (const selection of selections) {
+      if (selection.kind === Kind.FIELD) {
+        const name = selection.alias?.value ?? selection.name.value
+        names.set(name, (names.get(name) ?? 0) + 1)
+      } else if (selection.kind === Kind.INLINE_FRAGMENT) {
+        add(selection.selectionSet.selections, names, spread)
+      } else if (!spread.has(selection.name.value)) {
+        spread.add(selection.name.value)
+        for (const [name, count] of fragmentNamesOf(selection.name.value)) {
+          names.set(name, (names.get(name) ?? 0) + count)
+        }
+      }
+    }
+  }
+  // An unknown fragment and a cycle, both refused by validation, contribute nothing.
+  const fragmentNamesOf = (fragment: string): ReadonlyMap<string, number> => {
+    const known = fragmentNames.get(fragment)
+    if (known !== undefined) return known
+    const selections = fragments.get(fragment)
+    if (selections === undefined || expanding.has(fragment)) return new Map()
+    expanding.add(fragment)
+    const names = new Map<string, number>()
+    add(selections, names, new Set([fragment]))
+    expanding.delete(fragment)
+    fragmentNames.set(fragment, names)
+    return names
+  }
+  let pairs = 0
+  visit(document, {
+    SelectionSet(node: SelectionSetNode) {
+      const names = new Map<string, number>()
+      add(node.selections, names, new Set())
+      for (const count of names.values()) pairs += (count * (count - 1)) / 2
+    },
+  })
+  return pairs
+}
+
+/** The first fragment no operation reaches; graphql-js refuses it, and no limit above counts it. */
+function unusedFragment(document: DocumentNode): string | undefined {
+  const spreads = new Map<string, readonly string[]>()
+  const pending: string[] = []
+  const spreadsIn = (node: DocumentNode["definitions"][number]): string[] => {
+    const names: string[] = []
+    visit(node, {
+      FragmentSpread(spread) {
+        names.push(spread.name.value)
+      },
+    })
+    return names
+  }
+  for (const definition of document.definitions) {
+    if (definition.kind === Kind.FRAGMENT_DEFINITION) {
+      spreads.set(definition.name.value, spreadsIn(definition))
+    } else if (definition.kind === Kind.OPERATION_DEFINITION) {
+      pending.push(...spreadsIn(definition))
+    }
+  }
+  const reached = new Set<string>()
+  for (let name = pending.pop(); name !== undefined; name = pending.pop()) {
+    if (reached.has(name)) continue
+    reached.add(name)
+    pending.push(...(spreads.get(name) ?? []))
+  }
+  for (const name of spreads.keys()) if (!reached.has(name)) return name
+  return undefined
+}
+
+/**
+ * Refuses, before `validate()`, the documents whose overlap validation is expensive: too many
+ * same-named field pairs, or a fragment no operation uses (its fields escape `maxComplexity`). Run it
+ * after {@link documentLimitError} passes.
+ */
+export function overlapLimitError(
+  document: DocumentNode,
+  limits: GraphqlLimits,
+): string | undefined {
+  const unused = unusedFragment(document)
+  if (unused !== undefined) return `Fragment "${unused}" is never used.`
+  return fieldOverlaps(document) > limits.maxFieldOverlaps
+    ? `GraphQL document repeats field names in one selection set beyond the limit of ${limits.maxFieldOverlaps} same-named field pairs.`
+    : undefined
+}
+
 export function documentLimitError(
   metrics: GraphqlDocumentMetrics,
   limits: GraphqlLimits,

package/src/pubsub.ts

@@ -18,8 +18,34 @@ export interface GraphqlPubSub<Event = unknown> {
   subscribe(topic: string): AsyncIterableIterator<Event>
 }
 
-/** Create an in-memory {@link GraphqlPubSub}. */
-export function createPubSub<Event = unknown>(): GraphqlPubSub<Event> {
+export interface GraphqlPubSubOptions {
+  /** Maximum queued events per subscriber. Positive safe integer; default 1024. */
+  readonly maxQueuedEvents?: number
+  /** A full queue closes with an error by default. Dropping requires explicit opt-in. */
+  readonly overflow?: "error" | "drop-oldest" | "drop-newest"
+}
+
+export class GraphqlPubSubOverflowError extends Error {
+  readonly code = "graphql_pubsub_overflow"
+
+  constructor() {
+    super("GraphQL subscription event queue is full")
+    this.name = "GraphqlPubSubOverflowError"
+  }
+}
+
+/** Create an in-memory {@link GraphqlPubSub} with finite subscriber queues. */
+export function createPubSub<Event = unknown>(
+  options: GraphqlPubSubOptions = {},
+): GraphqlPubSub<Event> {
+  const maxQueuedEvents = options.maxQueuedEvents ?? 1024
+  const overflow = options.overflow ?? "error"
+  if (!Number.isSafeInteger(maxQueuedEvents) || maxQueuedEvents < 1) {
+    throw new RangeError("createPubSub maxQueuedEvents must be a positive safe integer")
+  }
+  if (overflow !== "error" && overflow !== "drop-oldest" && overflow !== "drop-newest") {
+    throw new TypeError("createPubSub overflow must be error, drop-oldest or drop-newest")
+  }
   const topics = new Map<string, Set<Sink<Event>>>()
 
   const publish = (topic: string, payload: Event): void => {
@@ -35,7 +61,7 @@ export function createPubSub<Event = unknown>(): GraphqlPubSub<Event> {
       topics.set(topic, sinks)
     }
     const set = sinks
-    const sink = createSink<Event>(() => {
+    const sink = createSink<Event>(maxQueuedEvents, overflow, () => {
       set.delete(sink)
       if (set.size === 0) topics.delete(topic)
     })
@@ -46,16 +72,21 @@ export function createPubSub<Event = unknown>(): GraphqlPubSub<Event> {
   return { publish, subscribe }
 }
 
-/** One subscriber: a bounded push queue bridged to an async iterator with backpressure via awaiting pulls. */
+/** Awaiting pulls consume immediately; synchronous publish cannot provide producer backpressure. */
 interface Sink<Event> {
   push(payload: Event): void
   readonly iterator: AsyncIterableIterator<Event>
 }
 
-function createSink<Event>(onClose: () => void): Sink<Event> {
+function createSink<Event>(
+  maxQueuedEvents: number,
+  overflow: NonNullable<GraphqlPubSubOptions["overflow"]>,
+  onClose: () => void,
+): Sink<Event> {
   const queue: Event[] = []
   const pulls: Array<(result: IteratorResult<Event>) => void> = []
   let done = false
+  let failure: GraphqlPubSubOverflowError | undefined
 
   const push = (payload: Event): void => {
     if (done) return
@@ -64,12 +95,22 @@ function createSink<Event>(onClose: () => void): Sink<Event> {
       pull({ value: payload, done: false })
       return
     }
+    if (queue.length >= maxQueuedEvents) {
+      if (overflow === "drop-newest") return
+      if (overflow === "error") {
+        failure = new GraphqlPubSubOverflowError()
+        finish()
+        return
+      }
+      queue.shift()
+    }
     queue.push(payload)
   }
 
   const finish = (): IteratorResult<Event> => {
     if (!done) {
       done = true
+      queue.length = 0
       onClose()
       for (const pull of pulls.splice(0)) pull({ value: undefined, done: true })
     }
@@ -78,14 +119,22 @@ function createSink<Event>(onClose: () => void): Sink<Event> {
 
   const iterator: AsyncIterableIterator<Event> = {
     next(): Promise<IteratorResult<Event>> {
-      if (queue.length > 0) return Promise.resolve({ value: queue.shift() as Event, done: false })
+      if (failure !== undefined) {
+        const error = failure
+        failure = undefined
+        return Promise.reject(error)
+      }
       if (done) return Promise.resolve({ value: undefined, done: true })
+      // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: a nonempty queue owns one Event; undefined is itself a valid Event payload.
+      if (queue.length > 0) return Promise.resolve({ value: queue.shift() as Event, done: false })
       return new Promise((resolve) => pulls.push(resolve))
     },
     return(): Promise<IteratorResult<Event>> {
+      failure = undefined
       return Promise.resolve(finish())
     },
     throw(err?: unknown): Promise<IteratorResult<Event>> {
+      failure = undefined
       finish()
       return Promise.reject(err)
     },

package/src/ws.ts

@@ -16,6 +16,7 @@
 import type { NifraWebSocket, WebSocketContext, WebSocketHandler } from "@nifrajs/core/ws"
 import {
   type DocumentNode,
+  type ExecutionArgs,
   type ExecutionResult,
   execute,
   GraphQLError,
@@ -38,6 +39,7 @@ import {
   documentMetrics,
   type GraphqlLimits,
   graphqlLimits,
+  overlapLimitError,
   requestLimitError,
 } from "./limits.ts"
 
@@ -49,6 +51,16 @@ interface GraphqlWsConnection {
   /** Tear the graphql-ws connection down (graphql-ws's `opened()` return value). */
   closed?: (code: number, reason: string) => void | Promise<void>
   readonly subscriptions: Set<string>
+  /** One abort controller per running operation id, aborted by the client's complete or a close. */
+  operations?: Map<string, AbortController>
+  /** Set once graphql-ws sends `connection_ack`, i.e. `connection_init` was admitted. */
+  acknowledged?: boolean
+}
+
+/** The `extra` graphql-ws hands its hooks for one socket. */
+interface GraphqlWsExtra {
+  readonly request: Request
+  readonly operations: Map<string, AbortController>
 }
 
 export interface GraphqlWsOptions<
@@ -58,6 +70,11 @@ export interface GraphqlWsOptions<
   readonly schema: GraphQLSchema
   /** Build the resolver `contextValue` from the upgrade request. Shared with the HTTP transport. */
   readonly context?: GraphqlContextBuilder<Context>
+  /**
+   * Admit a socket from its upgrade request, before {@link onConnect}; return `false` (or throw) to
+   * reject the connection. `mountGraphql({ subscriptions: true })` passes its HTTP `authorize` here.
+   */
+  readonly authorize?: (request: Request) => boolean | Promise<boolean>
   /**
    * Called once per connection with the client's `connection_init` payload; return `false` (or throw)
    * to reject the connection. The seam for authenticating a socket from an init token.
@@ -75,9 +92,14 @@ export interface GraphqlWsOptions<
   readonly maxAliases?: number
   readonly maxComplexity?: number
   readonly maxOperations?: number
+  readonly maxFieldOverlaps?: number
   /** Maximum concurrent subscription operation ids per connection. Default 20. */
   readonly maxSubscriptions?: number
-  /** Maximum time for initial execute/subscribe setup. Default 10 seconds. */
+  /**
+   * Maximum time for initial execute/subscribe setup. Default 10 seconds. Each operation's abort
+   * signal, which a resolver reads through `info.getAbortSignal()`, is aborted at this deadline, when
+   * the client completes the operation, and when the socket closes.
+   */
   readonly executionTimeoutMs?: number
 }
 
@@ -133,11 +155,13 @@ function subscriptionFrameError(
   } catch (error) {
     return { id, message: error instanceof GraphQLError ? error.message : "Invalid GraphQL query." }
   }
+  const limitError =
+    documentLimitError(documentMetrics(document), limits) ?? overlapLimitError(document, limits)
+  if (limitError !== undefined) return { id, message: limitError }
   const validationErrors = validate(schema, document, specifiedRules)
-  if (validationErrors.length > 0)
-    return { id, message: validationErrors[0]?.message ?? "Invalid GraphQL query." }
-  const limitError = documentLimitError(documentMetrics(document), limits)
-  return limitError === undefined ? undefined : { id, message: limitError }
+  return validationErrors.length > 0
+    ? { id, message: validationErrors[0]?.message ?? "Invalid GraphQL query." }
+    : undefined
 }
 
 function maskWsError(error: unknown): unknown {
@@ -155,12 +179,14 @@ function maskWsError(error: unknown): unknown {
  * so the id stops counting against `maxSubscriptions`: a client is not expected to complete an
  * operation the server already ended.
  */
-function outboundFrame(message: string, subscriptions: Set<string>): string {
+function outboundFrame(message: string, connection: GraphqlWsConnection): string {
   try {
     const parsed = recordOf(JSON.parse(message))
     if (parsed === undefined) return message
+    if (parsed.type === "connection_ack") connection.acknowledged = true
     if ((parsed.type === "complete" || parsed.type === "error") && typeof parsed.id === "string") {
-      subscriptions.delete(parsed.id)
+      connection.subscriptions.delete(parsed.id)
+      connection.operations?.delete(parsed.id)
     }
     if (parsed.type === "next") {
       const payload = recordOf(parsed.payload)
@@ -180,26 +206,68 @@ function outboundFrame(message: string, subscriptions: Set<string>): string {
   return message
 }
 
+/** Close a result that arrived after its operation timed out, if it is a stream nobody will read. */
+function disposeLate(result: unknown): void {
+  if (typeof result !== "object" || result === null || !(Symbol.asyncIterator in result)) return
+  const iterator = recordOf(result)
+  if (iterator === undefined || typeof iterator.return !== "function") return
+  Promise.resolve(iterator.return.call(result)).catch(() => {})
+}
+
+const wrappedSubscribeFields = new WeakSet<object>()
+
+/**
+ * graphql drops a subscribe resolver's result that settles after the operation's signal aborted, so
+ * a source the resolver opened anyway would stay open. Each root subscription field's resolver is
+ * wrapped once to return such a late source; with no signal, or before an abort, it is unchanged.
+ */
+function returnLateSources(schema: GraphQLSchema): void {
+  const fields = schema.getSubscriptionType()?.getFields() ?? {}
+  for (const field of Object.values(fields)) {
+    const resolver = field.subscribe
+    if (resolver === undefined || wrappedSubscribeFields.has(field)) continue
+    wrappedSubscribeFields.add(field)
+    field.subscribe = (source, args, context, info) => {
+      const result = resolver(source, args, context, info)
+      if (!(result instanceof Promise)) return result
+      return result.then((value) => {
+        if (info.getAbortSignal()?.aborted === true) disposeLate(value)
+        return value
+      })
+    }
+  }
+}
+
 /**
  * A timeout is that operation's error result. graphql-ws does not catch a rejected execute or
- * subscribe, so a rejection would end the whole socket instead of the one operation.
+ * subscribe, so a rejection would end the whole socket instead of the one operation. A timeout aborts
+ * the operation's `abortSignal`, which resolvers read through `info.getAbortSignal()`, and work that
+ * settles after it is not abandoned open: a late subscription stream is returned.
  */
 async function withWsTimeout<T>(
-  work: T | Promise<T>,
+  start: (abortSignal: AbortSignal) => T | Promise<T>,
+  outer: AbortSignal | null | undefined,
   timeoutMs: number,
 ): Promise<T | ExecutionResult> {
-  if (!(work instanceof Promise) || timeoutMs === 0) return work
+  const controller = new AbortController()
+  const work = start(outer ? AbortSignal.any([outer, controller.signal]) : controller.signal)
+  if (!(work instanceof Promise)) return work
   let timer: ReturnType<typeof setTimeout> | undefined
+  let timedOut = false
   const timeout = new Promise<ExecutionResult>((resolve) => {
-    timer = setTimeout(
-      () => resolve({ errors: [new GraphQLError("Execution timed out.")] }),
-      timeoutMs,
-    )
+    timer = setTimeout(() => {
+      timedOut = true
+      const error = new GraphQLError("Execution timed out.")
+      // Resolved first: the abort can reject the work, and the race must settle on this result.
+      resolve({ errors: [error] })
+      controller.abort(error)
+    }, timeoutMs)
   })
   try {
     return await Promise.race([work, timeout])
   } finally {
     if (timer !== undefined) clearTimeout(timer)
+    if (timedOut) work.then(disposeLate, () => {})
   }
 }
 
@@ -226,10 +294,23 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
   const executionTimeoutMs = options.executionTimeoutMs ?? 10_000
   assertWsNumber(executionTimeoutMs, "executionTimeoutMs", 0)
   const executeWithTimeout: typeof execute = (args) =>
-    withWsTimeout(execute(args), executionTimeoutMs)
+    executionTimeoutMs === 0
+      ? execute(args)
+      : withWsTimeout(
+          (abortSignal) => execute({ ...args, abortSignal }),
+          args.abortSignal,
+          executionTimeoutMs,
+        )
   const subscribeWithTimeout: typeof subscribe = (args) =>
-    withWsTimeout(subscribe(args), executionTimeoutMs)
-  const gqlServer = makeServer<Record<string, unknown>, { request: Request }>({
+    executionTimeoutMs === 0
+      ? subscribe(args)
+      : withWsTimeout(
+          (abortSignal) => subscribe({ ...args, abortSignal }),
+          args.abortSignal,
+          executionTimeoutMs,
+        )
+  returnLateSources(options.schema)
+  const gqlServer = makeServer<Record<string, unknown>, GraphqlWsExtra>({
     // Keep the raw escape hatch for auxiliary graphql-ws hooks, but make the package's safety
     // controls authoritative: callers cannot accidentally replace the bounded execute/subscribe
     // wrappers or the context/authentication seams with an unbounded implementation.
@@ -237,22 +318,41 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
     schema: options.schema,
     execute: executeWithTimeout,
     subscribe: subscribeWithTimeout,
-    onConnect: options.onConnect
-      ? async (ctx: GraphqlWsContext<Record<string, unknown>, { request: Request }>) => {
-          try {
-            return await options.onConnect?.(
-              ctx.connectionParams as ConnectionInitMessage["payload"],
-              ctx.extra.request,
-            )
-          } catch {
-            return false
+    onConnect:
+      options.onConnect || options.authorize
+        ? async (ctx: GraphqlWsContext<Record<string, unknown>, GraphqlWsExtra>) => {
+            try {
+              if (options.authorize !== undefined && !(await options.authorize(ctx.extra.request)))
+                return false
+              return (
+                (await options.onConnect?.(
+                  ctx.connectionParams as ConnectionInitMessage["payload"],
+                  ctx.extra.request,
+                )) ?? true
+              )
+            } catch {
+              return false
+            }
           }
-        }
-      : undefined,
-    context: options.context
-      ? async (ctx: GraphqlWsContext<Record<string, unknown>, { request: Request }>) =>
-          await buildContext(options.context, { request: ctx.extra.request })
-      : undefined,
+        : undefined,
+    // graphql-ws builds the context once per operation, just before executing it, so the operation's
+    // abort signal is attached to its execution arguments here.
+    context: async (
+      ctx: GraphqlWsContext<Record<string, unknown>, GraphqlWsExtra>,
+      id: string,
+      _payload: unknown,
+      args: ExecutionArgs,
+    ) => {
+      const controller = new AbortController()
+      ctx.extra.operations.set(id, controller)
+      args.abortSignal =
+        args.abortSignal === undefined || args.abortSignal === null
+          ? controller.signal
+          : AbortSignal.any([args.abortSignal, controller.signal])
+      return options.context === undefined
+        ? undefined
+        : await buildContext(options.context, { request: ctx.extra.request })
+    },
   })
 
   return {
@@ -264,11 +364,13 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
       const protocol =
         (ws.raw as { protocol?: string } | undefined)?.protocol ?? GRAPHQL_TRANSPORT_WS_PROTOCOL
       let onFrame: ((message: string) => void | Promise<void>) | undefined
+      const operations = new Map<string, AbortController>()
+      ws.data.operations = operations
       const closed = gqlServer.opened(
         {
           protocol,
           send: async (data: string) => {
-            ws.send(outboundFrame(data, ws.data.subscriptions))
+            ws.send(outboundFrame(data, ws.data))
           },
           close: (code: number, reason: string) => {
             ws.close(code, reason)
@@ -277,7 +379,7 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
             onFrame = cb
           },
         },
-        { request: ws.data.request },
+        { request: ws.data.request, operations },
       )
       ws.data.closed = closed
       ws.data.dispatch = async (message: string) => {
@@ -297,7 +399,13 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
       // this socket - including the client's `Complete` that stops the subscription. graphql-ws drives
       // its own sends and error frames from inside that loop; we only feed it inbound frames.
       const message = asText(data)
-      const rejected = subscriptionFrameError(message, options.schema, limits)
+      // Until connection_init is admitted, graphql-ws answers a subscribe frame by closing with 4401
+      // without reading the query. Parsing or validating it here would hand an unauthenticated socket
+      // schema suggestions and synchronous validation work.
+      const rejected =
+        ws.data.acknowledged === true
+          ? subscriptionFrameError(message, options.schema, limits)
+          : undefined
       if (rejected !== undefined) {
         ws.send(
           JSON.stringify({
@@ -324,6 +432,8 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
           ws.data.subscriptions.add(frame.id)
         } else if (frame?.type === "complete" && typeof frame.id === "string") {
           ws.data.subscriptions.delete(frame.id)
+          ws.data.operations?.get(frame.id)?.abort(new GraphQLError("Operation completed."))
+          ws.data.operations?.delete(frame.id)
         }
       } catch {
         // graphql-ws owns malformed protocol-frame handling; pass it through unchanged.
@@ -333,6 +443,9 @@ export function graphqlWebSocket<Context extends Record<string, unknown> = Recor
 
     close(ws: NifraWebSocket<GraphqlWsConnection>, code: number, reason: string): void {
       ws.data.subscriptions.clear()
+      for (const controller of ws.data.operations?.values() ?? [])
+        controller.abort(new GraphQLError("Socket closed."))
+      ws.data.operations?.clear()
       // The socket is gone: a failing iterator return() or onClose hook has no one left to answer.
       void Promise.resolve(ws.data.closed?.(code, reason)).catch(() => {})
     },