Step 7.13: Create subscriptionLogic

package.json

@@ -30,6 +30,7 @@
     "faker": "^4.1.0",
     "graphql": "^0.13.2",
     "graphql-date": "^1.0.3",
+    "iterall": "^1.2.2",
     "jsonwebtoken": "^8.3.0",
     "lodash": "^4.17.4",
     "sequelize": "^4.4.2",

server/data/logic.js

@@ -224,3 +224,28 @@ export const userLogic = {
     });
   },
 };
+
+export const subscriptionLogic = {
+  groupAdded(params, args, ctx) {
+    return getAuthenticatedUser(ctx)
+      .then((user) => {
+        if (user.id !== args.userId) {
+          throw new ForbiddenError('Unauthorized');
+        }
+
+        return Promise.resolve();
+      });
+  },
+  messageAdded(params, args, ctx) {
+    return getAuthenticatedUser(ctx)
+      .then(user => user.getGroups({ where: { id: { $in: args.groupIds } }, attributes: ['id'] })
+        .then((groups) => {
+          // user attempted to subscribe to some groups without access
+          if (args.groupIds.length > groups.length) {
+            throw new ForbiddenError('Unauthorized');
+          }
+
+          return Promise.resolve();
+        }));
+  },
+};

server/data/resolvers.js

@@ -7,7 +7,7 @@ import jwt from 'jsonwebtoken';
 import { Group, Message, User } from './connectors';
 import { pubsub } from '../subscriptions';
 import { JWT_SECRET } from '../config';
-import { groupLogic, messageLogic, userLogic } from './logic';
+import { groupLogic, messageLogic, userLogic, subscriptionLogic } from './logic';
 
 const MESSAGE_ADDED_TOPIC = 'messageAdded';
 const GROUP_ADDED_TOPIC = 'groupAdded';
@@ -106,7 +106,10 @@ export const resolvers = {
   Subscription: {
     messageAdded: {
       subscribe: withFilter(
-        () => pubsub.asyncIterator(MESSAGE_ADDED_TOPIC),
+        (payload, args, ctx) => pubsub.asyncAuthIterator(
+          MESSAGE_ADDED_TOPIC,
+          subscriptionLogic.messageAdded(payload, args, ctx),
+        ),
         (payload, args, ctx) => {
           return ctx.user.then((user) => {
             return Boolean(
@@ -120,7 +123,10 @@ export const resolvers = {
     },
     groupAdded: {
       subscribe: withFilter(
-        () => pubsub.asyncIterator(GROUP_ADDED_TOPIC),
+        (payload, args, ctx) => pubsub.asyncAuthIterator(
+          GROUP_ADDED_TOPIC,
+          subscriptionLogic.groupAdded(payload, args, ctx),
+        ),
         (payload, args, ctx) => {
           return ctx.user.then((user) => {
             return Boolean(

server/subscriptions.js

@@ -1,5 +1,24 @@
+import { $$asyncIterator } from 'iterall';
 import { PubSub } from 'apollo-server';
 
 export const pubsub = new PubSub();
 
+pubsub.asyncAuthIterator = (messages, authPromise) => {
+  const asyncIterator = pubsub.asyncIterator(messages);
+  return {
+    next() {
+      return authPromise.then(() => asyncIterator.next());
+    },
+    return() {
+      return authPromise.then(() => asyncIterator.return());
+    },
+    throw(error) {
+      return asyncIterator.throw(error);
+    },
+    [$$asyncIterator]() {
+      return asyncIterator;
+    },
+  };
+};
+
 export default pubsub;