Merge pull request #6621 from Ocelot-Social-Community/fix-security-subscriptions

fix(backend): security subscriptions

backend/src/schema/resolvers/messages.ts

@@ -25,8 +25,8 @@ export default {
     chatMessageAdded: {
       subscribe: withFilter(
         () => pubsub.asyncIterator(CHAT_MESSAGE_ADDED),
-        (payload, variables) => {
-          return payload.userId === variables.userId
+        (payload, variables, context) => {
+          return payload.userId === context.user?.id
         },
       ),
     },

backend/src/schema/resolvers/notifications.ts

@@ -7,8 +7,8 @@ export default {
     notificationAdded: {
       subscribe: withFilter(
         () => pubsub.asyncIterator(NOTIFICATION_ADDED),
-        (payload, variables) => {
-          return payload.notificationAdded.to.id === variables.userId
+        (payload, variables, context) => {
+          return payload.notificationAdded.to.id === context.user?.id
         },
       ),
     },

backend/src/schema/resolvers/rooms.ts

@@ -20,8 +20,8 @@ export default {
     roomCountUpdated: {
       subscribe: withFilter(
         () => pubsub.asyncIterator(ROOM_COUNT_UPDATED),
-        (payload, variables) => {
-          return payload.userId === variables.userId
+        (payload, variables, context) => {
+          return payload.userId === context.user?.id
         },
       ),
     },

backend/src/schema/types/type/Message.gql

@@ -46,5 +46,5 @@ type Query {
 }
 
 type Subscription {
-  chatMessageAdded(userId: ID!): Message
+  chatMessageAdded: Message
 }

backend/src/schema/types/type/NOTIFIED.gql

@@ -38,5 +38,5 @@ type Mutation {
 }
 
 type Subscription {
-  notificationAdded(userId: ID!): NOTIFIED
+  notificationAdded: NOTIFIED
 }

backend/src/schema/types/type/Room.gql

@@ -58,5 +58,5 @@ type Query {
 }
 
 type Subscription {
-  roomCountUpdated(userId: ID!): Int
+  roomCountUpdated: Int
 }

webapp/components/Chat/Chat.vue

@@ -181,9 +181,6 @@ export default {
     // Subscriptions
     const observer = this.$apollo.subscribe({
       query: chatMessageAdded(),
-      variables: {
-        userId: this.currentUser.id,
-      },
     })
 
     observer.subscribe({

webapp/components/ChatNotificationMenu/ChatNotificationMenu.vue

@@ -44,11 +44,6 @@ export default {
       },
       subscribeToMore: {
         document: roomCountUpdated(),
-        variables() {
-          return {
-            userId: this.user.id,
-          }
-        },
         updateQuery: (previousResult, { subscriptionData }) => {
           return { UnreadRooms: subscriptionData.data.roomCountUpdated }
         },

webapp/components/NotificationMenu/NotificationMenu.vue

@@ -137,11 +137,6 @@ export default {
       },
       subscribeToMore: {
         document: notificationAdded(),
-        variables() {
-          return {
-            userId: this.user.id,
-          }
-        },
         updateQuery: (previousResult, { subscriptionData }) => {
           const {
             data: { notificationAdded: newNotification },

webapp/graphql/Messages.js

@@ -54,8 +54,8 @@ export const messageQuery = () => {
 
 export const chatMessageAdded = () => {
   return gql`
-    subscription chatMessageAdded($userId: ID!) {
-      chatMessageAdded(userId: $userId) {
+    subscription chatMessageAdded {
+      chatMessageAdded {
         _id
         id
         indexId

webapp/graphql/Rooms.js

@@ -66,8 +66,8 @@ export const unreadRoomsQuery = () => {
 
 export const roomCountUpdated = () => {
   return gql`
-    subscription roomCountUpdated($userId: ID!) {
-      roomCountUpdated(userId: $userId)
+    subscription roomCountUpdated {
+      roomCountUpdated
     }
   `
 }

webapp/graphql/User.js

@@ -245,8 +245,8 @@ export const notificationAdded = () => {
     ${postFragment}
     ${groupFragment}
 
-    subscription notifications($userId: ID!) {
-      notificationAdded(userId: $userId) {
+    subscription notifications {
+      notificationAdded {
         id
         read
         reason