fix(api-graphql): trigger WebSocket reconnection on auth errors (#14569)

Detect authentication errors (UnauthorizedException, NotAuthorizedException,
Token expired) in subscription error responses using exact errorType matching
and close the WebSocket to trigger reconnection with fresh tokens.

Handles both EVENT_SUBSCRIBE_ERROR (structured errors array) and GQL_ERROR
(payload errors) message types.

The socket close fires the existing CONNECTION_CLOSED → ConnectionDisrupted →
ReconnectionMonitor flow, so no changes needed in DataStore's disconnectionHandler.

Fixes #12954

Co-authored-by: Osama Rizk <41443120+osama-rizk@users.noreply.github.com>
Co-authored-by: Philipp Andreas Paul <phandpau@amazon.de>

Author: 3 people

.changeset/fix-websocket-auth-reconnection.md

@@ -0,0 +1,5 @@
+---
+'@aws-amplify/api-graphql': patch
+---
+
+fix(api-graphql): trigger WebSocket reconnection on auth errors to restore subscriptions after token expiration

packages/api-graphql/src/Providers/AWSWebSocketProvider/index.ts

@@ -701,17 +701,50 @@ export abstract class AWSWebSocketProvider {
 				});
 
 				let errorMessage = JSON.stringify(payload ?? data);
+				let isAuthError = false;
+
+				const AUTH_ERROR_TYPES = [
+					'UnauthorizedException',
+					'Unauthorized',
+					'NotAuthorizedException',
+				];
 
 				if (type === MESSAGE_TYPES.EVENT_SUBSCRIBE_ERROR) {
 					const { errors } = JSON.parse(String(message.data));
 					if (Array.isArray(errors) && errors.length > 0) {
 						const error = errors[0];
 						errorMessage = `${error.errorType}: ${error.message}`;
+						isAuthError =
+							AUTH_ERROR_TYPES.includes(error.errorType) ||
+							error.message?.includes('Token expired');
+					}
+				} else if (
+					type === MESSAGE_TYPES.GQL_ERROR &&
+					payload &&
+					typeof payload === 'object'
+				) {
+					const { errors } = payload as Record<string, unknown>;
+					if (Array.isArray(errors) && errors.length > 0) {
+						const error = errors[0] as Record<string, string>;
+						isAuthError =
+							AUTH_ERROR_TYPES.includes(error.errorType) ||
+							error.message?.includes('Token expired');
 					}
 				}
 
 				this.logger.debug(`${CONTROL_MSG.CONNECTION_FAILED}: ${errorMessage}`);
 
+				// On auth errors, close the socket to trigger reconnection with fresh tokens.
+				// The onclose handler fires _errorDisconnect → CONNECTION_CLOSED, which the
+				// ConnectionStateMonitor picks up as ConnectionDisrupted and the
+				// ReconnectionMonitor reconnects with refreshed credentials.
+				if (isAuthError && this.awsRealTimeSocket) {
+					this.logger.warn(
+						'Subscription failed due to auth error, closing WebSocket to trigger reconnection with fresh tokens',
+					);
+					this.awsRealTimeSocket.close(1000, 'Auth error - reconnecting');
+				}
+
 				observer.error({
 					errors: [
 						{