How to unsubscribe from server side

[namnm]

Hi, thank you and the community making a great work on this package.

I would like to ask in case of authentication or authorization changed, how do we unsubscribe or disconnect the socket from server side?

Story

The client connect to server, it will go through onConnect and server check for authentication in header, assume passed.
Then the client send the actual subscription with the following:

subscription {
  dataCreated(orgId: String!): Data!
}

It will go through onSubscribe, here we check for authorization if that user can access that event from that orgId, assume passed.
We use pubsub and withFilter to compare the orgId to filter so it will receive the event from the correct org.

Acceptance criteria

1. Now if authorization changed somewhere else, this user no longer have access to that event from that orgId, how do we remove the subscription listener here on server side?
2. Same in case of authentication changed, need to completely disconnect the socket?

[enisdenjo]

Same in case of authentication changed, need to completely disconnect the socket?

I always recommend to completely kick off the client for re-authentication. It will have the client re-run the connecting phase allowing the server to properly authorise. Once the client reconnects, it will resubscribe all previously active subscriptions.

Assuming you're using the built-in servers, the socket is always available in the context's extras. I recommend closing with the 4403: Forbidden close code, but you're free to close with any non-fatal close code you wish. For example, with graphql-ws/lib/use/ws:

import { WebSocketServer } from 'ws';
import { useServer } from 'graphql-ws/lib/use/ws';
import { CloseCode } from 'graphql-ws';

const server = new WebSocketServer({
  port: 4000,
  path: '/graphql',
});

useServer(
  {
    // ...
    onConnect: (ctx) => {
      ctx.extra.socket.close(CloseCode.Forbidden);
    },
    onSubscribe: (ctx) => {
      // or
      ctx.extra.socket.close(CloseCode.Forbidden);
    },
    onNext: (ctx) => {
      // or
      ctx.extra.socket.close(CloseCode.Forbidden);
    },
    onError: (ctx) => {
      // or
      ctx.extra.socket.close(CloseCode.Forbidden);
    },
    onComplete: (ctx) => {
      // or
      ctx.extra.socket.close(CloseCode.Forbidden);
    },
  },
  server,
);

Now if authorization changed somewhere else, this user no longer have access to that event from that orgId, how do we remove the subscription listener here on server side?

I still recommend kicking off the client completely since it's much safer, but if you want this approach still - you'll have to build the logic yourself. You can find the list of all active subscriptions in Context.subscriptions.