subscription roomCountUpdated security fix

backend/src/schema/resolvers/rooms.ts

@@ -20,8 +20,8 @@ export default {
     roomCountUpdated: {
       subscribe: withFilter(
         () => pubsub.asyncIterator(ROOM_COUNT_UPDATED),
-        (payload, variables) => {
-          return payload.userId === variables.userId
+        (payload, variables, context) => {
+          return payload.userId === context.user?.id
         },
       ),
     },

backend/src/schema/types/type/Room.gql

@@ -57,5 +57,5 @@ type Query {
 }
 
 type Subscription {
-  roomCountUpdated(userId: ID!): Int
+  roomCountUpdated: Int
 }

webapp/components/ChatNotificationMenu/ChatNotificationMenu.vue

@@ -44,11 +44,6 @@ export default {
       },
       subscribeToMore: {
         document: roomCountUpdated(),
-        variables() {
-          return {
-            userId: this.user.id,
-          }
-        },
         updateQuery: (previousResult, { subscriptionData }) => {
           return { UnreadRooms: subscriptionData.data.roomCountUpdated }
         },

webapp/graphql/Rooms.js

@@ -52,8 +52,8 @@ export const unreadRoomsQuery = () => {
 
 export const roomCountUpdated = () => {
   return gql`
-    subscription roomCountUpdated($userId: ID!) {
-      roomCountUpdated(userId: $userId)
+    subscription roomCountUpdated {
+      roomCountUpdated
     }
   `
 }