aws-appsync-subscription-link 4.0.1 → 4.0.3

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+<a name="4.0.3"></a>
+## [4.0.3](https://github.com/awslabs/aws-mobile-appsync-sdk-js/compare/aws-appsync-subscription-link@4.0.2...aws-appsync-subscription-link@4.0.3) (2026-03-30)
+
+
+
+
+**Note:** Version bump only for package aws-appsync-subscription-link
+
+<a name="4.0.2"></a>
+## [4.0.2](https://github.com/awslabs/aws-mobile-appsync-sdk-js/compare/aws-appsync-subscription-link@4.0.1...aws-appsync-subscription-link@4.0.2) (2026-03-19)
+
+
+### Bug Fixes
+
+* **subscription-link:** move auth credentials from URL query string to Sec-WebSocket-Protocol header ([fb5dd3e](https://github.com/awslabs/aws-mobile-appsync-sdk-js/commit/fb5dd3e))
+
+
+
+
 <a name="4.1.0"></a>
 # [4.1.0] (Unreleased)
 

package/lib/index.js

@@ -118,6 +118,7 @@ function _inherits(subClass, superClass) {
     if (superClass) _set_prototype_of(subClass, superClass);
 }
 function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
         return !!right[Symbol.hasInstance](left);
     } else {
@@ -201,12 +202,22 @@ function _object_spread_props(target, source) {
 }
 function _object_without_properties(source, excluded) {
     if (source == null) return {};
-    var target = _object_without_properties_loose(source, excluded);
-    var key, i;
+    var target = {}, sourceKeys, key, i;
+    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
+        sourceKeys = Reflect.ownKeys(Object(source));
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
+            if (excluded.indexOf(key) >= 0) continue;
+            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
+            target[key] = source[key];
+        }
+        return target;
+    }
+    target = _object_without_properties_loose(source, excluded);
     if (Object.getOwnPropertySymbols) {
-        var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
-        for(i = 0; i < sourceSymbolKeys.length; i++){
-            key = sourceSymbolKeys[i];
+        sourceKeys = Object.getOwnPropertySymbols(source);
+        for(i = 0; i < sourceKeys.length; i++){
+            key = sourceKeys[i];
             if (excluded.indexOf(key) >= 0) continue;
             if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
             target[key] = source[key];
@@ -216,12 +227,11 @@ function _object_without_properties(source, excluded) {
 }
 function _object_without_properties_loose(source, excluded) {
     if (source == null) return {};
-    var target = {};
-    var sourceKeys = Object.keys(source);
-    var key, i;
+    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
     for(i = 0; i < sourceKeys.length; i++){
         key = sourceKeys[i];
         if (excluded.indexOf(key) >= 0) continue;
+        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
         target[key] = source[key];
     }
     return target;
@@ -314,9 +324,17 @@ function _ts_generator(thisArg, body) {
         },
         trys: [],
         ops: []
-    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
-    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() {
-        return this;
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
     }), g;
     function verb(n) {
         return function(v) {
@@ -402,27 +420,27 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJS = function(cb, mod) {
+var __commonJS = function __commonJS(cb, mod) {
     return function __require() {
         return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = {
             exports: {}
         }).exports, mod), mod.exports;
     };
 };
-var __export = function(target, all) {
+var __export = function __export(target, all) {
     for(var name in all)__defProp(target, name, {
         get: all[name],
         enumerable: true
     });
 };
-var __copyProps = function(to, from, except, desc) {
+var __copyProps = function __copyProps(to, from, except, desc) {
     if (from && (typeof from === "undefined" ? "undefined" : _type_of(from)) === "object" || typeof from === "function") {
         var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
         try {
             var _loop = function() {
                 var key = _step.value;
                 if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-                    get: function() {
+                    get: function get() {
                         return from[key];
                     },
                     enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
@@ -446,7 +464,7 @@ var __copyProps = function(to, from, except, desc) {
     }
     return to;
 };
-var __toESM = function(mod, isNodeMode, target) {
+var __toESM = function __toESM(mod, isNodeMode, target) {
     return target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(// If the importer is in node compatibility mode or this is not an ESM
     // file that has been converted to a CommonJS file using a Babel-
     // compatible transform (i.e. "__esModule" has not been set), then set
@@ -456,7 +474,7 @@ var __toESM = function(mod, isNodeMode, target) {
         enumerable: true
     }) : target, mod);
 };
-var __toCommonJS = function(mod) {
+var __toCommonJS = function __toCommonJS(mod) {
     return __copyProps(__defProp({}, "__esModule", {
         value: true
     }), mod);
@@ -2209,10 +2227,10 @@ var require_paho_mqtt = __commonJS({
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-    CONTROL_EVENTS_KEY: function() {
+    CONTROL_EVENTS_KEY: function CONTROL_EVENTS_KEY1() {
         return CONTROL_EVENTS_KEY;
     },
-    createSubscriptionHandshakeLink: function() {
+    createSubscriptionHandshakeLink: function createSubscriptionHandshakeLink1() {
         return createSubscriptionHandshakeLink;
     }
 });
@@ -2320,8 +2338,8 @@ var SubscriptionHandshakeLink = /*#__PURE__*/ function(_import_core_ApolloLink)
                     return c.topics.some(function(t) {
                         return newTopics.has(t);
                     });
-                }).map(function(_param) {
-                    var topics = _param.topics, rest = _object_without_properties(_param, [
+                }).map(function(_0) {
+                    var topics = _0.topics, rest = _object_without_properties(_0, [
                         "topics"
                     ]);
                     return _object_spread_props(_object_spread({}, rest), {
@@ -2414,8 +2432,8 @@ var SubscriptionHandshakeLink = /*#__PURE__*/ function(_import_core_ApolloLink)
                                 clientId = connectionInfo.client, url2 = connectionInfo.url, topics = connectionInfo.topics;
                                 client = new Paho.Client(url2, clientId);
                                 client.trace = mqttLogger.bind(null, clientId);
-                                client.onConnectionLost = function(_param) {
-                                    var errorCode = _param.errorCode, args = _object_without_properties(_param, [
+                                client.onConnectionLost = function(_0) {
+                                    var errorCode = _0.errorCode, args = _object_without_properties(_0, [
                                         "errorCode"
                                     ]);
                                     if (errorCode !== 0) {
@@ -2443,7 +2461,7 @@ var SubscriptionHandshakeLink = /*#__PURE__*/ function(_import_core_ApolloLink)
                                         client.connect({
                                             useSSL: url2.indexOf("wss://") === 0,
                                             mqttVersion: 3,
-                                            onSuccess: function() {
+                                            onSuccess: function onSuccess() {
                                                 return resolve(client);
                                             },
                                             onFailure: reject
@@ -2482,7 +2500,7 @@ var SubscriptionHandshakeLink = /*#__PURE__*/ function(_import_core_ApolloLink)
                 var _this = this;
                 return new Promise(function(resolve, reject) {
                     client.subscribe(topic, {
-                        onSuccess: function() {
+                        onSuccess: function onSuccess() {
                             if (!_this.topicObservers.has(topic)) {
                                 _this.topicObservers.set(topic, /* @__PURE__ */ new Set());
                             }
@@ -2583,7 +2601,7 @@ var NonRetryableError = /*#__PURE__*/ function(Error1) {
     }
     return NonRetryableError;
 }(_wrap_native_super(Error));
-var isNonRetryableError = function(obj) {
+var isNonRetryableError = function isNonRetryableError(obj) {
     var key = "nonRetryable";
     return obj && obj[key];
 };
@@ -2594,7 +2612,7 @@ function retry(functionToRetry, args, delayFn) {
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    logger2("Attempt #".concat(attempt, " for this vars: ").concat(JSON.stringify(args)));
+                    logger2("Attempt #".concat(attempt));
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -2666,7 +2684,7 @@ function jitteredBackoff(maxDelayMs) {
         return delay > maxDelayMs ? false : delay;
     };
 }
-var jitteredExponentialRetry = function(functionToRetry, args) {
+var jitteredExponentialRetry = function jitteredExponentialRetry(functionToRetry, args) {
     var maxDelayMs = arguments.length > 2 && arguments[2] !== void 0 ? arguments[2] : MAX_DELAY_MS;
     return retry(functionToRetry, args, jitteredBackoff(maxDelayMs));
 };
@@ -2707,6 +2725,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
         _this.auth = theAuth;
         _this.proxyUrl = proxy === null || proxy === void 0 ? void 0 : proxy.url;
         _this.keepAliveTimeout = keepAliveTimeoutMs;
+        if (_this.url && !_this.url.startsWith("https://")) {
+            logger3("WARNING: AppSync endpoint URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.url));
+        }
+        if (_this.proxyUrl && !_this.proxyUrl.startsWith("https://")) {
+            logger3("WARNING: Proxy URL is not using HTTPS. Credentials may be sent unencrypted: ".concat(_this.proxyUrl));
+        }
         if (_this.keepAliveTimeout < SERVER_KEEP_ALIVE_TIMEOUT) {
             var configName = "keepAliveTimeoutMs";
             throw new Error("".concat(configName, " must be greater than or equal to ").concat(SERVER_KEEP_ALIVE_TIMEOUT, " (").concat(_this.keepAliveTimeout, " used)."));
@@ -2744,7 +2768,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                         authenticationType: _this.auth.type,
                         query: (0, import_graphql.print)(query),
                         region: _this.region,
-                        graphql_headers: function() {
+                        graphql_headers: function graphql_headers() {
                             return headers;
                         },
                         variables: variables,
@@ -3004,7 +3028,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                 }
                 return new Promise(function(res, rej) {
                     return _async_to_generator(function() {
-                        var payloadString, headerString, _, headerQs, payloadQs, discoverableEndpoint, awsRealTimeUrl, err;
+                        var payloadString, headerObj, headerString, headerBase64url, discoverableEndpoint, protocols, err;
                         return _ts_generator(this, function(_state) {
                             switch(_state.label){
                                 case 0:
@@ -3026,7 +3050,6 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                     ]);
                                     this.socketStatus = 2 /* CONNECTING */ ;
                                     payloadString = "{}";
-                                    _ = JSON.stringify;
                                     return [
                                         4,
                                         this._awsRealTimeHeaderBasedAuth({
@@ -3038,15 +3061,13 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                             region: region,
                                             credentials: credentials,
                                             token: token,
-                                            graphql_headers: function() {}
+                                            graphql_headers: function graphql_headers() {}
                                         })
                                     ];
                                 case 2:
-                                    headerString = _.apply(JSON, [
-                                        _state.sent()
-                                    ]);
-                                    headerQs = Buffer.from(headerString).toString("base64");
-                                    payloadQs = Buffer.from(payloadString).toString("base64");
+                                    headerObj = _state.sent();
+                                    headerString = JSON.stringify(headerObj);
+                                    headerBase64url = Buffer.from(headerString).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
                                     if (this.proxyUrl) {
                                         discoverableEndpoint = this.proxyUrl.replace(/\/graphql$/, "").concat(customDomainPath).replace("https://", "wss://").replace("http://", "ws://");
                                     } else if (this.isCustomDomain(appSyncGraphqlEndpoint)) {
@@ -3056,11 +3077,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                         discoverableEndpoint = appSyncGraphqlEndpoint.replace("appsync-api", "appsync-realtime-api").replace("gogi-beta", "grt-beta");
                                         discoverableEndpoint = discoverableEndpoint.replace("https://", "wss://").replace("http://", "ws://");
                                     }
-                                    awsRealTimeUrl = "".concat(discoverableEndpoint, "?header=").concat(headerQs, "&payload=").concat(payloadQs);
+                                    protocols = [
+                                        "graphql-ws",
+                                        "header-".concat(headerBase64url)
+                                    ];
                                     return [
                                         4,
                                         this._initializeRetryableHandshake({
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: discoverableEndpoint,
+                                            protocols: protocols
                                         })
                                     ];
                                 case 3:
@@ -3120,11 +3145,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                 };
                                 handler = headerHandler[authenticationType];
                                 if (typeof handler !== "function") {
-                                    logger3("Authentication type ".concat(authenticationType, " not supported"));
-                                    return [
-                                        2,
-                                        {}
-                                    ];
+                                    throw new NonRetryableError("Authentication type ".concat(authenticationType, " not supported"));
                                 }
                                 host = url.parse(this.url).host;
                                 return [
@@ -3298,17 +3319,18 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
             key: "_initializeRetryableHandshake",
             value: function _initializeRetryableHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var awsRealTimeUrl;
+                    var awsRealTimeUrl, protocols;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializaling retryable Handshake");
                                 return [
                                     4,
                                     jitteredExponentialRetry(this._initializeHandshake.bind(this), [
                                         {
-                                            awsRealTimeUrl: awsRealTimeUrl
+                                            awsRealTimeUrl: awsRealTimeUrl,
+                                            protocols: protocols
                                         }
                                     ])
                                 ];
@@ -3326,12 +3348,12 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
             key: "_initializeHandshake",
             value: function _initializeHandshake(_0) {
                 return _async_to_generator(function(param) {
-                    var _this, awsRealTimeUrl, err, errorType, errorCode;
+                    var _this, awsRealTimeUrl, protocols, err, errorType, errorCode;
                     return _ts_generator(this, function(_state) {
                         switch(_state.label){
                             case 0:
                                 _this = this;
-                                awsRealTimeUrl = param.awsRealTimeUrl;
+                                awsRealTimeUrl = param.awsRealTimeUrl, protocols = param.protocols;
                                 logger3("Initializing handshake ".concat(awsRealTimeUrl));
                                 _state.label = 1;
                             case 1:
@@ -3345,7 +3367,7 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                     4,
                                     function() {
                                         return new Promise(function(res, rej) {
-                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, "graphql-ws");
+                                            var newSocket = _AppSyncRealTimeSubscriptionHandshakeLink.createWebSocket(awsRealTimeUrl, protocols);
                                             newSocket.onerror = function() {
                                                 logger3("WebSocket connection error");
                                             };
@@ -3379,13 +3401,20 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
                                                 rej(new Error(JSON.stringify(event)));
                                             };
                                             _this.awsRealTimeSocket.onmessage = function(message) {
-                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(message.data, " "));
-                                                var data = JSON.parse(message.data);
+                                                var data;
+                                                try {
+                                                    data = JSON.parse(message.data);
+                                                } catch (e) {
+                                                    logger3("Failed to parse WebSocket message");
+                                                    return;
+                                                }
                                                 var type = data.type, tmp = data.payload, _ref = tmp === void 0 ? {} : tmp, _ref_connectionTimeoutMs = _ref.connectionTimeoutMs, connectionTimeoutMs = _ref_connectionTimeoutMs === void 0 ? DEFAULT_KEEP_ALIVE_TIMEOUT : _ref_connectionTimeoutMs;
+                                                logger3("subscription message from AWS AppSyncRealTime: ".concat(type));
                                                 if (type === "connection_ack" /* GQL_CONNECTION_ACK */ ) {
-                                                    ackOk = true;
                                                     var _this_keepAliveTimeout;
-                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : connectionTimeoutMs;
+                                                    ackOk = true;
+                                                    var validTimeout = typeof connectionTimeoutMs === "number" && connectionTimeoutMs >= SERVER_KEEP_ALIVE_TIMEOUT ? connectionTimeoutMs : DEFAULT_KEEP_ALIVE_TIMEOUT;
+                                                    _this.keepAliveTimeout = (_this_keepAliveTimeout = _this.keepAliveTimeout) !== null && _this_keepAliveTimeout !== void 0 ? _this_keepAliveTimeout : validTimeout;
                                                     _this.awsRealTimeSocket.onmessage = _this._handleIncomingSubscriptionMessage.bind(_this);
                                                     _this.awsRealTimeSocket.onerror = function(err) {
                                                         logger3(err);
@@ -3446,8 +3475,15 @@ var AppSyncRealTimeSubscriptionHandshakeLink = /*#__PURE__*/ function(_import_co
         {
             key: "_handleIncomingSubscriptionMessage",
             value: function _handleIncomingSubscriptionMessage(message) {
-                logger3("subscription message from AWS AppSync RealTime: ".concat(message.data));
-                var _JSON_parse = JSON.parse(message.data), _JSON_parse_id = _JSON_parse.id, id = _JSON_parse_id === void 0 ? "" : _JSON_parse_id, payload = _JSON_parse.payload, type = _JSON_parse.type;
+                var parsed;
+                try {
+                    parsed = JSON.parse(message.data);
+                } catch (e) {
+                    logger3("Failed to parse incoming subscription message");
+                    return;
+                }
+                var _parsed_id = parsed.id, id = _parsed_id === void 0 ? "" : _parsed_id, payload = parsed.payload, type = parsed.type;
+                logger3("subscription message from AWS AppSync RealTime: ".concat(type, " id: ").concat(id));
                 var _ref = this.subscriptionObserverMap.get(id) || {}, _ref_observer = _ref.observer, observer = _ref_observer === void 0 ? null : _ref_observer, _ref_query = _ref.query, query = _ref_query === void 0 ? "" : _ref_query, _ref_variables = _ref.variables, variables = _ref_variables === void 0 ? {} : _ref_variables, _ref_startAckTimeoutId = _ref.startAckTimeoutId, startAckTimeoutId = _ref_startAckTimeoutId === void 0 ? 0 : _ref_startAckTimeoutId, _ref_subscriptionReadyCallback = _ref.subscriptionReadyCallback, subscriptionReadyCallback = _ref_subscriptionReadyCallback === void 0 ? null : _ref_subscriptionReadyCallback, _ref_subscriptionFailedCallback = _ref.subscriptionFailedCallback, subscriptionFailedCallback = _ref_subscriptionFailedCallback === void 0 ? null : _ref_subscriptionFailedCallback;
                 logger3({
                     id: id,
@@ -3598,9 +3634,9 @@ function createSubscriptionHandshakeLink(infoOrUrl, theResultsFetcherLink) {
         subscriptionLinks = import_core4.ApolloLink.from([
             new NonTerminatingLink("controlMessages", _define_property({}, "link", new import_core4.ApolloLink(function(operation, _forward) {
                 return new import_core4.Observable(function(observer) {
-                    var _operation_variables = operation.variables, controlEvents = _operation_variables[CONTROL_EVENTS_KEY], variables = _object_without_properties(operation.variables, [
-                        CONTROL_EVENTS_KEY
-                    ].map(_to_property_key));
+                    var _ref = operation.variables, controlEvents = _ref[CONTROL_EVENTS_KEY], variables = _object_without_properties(_ref, [
+                        _to_property_key(CONTROL_EVENTS_KEY)
+                    ]);
                     if (typeof controlEvents !== "undefined") {
                         operation.variables = variables;
                     }