react-native-action-cable-jwt

Compatible 100% Rails 5 + GRAPHQL RUBY ~> '1.8.5'

Make your mobile application safer by avoiding to send tokens via url. Submit your jwt token from your application via the Action Cable header. Why not send JWT tokens via URL? read more: https://bit.ly/2nZ4GbS

INSTALL

npm install --save react-native-action-cable-jwt

USAGE

React Native

import ActionCableJwt from 'react-native-action-cable-jwt';
import ActionCableLink from 'graphql-ruby-client/subscriptions/ActionCableLink';

const url = 'http://YOUR_URL';

const wsUri = `ws://${url}/cable`;
const actionCableJwt = ActionCableJwt.createConnection(async () => {
  const token = await AsyncStorage.getItem('@token');
  return token;
});
const cable = actionCableJwt.createConsumer(wsUri);
const webSocketLink = new ActionCableLink({ cable });

Rails + GRAPHQL RUBY

app/channels/graphql_channel.rb

class GraphqlChannel < ApplicationCable::Channel
  def subscribed    
    @subscription_ids = []
  end

  def execute(data)
    query = data['query']
    variables = ensure_hash(data['variables'])
    operation_name = data['operationName']
    context = {
      current_user: current_user,
      channel: self,
    }

    result = YOURSCHEMA.execute(query: query,
      context: context,
      variables: variables,
      operation_name: operation_name)

    payload = {
      result: result.subscription? ? {data: nil} : result.to_h,
      more: result.subscription?
    }

    if result.context[:subscription_id]
      @subscription_ids << context[:subscription_id]
    end

    transmit(payload)
  end

  def unsubscribed
    @subscription_ids.each { |sid|
      YOURSCHEMA.subscriptions.delete_subscription(sid)
    }
  end

  private

  def ensure_hash(ambiguous_param)
    case ambiguous_param
    when String
      ambiguous_param.present? ? ensure_hash(JSON.parse(ambiguous_param)) : {}
    when Hash, ActionController::Parameters
      ambiguous_param
    when nil
      {}
    else
      raise ArgumentError, "Unexpected parameter: #{ambiguous_param}"
    end
  end  
end

app/channels/application_cable/connection.rb

module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user    

    def connect      
      self.current_user = find_verified_user || reject_unauthorized_connection      
    end  

    def disconnect
      # Any cleanup work needed when the cable connection is cut.
    end    

    protected
    def find_verified_user
      header_array = request.headers[:HTTP_SEC_WEBSOCKET_PROTOCOL].split(',')
      token = header_array[header_array.length-1]      
      return nil if token.blank?     
      # Example with authetication via GEM 'json_web_token' 
      current_user = AuthToken.verify(token)
       return current_user ? current_user.id : nil
    end      
  end
end