graphql

emccue 2020-11-09T18:10:09.058700Z

I am actually in the same boat right now

emccue 2020-11-09T18:10:20.059Z

["/api/v1/graphql" :post
         (-> (lp/default-interceptors (graphql/compiled-schema) {:system system})
             (inject (interceptor/interceptor `auth/requires-auth-interceptor)
                     :after :com.walmartlabs.lacinia.pedestal2/inject-app-context)
             (inject {:name ::graphql-context-user-injector
                      :enter (fn [ctx]
                               (assoc-in ctx
                                 [:request :lacinia-app-context :user]
                                 (:user (:request ctx))))}
                     :after :com.walmartlabs.lacinia.pedestal2/inject-app-context))
         :route-name ::graphql]}

emccue 2020-11-09T18:10:28.059300Z

I have this as my normal graphql route

emccue 2020-11-09T18:10:55.059800Z

and I want to set up subscriptions with the same interceptors and context

emccue 2020-11-09T18:11:07.060100Z

(lp/enable-subscriptions (graphql/compiled-schema)
                                 {:subscriptions-path "/api/v1/ws"})

emccue 2020-11-09T18:12:28.060800Z

but the docs on the matter point to listener-fn-factory as where I should look for the options

emccue 2020-11-09T18:12:56.061200Z

but that function isn't in the same namespace, so its already somewhat confusing

emccue 2020-11-09T18:14:35.061700Z

but I at least see :app-context for the static values

emccue 2020-11-09T18:17:04.062200Z

and I at least can infer that I need to mess with :subscription-interceptors and default-subscription-interceptors

emccue 2020-11-09T18:17:32.062700Z

but all of this feels like it could be better documented, since I am primarily sleuthing through the code

emccue 2020-11-09T18:17:41.063Z

and not reading the docs anymore

emccue 2020-11-09T18:24:29.064500Z

i'm unclear if default-subscription-interceptors can take the function that can be later called to make a schema or if I need to definitely pre-compile before running

emccue 2020-11-09T18:24:31.064700Z

and so on

orestis 2020-11-09T18:31:38.065400Z

I’m not clear if the default-subscription-interceptors relate to the websocket itself (pedestal doesn’t actually give you interceptors for websockets, does it?)

orestis 2020-11-09T18:33:27.067500Z

And I’ve no idea what happens with authentication etc. Websockets suffer from cross-origin attacks (there’s no CORS policy for websockets) so I want to add some code there that does some checks before upgrading the connection — but it’s unclear where to plug in.

orestis 2020-11-09T18:34:04.068400Z

I’m still in the preliminary background research phase but my instincts say to do the integration on my own, starting with pedestal proper.

gklijs 2020-11-10T08:38:40.069500Z

Probably little use, but I have a compojure example where I check the session/cookie to do the upgrade. https://github.com/gklijs/mv/blob/fe3cf2636317a2550c82f11b801cfed381d81637/src/clj/m_venue/websocket.clj#L51

orestis 2020-11-10T13:46:25.069800Z

Right, that suffers from websocket CSRF

emccue 2020-11-09T18:48:19.068800Z

@orestis LMK what you end up with

emccue 2020-11-09T18:48:29.069100Z

and I'll do the same when it gets working