feat(api): AppSyncRTC 2.0.0 upgrade - Handle unauthorized connection (#1994)

* fix(api): AppSyncRTC 2.0.0 upgrade

* feat: add APIError.isUnauthorized helper

* use 401 instead of 403 for http status code

* address PR comments

* Add UnauthorizedDetermining

* add additional doc comment

* update naming

Author: lawmicha

AmplifyPlugins.podspec

@@ -36,7 +36,7 @@ Pod::Spec.new do |s|
 
   s.subspec 'AWSAPIPlugin' do |ss|
     ss.source_files = 'AmplifyPlugins/API/AWSAPICategoryPlugin/**/*.swift'
-    ss.dependency 'AppSyncRealTimeClient', "~> 1.8"
+    ss.dependency 'AppSyncRealTimeClient', "~> 2.0"
   end
 
   s.subspec 'AWSCognitoAuthPlugin' do |ss|

AmplifyPlugins/API/APICategoryPlugin.xcodeproj/project.pbxproj

@@ -70,6 +70,8 @@
 		21A4F98F25A7BF9E00E1047D /* AppSyncListResponseTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21A4F98E25A7BF9E00E1047D /* AppSyncListResponseTests.swift */; };
 		21A90541261644F700EC141D /* GraphQLScalarTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21A90540261644F700EC141D /* GraphQLScalarTests.swift */; };
 		21A9054C2616453200EC141D /* GraphQLTestBase.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21A9054B2616453200EC141D /* GraphQLTestBase.swift */; };
+		21B0AE7F287DEA7F0047C52F /* APIError+Unauthorized.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21B0AE7E287DEA7F0047C52F /* APIError+Unauthorized.swift */; };
+		21B0AE81287DF6840047C52F /* APIError+UnauthorizedTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21B0AE80287DF6840047C52F /* APIError+UnauthorizedTests.swift */; };
 		21D38B9B240C517C00EC2A8D /* AWSOIDCAuthProvider.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21D38B9A240C517C00EC2A8D /* AWSOIDCAuthProvider.swift */; };
 		21D5286724169E74005186BA /* IAMAuthInterceptor.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21D5286624169E74005186BA /* IAMAuthInterceptor.swift */; };
 		21D7A0DF237B54D90057D00D /* AWSGraphQLOperation.swift in Sources */ = {isa = PBXBuildFile; fileRef = 21D7A08D237B54D90057D00D /* AWSGraphQLOperation.swift */; };
@@ -405,6 +407,8 @@
 		21A4F98E25A7BF9E00E1047D /* AppSyncListResponseTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AppSyncListResponseTests.swift; sourceTree = "<group>"; };
 		21A90540261644F700EC141D /* GraphQLScalarTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GraphQLScalarTests.swift; sourceTree = "<group>"; };
 		21A9054B2616453200EC141D /* GraphQLTestBase.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = GraphQLTestBase.swift; sourceTree = "<group>"; };
+		21B0AE7E287DEA7F0047C52F /* APIError+Unauthorized.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "APIError+Unauthorized.swift"; sourceTree = "<group>"; };
+		21B0AE80287DF6840047C52F /* APIError+UnauthorizedTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = "APIError+UnauthorizedTests.swift"; sourceTree = "<group>"; };
 		21D38B9A240C517C00EC2A8D /* AWSOIDCAuthProvider.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = AWSOIDCAuthProvider.swift; sourceTree = "<group>"; };
 		21D5286624169E74005186BA /* IAMAuthInterceptor.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = IAMAuthInterceptor.swift; sourceTree = "<group>"; };
 		21D7A08D237B54D90057D00D /* AWSGraphQLOperation.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AWSGraphQLOperation.swift; sourceTree = "<group>"; };
@@ -903,15 +907,16 @@
 		21D7A08B237B54D90057D00D /* AWSAPICategoryPlugin */ = {
 			isa = PBXGroup;
 			children = (
+				21B0AE7E287DEA7F0047C52F /* APIError+Unauthorized.swift */,
 				219F7B1B25BF92C6007107D3 /* AWSAPIPlugin.md */,
 				21D7A09A237B54D90057D00D /* AWSAPIPlugin.swift */,
 				6B382B442538E53700906593 /* AWSAPIPlugin+APIAuthProviderFactoryBehavior.swift */,
+				211A81DC27176C7300C5483D /* AWSAPIPlugin+AuthInformation.swift */,
 				21D7A098237B54D90057D00D /* AWSAPIPlugin+Configure.swift */,
 				21D7A0B1237B54D90057D00D /* AWSAPIPlugin+GraphQLBehavior.swift */,
 				21D7A099237B54D90057D00D /* AWSAPIPlugin+InterceptorBehavior.swift */,
 				FA8EE784238632620097E4F1 /* AWSAPIPlugin+Log.swift */,
 				6B33897123AAD94800561E5B /* AWSAPIPlugin+Reachability.swift */,
-				211A81DC27176C7300C5483D /* AWSAPIPlugin+AuthInformation.swift */,
 				21D7A096237B54D90057D00D /* AWSAPIPlugin+Resettable.swift */,
 				21D7A0D0237B54D90057D00D /* AWSAPIPlugin+RESTBehavior.swift */,
 				21D7A0D1237B54D90057D00D /* AWSAPIPlugin+URLSessionBehaviorDelegate.swift */,
@@ -1157,6 +1162,7 @@
 		B4DFA5BE237A611D0013E17B /* AWSAPICategoryPluginTests */ = {
 			isa = PBXGroup;
 			children = (
+				21B0AE80287DF6840047C52F /* APIError+UnauthorizedTests.swift */,
 				211A81FE271851B000C5483D /* AWSAPICategoryPlugin+AuthInformationTests.swift */,
 				B4DFA5DE237A611D0013E17B /* AWSAPICategoryPlugin+ConfigureTests.swift */,
 				B4DFA5CC237A611D0013E17B /* AWSAPICategoryPlugin+GraphQLBehaviorTests.swift */,
@@ -2519,6 +2525,7 @@
 				6B33897023AABF1800561E5B /* NetworkReachability.swift in Sources */,
 				21D7A0FE237B54D90057D00D /* URLSessionDataTaskBehavior.swift in Sources */,
 				76148E0925D896EA007F3F21 /* URLComponents+sigv4Encoding.swift in Sources */,
+				21B0AE7F287DEA7F0047C52F /* APIError+Unauthorized.swift in Sources */,
 				21A4F94C25A7ACE600E1047D /* GraphQLRequest+toListQuery.swift in Sources */,
 				216449482587E92B00C548A5 /* GraphQLResponseDecoder.swift in Sources */,
 				21D7A0E5237B54D90057D00D /* AWSAPICategoryPluginConfiguration.swift in Sources */,
@@ -2556,6 +2563,7 @@
 				B4DFA5E1237A611D0013E17B /* MockURLSessionTask.swift in Sources */,
 				FAA7A5AA24C0E01500CA863F /* AWSGraphQLSubscriptionOperationCancelTests.swift in Sources */,
 				211BEDFB25E59DC8004F367A /* AWSHTTPURLResponseTests.swift in Sources */,
+				21B0AE81287DF6840047C52F /* APIError+UnauthorizedTests.swift in Sources */,
 				B4DFA5F8237A611D0013E17B /* AWSAPICategoryPlugin+ConfigureTests.swift in Sources */,
 				B4DFA5F1237A611D0013E17B /* AWSAPICategoryPlugin+URLSessionBehaviorDelegateTests.swift in Sources */,
 				B4DFA5E7237A611D0013E17B /* AWSAPICategoryPlugin+InterceptorBehaviorTests.swift in Sources */,

AmplifyPlugins/API/AWSAPICategoryPlugin/APIError+Unauthorized.swift

@@ -0,0 +1,63 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import Amplify
+import AppSyncRealTimeClient
+
+extension APIError {
+
+    static let UnauthorizedMessageString: String = "Unauthorized"
+
+    /// By default, this consolidates unauthorized error scenarios coming from `APIError.httpStatusError` and
+    /// `APIError.operationError`. For `.httpStatusError`, this checks if the status code is 401 or 403. For
+    /// `.operationError`, this checks if the error description contains "Unauthorized".
+    ///
+    /// **Warning** Customized server responses that indicate unauthorized may not match the internal mapping done
+    /// in this API and return `false`. Check APIError enum directly or create your own `UnauthorizedDeterming` rule,
+    /// for example:
+    /// ```
+    /// static let customRule = UnauthorizedDetermining { error in
+    ///     // Your custom logic to determine if `error` is unauthorized.
+    ///     // return `true` or `false`.
+    /// }
+    /// ```
+    ///
+    /// - Parameter rule: Used to determine if the `APIError` is an unauthorized error.
+    /// - Returns: `true` if unauthorized error, `false` otherwise
+    public func isUnauthorized(rule: UnauthorizedDetermining = .default) -> Bool {
+        rule.isUnauthorized(self)
+    }
+
+    public struct UnauthorizedDetermining {
+        let isUnauthorized: (APIError) -> Bool
+
+        public init(isUnauthenticated: @escaping (APIError) -> Bool) {
+            self.isUnauthorized = isUnauthenticated
+        }
+
+        public static let `default` = UnauthorizedDetermining { error in
+            error.containsUnauthorizedMessageString || error.is401or403
+        }
+    }
+
+    private var is401or403: Bool {
+        switch self {
+        case .httpStatusError(let statusCode, _):
+            return statusCode == 401 || statusCode == 403
+        default:
+            return false
+        }
+    }
+
+    private var containsUnauthorizedMessageString: Bool {
+        switch self {
+        case .operationError(let errorDescription, _, _):
+            return errorDescription.range(of: APIError.UnauthorizedMessageString, options: .caseInsensitive) != nil
+        default: return false
+        }
+    }
+}

AmplifyPlugins/API/AWSAPICategoryPlugin/Operation/AWSGraphQLSubscriptionOperation.swift

@@ -174,18 +174,36 @@ final public class AWSGraphQLSubscriptionOperation<R: Decodable>: GraphQLSubscri
     }
 
     private func onSubscriptionFailure(_ error: Error) {
-        let errorDescription = "Subscription item event failed with error"
+        var errorDescription = "Subscription item event failed with error"
         if case let ConnectionProviderError.subscription(_, payload) = error,
            let errors = payload?["errors"] as? AppSyncJSONValue,
            let graphQLErrors = try? GraphQLErrorDecoder.decodeAppSyncErrors(errors) {
+
+            if graphQLErrors.hasUnauthorizedError() {
+                errorDescription += ": \(APIError.UnauthorizedMessageString)"
+            }
+
             let graphQLResponseError = GraphQLResponseError<R>.error(graphQLErrors)
             dispatch(result: .failure(APIError.operationError(errorDescription, "", graphQLResponseError)))
             finish()
             return
+        } else if case ConnectionProviderError.unauthorized = error {
+            errorDescription += ": \(APIError.UnauthorizedMessageString)"
         }
 
         dispatch(result: .failure(APIError.operationError(errorDescription, "", error)))
         finish()
     }
+}
 
+extension Array where Element == GraphQLError {
+    func hasUnauthorizedError() -> Bool {
+        contains { graphQLError in
+            if case let .string(errorTypeValue) = graphQLError.extensions?["errorType"],
+               case .unauthorized = AppSyncErrorType(errorTypeValue) {
+                return true
+            }
+            return false
+        }
+    }
 }

AmplifyPlugins/API/AWSAPICategoryPluginIntegrationTests/GraphQL/GraphQLWithUserPoolIntegrationTests/GraphQLWithUserPoolIntegrationTests.swift

@@ -496,6 +496,46 @@ class GraphQLWithUserPoolIntegrationTests: XCTestCase {
         waitForExpectations(timeout: TestCommonConstants.networkTimeout)
     }
 
+    /// The user is not signed in so establishing the subscription will fail with an unauthorized error.
+    func testOnCreateSubscriptionUnauthorized() {
+        Amplify.Logging.logLevel = .verbose
+        let connectingInvoked = expectation(description: "Connecting invoked")
+        let connectedInvoked = expectation(description: "Connection established")
+        connectedInvoked.isInverted = true
+        let completedInvoked = expectation(description: "Completed invoked")
+        let request = GraphQLRequest(document: OnCreateTodoSubscription.document,
+                                     variables: nil,
+                                     responseType: OnCreateTodoSubscription.Data.self)
+        let operation = Amplify.API.subscribe(
+            request: request,
+            valueListener: { event in
+                switch event {
+                case .connection(let state):
+                    switch state {
+                    case .connecting:
+                        connectingInvoked.fulfill()
+                    case .connected:
+                        connectedInvoked.fulfill()
+                    case .disconnected:
+                        break
+                    }
+                case .data:
+                    break
+                }
+        }, completionListener: { event in
+            switch event {
+            case .failure(let error):
+                if error.isUnauthorized() {
+                    completedInvoked.fulfill()
+                }
+            case .success:
+                XCTFail("Unexpected success")
+            }
+        })
+        XCTAssertNotNil(operation)
+        wait(for: [connectingInvoked, connectedInvoked, completedInvoked], timeout: TestCommonConstants.networkTimeout)
+    }
+
     /// Given: A successful subscription is created for CreateTodo's
     /// When: Call mutate API on CreateTodo
     /// Then: The subscription handler is called and Todo object is returned

AmplifyPlugins/API/AWSAPICategoryPluginTests/APIError+UnauthorizedTests.swift

@@ -0,0 +1,38 @@
+//
+// Copyright Amazon.com Inc. or its affiliates.
+// All Rights Reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+import XCTest
+
+@testable import Amplify
+@testable import AWSAPICategoryPlugin
+
+class APIErrorUnauthorizedTests: XCTestCase {
+
+    func testAPIErrorUnauthorized() throws {
+        let apiError = APIError.operationError("Unauthorized", "", nil)
+
+        XCTAssertTrue(apiError.isUnauthorized())
+    }
+
+    func testAPIErrorUnauthorizedLowerCase() throws {
+        let apiError = APIError.operationError("unauthorized", "", nil)
+
+        XCTAssertTrue(apiError.isUnauthorized())
+    }
+
+    func testAPIErrorHTTPStatus401() throws {
+        let apiError = APIError.httpStatusError(401, .init())
+
+        XCTAssertTrue(apiError.isUnauthorized())
+    }
+
+    func testAPIErrorHTTPStatus403() throws {
+        let apiError = APIError.httpStatusError(403, .init())
+
+        XCTAssertTrue(apiError.isUnauthorized())
+    }
+}

AmplifyPlugins/API/Podfile

@@ -8,7 +8,7 @@ include_build_tools!
 target 'AWSAPICategoryPlugin' do
 	pod 'Amplify', :path => '../../'
   pod 'AWSPluginsCore', :path => '../../'
-  pod "AppSyncRealTimeClient", "~> 1.8"
+  pod "AppSyncRealTimeClient", "~> 2.0"
 
   target "AWSAPICategoryPluginTests" do
     inherit! :complete

AmplifyPlugins/API/Podfile.lock

@@ -19,7 +19,7 @@ PODS:
     - AWSMobileClient (~> 2.27.0)
     - AWSPluginsCore (= 1.26.2)
     - CwlPreconditionTesting (~> 2.0)
-  - AppSyncRealTimeClient (1.10.0):
+  - AppSyncRealTimeClient (2.0.0):
     - Starscream (~> 4.0.4)
   - AWSAuthCore (2.27.10):
     - AWSCore (= 2.27.10)
@@ -54,7 +54,7 @@ DEPENDENCIES:
   - Amplify (from `../../`)
   - AmplifyPlugins/AWSCognitoAuthPlugin (from `../../`)
   - AmplifyTestCommon (from `../../`)
-  - AppSyncRealTimeClient (~> 1.8)
+  - AppSyncRealTimeClient (~> 2.0)
   - AWSPluginsCore (from `../../`)
   - CwlPreconditionTesting (from `https://github.com/mattgallagher/CwlPreconditionTesting.git`, tag `2.1.0`)
   - SwiftFormat/CLI (= 0.44.17)
@@ -98,7 +98,7 @@ SPEC CHECKSUMS:
   Amplify: a4747a22276b4994cfdb29ea8cdbe6eed7964e9f
   AmplifyPlugins: c5af5605be693b8c21afa5e69a8f787f02f55165
   AmplifyTestCommon: 20bb0ea2535f69ede737d37bb4fcc7a387b9b15d
-  AppSyncRealTimeClient: 656ab4215e05f6ca47fe6d8c73f416d9984a8aac
+  AppSyncRealTimeClient: 186ce6451db2081ccd3f8f454b109c5e4e7025b1
   AWSAuthCore: ea9baff143a5ff4a98cea3954b006cedc96cd47e
   AWSCognitoIdentityProvider: 7ef13d7a86298db707165208f01b92997cc3b5af
   AWSCognitoIdentityProviderASF: d745c40a37815ef1c547f9677145d4e522f582f3
@@ -114,6 +114,6 @@ SPEC CHECKSUMS:
   SwiftFormat: 3b5caa6389b2b9adbc00e133b3ccc8c6e687a6a4
   SwiftLint: f80f1be7fa96d30e0aa68e58d45d4ea1ccaac519
 
-PODFILE CHECKSUM: 54e87158e45936fe60756d4a417b89eb64ea1c51
+PODFILE CHECKSUM: 2a9177ccb9833844ad436a0c7c9e5768a7ab8868
 
 COCOAPODS: 1.11.3

AmplifyPlugins/DataStore/Podfile.lock

@@ -3,7 +3,7 @@ PODS:
     - Amplify/Default (= 1.26.2)
   - Amplify/Default (1.26.2)
   - AmplifyPlugins/AWSAPIPlugin (1.26.2):
-    - AppSyncRealTimeClient (~> 1.8)
+    - AppSyncRealTimeClient (~> 2.0)
     - AWSCore (~> 2.27.0)
     - AWSPluginsCore (= 1.26.2)
   - AmplifyPlugins/AWSCognitoAuthPlugin (1.26.2):
@@ -23,7 +23,7 @@ PODS:
     - AWSMobileClient (~> 2.27.0)
     - AWSPluginsCore (= 1.26.2)
     - CwlPreconditionTesting (~> 2.0)
-  - AppSyncRealTimeClient (1.10.0):
+  - AppSyncRealTimeClient (2.0.0):
     - Starscream (~> 4.0.4)
   - AWSAuthCore (2.27.10):
     - AWSCore (= 2.27.10)
@@ -106,9 +106,9 @@ CHECKOUT OPTIONS:
 
 SPEC CHECKSUMS:
   Amplify: a4747a22276b4994cfdb29ea8cdbe6eed7964e9f
-  AmplifyPlugins: c5af5605be693b8c21afa5e69a8f787f02f55165
+  AmplifyPlugins: 7e91dfcbde64a7a12a816a594a73b3839880488c
   AmplifyTestCommon: 20bb0ea2535f69ede737d37bb4fcc7a387b9b15d
-  AppSyncRealTimeClient: 656ab4215e05f6ca47fe6d8c73f416d9984a8aac
+  AppSyncRealTimeClient: 186ce6451db2081ccd3f8f454b109c5e4e7025b1
   AWSAuthCore: ea9baff143a5ff4a98cea3954b006cedc96cd47e
   AWSCognitoIdentityProvider: 7ef13d7a86298db707165208f01b92997cc3b5af
   AWSCognitoIdentityProviderASF: d745c40a37815ef1c547f9677145d4e522f582f3