feat: add real WebSocket E2E integration test for realtime subscriptions

[pyramation]

Summary

Adds a full end-to-end integration test suite for realtime subscriptions over real WebSocket connections (not mocked grafast.subscribe() calls). Also fixes a bug in the realtime subscriptions plugin where args.get('ids') was using the deprecated grafast FieldArgs API.

Bug fix (plugin.ts): Changed args.get('ids') → args.getRaw('ids'). The grafast FieldArgs.get() method is deprecated (typed as never) and was causing "args.get is not a function" errors during subscription planning. .getRaw() is the correct API.

New test file (realtime-websocket.integration.test.ts): 7 test cases covering:

• Sanity check via direct grafastSubscribe
• INSERT, UPDATE, DELETE event delivery over WebSocket
• INVALIDATE (overflow) events
• Sparse set filtering via ids argument
• Multiple concurrent WebSocket subscribers
• Raw NOTIFY payload handling

The test infrastructure seeds a PostgreSQL database, builds a GraphQL schema with RealtimeSubscriptionsPlugin, starts a real HTTP + WebSocket server (ws + graphql-ws/use/ws), and connects a graphql-ws client over an actual WebSocket transport.

Review & Testing Checklist for Human

• Verify args.getRaw('ids') correctness: Confirm that .getRaw() returns the expected grafast step type and that the downstream lambda in the subscribePlan correctly receives string[] | null | undefined at runtime. This is a production code change.
• Sparse set filtering design: The test asserts that non-matching events arrive with event: 'UNKNOWN' and rowId: null (lines 377-387) because grafast subscriptions don't support event-level inhibition. Verify this is the intended client-side filtering contract.
• Timing-based test stability: Tests use delay(200)–delay(500) for event propagation. Verify these are sufficient for CI environments under load. Consider whether any of these could be flaky.
• Lockfile audit: The lockfile includes graphql-ws 6.0.7→6.0.8 and ws 8.19.0→8.20.1 version bumps across the workspace. Spot-check that no unintended transitive changes were introduced.

Recommended test plan: Run cd graphile/graphile-realtime-test && npx jest realtime-websocket locally against a seeded PostgreSQL instance to verify all 7 tests pass.

Notes

• The existing realtime.integration.test.ts has a pre-existing module resolution error on main (not introduced by this PR).
• The pgSubscriber is manually threaded into the grafast context via the graphql-ws subscribe handler — this mirrors how PostGraphile would wire it but is not identical to the production preset integration path.

Link to Devin session: https://app.devin.ai/sessions/19485cf5cc58416a9f86068563d512f5
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​pgpm/​metaschema-schema@​0.18.0
	@​pgpm/​metaschema-modules@​0.21.1
	@​pgpm/​database-jobs@​0.18.0
	@​pgpm/​inflection@​0.18.0
	@​pgpm/​types@​0.18.0
	@​pgpm/​verify@​0.18.0
	@​launchql/​styled-email@​0.1.0
	@​pgpm/​services@​0.18.0
	@​jest/​test-sequencer@​30.3.0
	@​launchql/​mjml@​0.1.1
	@​constructive-io/​fetch@​1.0.0
	@​agentic-kit/​ollama@​1.0.3
	@​inquirerer/​utils@​3.3.5
	@​inquirerer/​test@​1.4.1
	@​dataplan/​json@​1.0.0
	@​babel/​generator@​7.29.1
	@​constructive-io/​noble-hashes@​0.2.1
	@​0no-co/​graphql.web@​1.2.0
	@​dataplan/​pg@​1.0.0
	@​aws-sdk/​lib-storage@​3.1009.0
	@​graphile-contrib/​pg-many-to-many@​2.0.0-rc.2
	@​testing-library/​react@​11.2.5
	@​tanstack/​react-query@​5.90.21
	@​graphile/​simplify-inflection@​8.0.0
	@​testing-library/​jest-dom@​5.11.10
	@​pgsql/​traverse@​17.2.5
	@​pgsql/​utils@​17.8.15
	@​aws-sdk/​client-s3@​3.1009.0
	@​aws-sdk/​s3-request-presigner@​3.1017.0
	@​playwright/​test@​1.58.2

View full report